2c9221d81b7acec5460bce5e913b2e93a219f920b5285738c399378da5ea7f57

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_71197795dc93a18e1408546f454c0cbc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 3.6MB
Sample260922-pnet9aszhy
SHA256 2c9221d81b7acec5460bce5e913b2e93a219f920b5285738c399378da5ea7f57
MD5 71197795dc93a18e1408546f454c0cbc
SHA1 efe77e4a19b8b28be222eff5edc50a41dd8b0a50
SHA512 8b0ca97760c28d19ee2232d4e24c43da993a5d0d45883d4b39e33d06f408e80673d5d8e32ea6df480e6060c106e02346b3d97534a2f4297f488056e63438f360
SSDEEP 49152:3eqDxpkcC/JaG5TJxlGc6O9p+XyrfOM0NghZYHiqWhM03TxDZY8fgC2KUcLN/j2B:mB/Zzlv64sXi7ukF1j2jF
TLSH
T140066B23B2E600D8C05DD1759B468332AAE1BCA58F70A3DF465177161FB6ED06B3E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4664	alg.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2124	elevation_service.exe
3336	elevation_service.exe
3952	maintenanceservice.exe
3096	OSE.EXE
4576	fxssvc.exe
4916	msdtc.exe
3248	PerceptionSimulationService.exe
3488	perfhost.exe
3100	locator.exe
5072	SensorDataService.exe
1616	snmptrap.exe
4396	spectrum.exe
4500	ssh-agent.exe
2628	TieringEngineService.exe
1764	AgentService.exe
4640	vds.exe
1348	vssvc.exe
4284	wbengine.exe
2016	WmiApSrv.exe
684	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-21_71197795dc93a18e1408546f454c0cbc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_71197795dc93a18e1408546f454c0cbc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_71197795dc93a18e1408546f454c0cbc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-21_71197795dc93a18e1408546f454c0cbc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-21_71197795dc93a18e1408546f454c0cbc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\526d29adc665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033c60b178e4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045bb5d168e4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000860cf3178e4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2f658168e4add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5b7ba168e4add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e315fb168e4add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e0126178e4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c7cbf168e4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000793fe3168e4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe
2124	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1656	2026-09-21_71197795dc93a18e1408546f454c0cbc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	2228	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2124	elevation_service.exe
Token: SeAuditPrivilege	4576	fxssvc.exe
Token: SeRestorePrivilege	2628	TieringEngineService.exe
Token: SeManageVolumePrivilege	2628	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1764	AgentService.exe
Token: SeBackupPrivilege	1348	vssvc.exe
Token: SeRestorePrivilege	1348	vssvc.exe
Token: SeAuditPrivilege	1348	vssvc.exe
Token: SeBackupPrivilege	4284	wbengine.exe
Token: SeRestorePrivilege	4284	wbengine.exe
Token: SeSecurityPrivilege	4284	wbengine.exe
Token: 33	684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	684	SearchIndexer.exe
Token: SeDebugPrivilege	2124	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 4084	684	SearchIndexer.exe	132
PID 684 wrote to memory of 4340	684	SearchIndexer.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-21_71197795dc93a18e1408546f454c0cbc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_71197795dc93a18e1408546f454c0cbc_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3336

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3952

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1172

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3488

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5072

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1616

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4396

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4716

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4084
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3a39561a9f51da24a1ddf04ba25d327ea1f4a5f9100253688e83666774ea823b
MD5 3f5690cbfc63afd62d40595a4f802559
SHA1 ca93e0ef4391fa957dfdf9a8f4e627b6545a4f94
SHA512 29495512a18febc9fdded648a3c81b14cddc353f03941a1f26819b7642a8be453aee33837b4859bc8d979aa8e8fdd7200eb4855c956a610045ed1a240e4f4755
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnFN/j2U4FH:33q6HjBqj2jF
TLSH
T1F9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 04d8ca165b715a42692ba3dbfb32c7219f584bb69a0503eff8ab9d7ca8b7c981
MD5 ea6f8b8ee51e697e3386934ed2b71a5d
SHA1 73b42e50fdf062e0ef5de0e75bbd3b90b5144d53
SHA512 0534aad53c38a025ed38a09c7570a64cc608fcd44d8c4bb105717b1e089a3ba753080214db44e085580740877a4e214e9e7401c412050b58d2eb3ffc9b2bf93d
SSDEEP 12288:A1XLsswWkxy2lRq2czAlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WXYfDtczAhdCN/j2GLl3iFSE33b9
TLSH
T188050228B7E049F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7a15ea4793ce14056b1fc71ae4be9e003371a0d11dd73572147ab77eb1bb5116
MD5 61ded3067f45f1f9d93aec776866e3d7
SHA1 7fe2335ceb07e85263f054ab664361e58a26b0fc
SHA512 cae9c246fedcb45c9503963596adc36c09202de8911cbe983aab4cc3e3c3c41d286c57f59186f15d555b82b82f04cd1e4fef5de2bb59c80d7226c43fe46fd153
SSDEEP 24576:V0Le5ji0hmxirM6dCN/j2GLl3iFSE33b9:VPji0AccN/j2U4FH
TLSH
T1C235AE26F6748335D073C0B9C5D2A69AEA7130855B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a6cfdf35550cb856a8c52e69fb005c373d5319d26bf5cc3399a2ea31435af048
MD5 e1860f1acc7f3ac65facd377b9da3ace
SHA1 13a9e94ae4dd98f273061a829cd1c09f35836036
SHA512 43fc57fe6a22a749d89c09a44ac7d08ba7f4f0b52496b814db7748aad79bc280f6fd07406ed6e3693808985d379e1418170c21cc7ba4739f9dccc543455fa2dc
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyukdCN/j2GLl3iFSE33b9:k/ezSC6vUzPvxHjyYN/j2U4FH
TLSH
T181755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 02395aa10e2fe3bcff61d940d88aebed4fedd48c1b5c1ce180eab7c2a7be3c40
MD5 5b5235312554da146087c5df2a477fad
SHA1 b3a62351388533ac2027cecd9bf2bb2286741522
SHA512 a2f748a18b764e15cee44fcfd9c696c3efc562abf65d019391632bbf3468d25ab9730736eae5b55bb224e0a58e6e46191cef586ff9db9a4e1424dc41a4ce76d6
SSDEEP 24576:KVbqPb88hv/l+6ldCN/j2GLl3iFSE33b9:KVO88hXl+ZN/j2U4FH
TLSH
T1C6559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f438df129c42c759e770e46a2a19580c61a012be7945b69a3409beb05e5b49c4
MD5 a1214a5033f6250bcf9111b6e617f521
SHA1 db33e3c482da60ea25bbc6d1f39538e653968b4e
SHA512 856d952e235f87fc7577e5bd0e566801758a510f11f24cdebbd09c8e0aa95089d18cf5d3c4ef9f887e060e33a10e8badcb8834bcb64b862c1ed11b15ef0ce79e
SSDEEP 12288:7RiJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7R+dCN/j2GLl3iFSE33b9
TLSH
T1D9C42364DAE5F565F26F837903ADAE655200FEE8E525884785817BEF513CFE8C032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e054540698703832e369ebda59038f157777c16d7e19cde874238878844b28fb
MD5 2ec7de9cde182c017840511295119e47
SHA1 b08c805dc762251b8609eb457f412115108a274a
SHA512 217a4945fb0b59db8e1f0f13cb0496bd62ea0155156a96743fcb00c8949c061539675ff3803b8d432877a8f1596908d42a6ab4110b810a26488f0a5b696fc6b9
SSDEEP 12288:EeBNUbTVO86U5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH3:EJIUddCN/j2GLl3iFSE33b9
TLSH
T16E05CF3BEE28FCE2C27E8DB85791C600976278708B6293CBD165834EDE235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 13262bc5395a1cbdc3aa4ec93a1ff72fc211b4c352bc8679bcdb163708e2cf11
MD5 9302880f486a68e3046f027ef8368934
SHA1 715d70bbdb668edccb8c8694a7ba880c593352f7
SHA512 e197e9d816c4980ee08fba7aa9b56fcff826759cf37f3b25b6f29b501b12e53f08605dcbd7dc96349db5dece81ef211f3f0dea5f096393f4e28f6ce484fadf52
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:MQvGAdlCEL8c/yRNw5Chj2jF
TLSH
T1FD267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c7fbab3495505be14725a32589788300be927022a5ac2aa4fca74a8dafd901d5
MD5 8d177e2481866df0880b4c5813f07c7a
SHA1 48b0e636f9ba008d58021c74b606eaeeb36c43fa
SHA512 5909301b7d8e182ed16e7e16f84c707e08cabfb323aa68d488dceb4c6e2f599d40f6b5b10e7a48a311fadbb3b8de1ab8d0b1d2c55d84980c46a028daefca2e58
SSDEEP 12288:aAwSfxL/2Dc34DLLmt0LDQewsAjPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:vdewsAjfdCN/j2GLl3iFSE33b9
TLSH
T1ED15E031FE74E036C27F0DB61B36D716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ea1d1482877c8587940fbbda34b9b08d235aabc4bba2d93f039c4e6938ef8afd
MD5 eefbe7b0e0dbb47b74798369cab4a48b
SHA1 24806405f7f50e352be9beb4762e565e51f14d5f
SHA512 55069d2ede6ca001222b5eae83786d52a58002caf11c00e1986c1ed1c5488b1c67c54c61b58c5d5092e4dc79b8c961d4f9d801c473f3735bc795aa9d5139dde5
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH48F:tUEtQevvqc2W1cpV2EI324
TLSH
T154474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 58763b464f03e0e18dd97ed837290de78767b87e163efd9f4fdf490bd9a953c5
MD5 dff4541d18db5160a8350b0229ca6ae9
SHA1 a184d5ce05875b12541c64a7a02b838d1ee27061
SHA512 5e1c8cca4fa282dd6a02716ba56c719beb16c9534f018f418a5a4ef0a0357bd965130fdc2e3f96f9c27a37a8e239802f8893794f6d463e90eaaa982b19f0a877
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zMN/j2U4FH:ZoqtVjnmFj2jF
TLSH
T14ED58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 17e951b502c7590bd27872d402223c16ae481392546a643791ac2566b3926573
MD5 9d0cbe0afe01c6f68b25293e8db54390
SHA1 8084c2ffff214814ea7b9c49e8b477096f403ea0
SHA512 4c0198e129b5c1e2ba5aea156bdeb8dc6c5e5437d617bd66bf6e0b433edb8c289e424875843a65cf458a1a08694ffd65403f38082bad7971860b2b0673695695
SSDEEP 24576:HAhGLJIFoiwtA5l7S53gdCN/j2GLl3iFSE33b9:HAMyFoiq5bN/j2U4FH
TLSH
T15735AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 0c3fbd70fb657699a33be26ae2e465cad1a93fef6fb6fd1a8e2ceec524d3e2e3
MD5 75eecb0a5f31a343957acbbfe658033a
SHA1 22492d288c316028ace579e72865520436e70292
SHA512 da81a6b404922731fef87b9f8c1c3cb18caa631bdc9a33561a625b31a5e33fa58c1fc26f12e16d75b8429a533d98d450f8e14f44907d887dba477648210be913
SSDEEP 12288:Bmw5HEjsChNVBFgl0WDm+CsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cwuoOWbdCN/j2GLl3iFSE33b9
TLSH
T16A05F14577E41CF9E56782388697C536F7B2BC512A21CB0F07A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3bf3130f9758cc99daf46e27feb8072e416d832dc4ada497a57a46d28d55e32e
MD5 9ebf2bf912cd1c3c767e96db4b3ea6f4
SHA1 61b865f9516f85dfd918446f09dbc30a1fe7651e
SHA512 dd03dcebc378b3e648bb04124b2a89dd03d94adaec8a30c05555b893fe42fc7c3e10cb1942092d7bc67b31073a0206ad968034632d12462b461ba284d900eb16
SSDEEP 12288:9BZ1Iy/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bZuSdCN/j2GLl3iFSE33b9
TLSH
T10BE4125937E471F9E1A7823C8AE59A05D321B8A5A73243CF025047EA2F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 358193aac7b7d1fdeee9e4e0a67277d7ab62ede20fd9784a116a5c6aec2738c1
MD5 629e05712cd588110fc9365c6550079e
SHA1 3728b49a3f6f75bcc5269920a49c4da9176885bd
SHA512 86aca69b096911c2ad9f80620ed042fa1501801008fcfaf379fe02ff6deef9291432ef4f780717568f2fd19a2bed64a128715f542ff115ea8df8c35b76b8d6bd
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:sQRQyi36YOcPQLvw2gAf+PN32j2jF
TLSH
T107667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8545a5e459ef5c2038c2dfe71a2a9ff27ba3547c65591c12a85707932af4dba1
MD5 91edaaf9b2ae947fd4285460fe5bdcd9
SHA1 ec000fbda5726a0f87ac82f550fdbd5419663183
SHA512 543e4f719ab039b12f22472b6f70b3901f94374ac786f4970f89385a994bbdddb93a68cf8100abacf13fc1db44c941d7feed666f38421a03e22e74cc265726ab
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:hQRQyi36YOcPQLvw2gAf+PN32j2jF
TLSH
T129667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6e04697497652ece40246d0e3ed764ee178a62807c439f15d4fb9dfc556566ea
MD5 b400664c54ca26585232a15f059a915b
SHA1 a2e330d9cd8cef6c5e2ae6b581cb3a55b8e8e2bd
SHA512 5ca484d1db1a4eb3e51cd0122d7d6823eedb33624b7c5ec27f8b076dad0013a52dd951d90aa112804d1a54884a8c0234ef0ff20fb00f5c1c64e0ed36bc474fb8
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0CdCN/j2GLl3iFS+:r68Qg55nhheWu7PNU3/cN/j2U4FH
TLSH
T15AB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8541725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2e7f121b839d596e488360c594b0cc6f9ab00d7317e040b3b04420d2f42d28d6
MD5 d3af458dcfbbe865d63d18a55899522a
SHA1 b480b0c4305d750d7d17bc29c4fae52d850c09ad
SHA512 af6c004e2c42847d643c7631fa501a51b941360185f6a0086ec991942e93b1cbd6b486edbc7bffb671e11f4e79ae71064423c220c51d08a888b6788a4b3e7b93
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:Ky5112gYy5azzVvL69nLKnhZvj2jF
TLSH
T1EA168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b93d342d12a5d5c857033369a92c7913c48f2b73116c1d99e97a0b96fde3fd9f
MD5 978f4cf901b73d6719a940e4bdb3d64b
SHA1 0b6fc0927e1989b326c813990499e3e87fe34ada
SHA512 76cf9e7f70214b57df814d59cb0d7e1ac6baeb57778a781ad5bc77daebc953695968a17e0a59d31752f4257c9e4a19cb711caada4f639e5a5434f9285b693128
SSDEEP 49152:DB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmN/j2U4FH:1u6JmVxd2dej2jF
TLSH
T141D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5a38b122247fdb8881510a776319e1aeffe4e67cb88e4b03861222f83fd775cf
MD5 b4ab1f6cdeeee7c8a72ead3c86e4a1be
SHA1 bc348423d29cccf2bdbe9798bd21fee6a5b624e0
SHA512 2bc9c0999cf061fde9206b8a526db4a05484154bc83aab890a4741fcb0ce5490ecd53ede7d433a72fefe607ac3bfa2157e52fcdfce30cd112ef6872225d74fe2
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xSN/j2U4FH:rmifPbRFj2jF
TLSH
T150B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 45fc2f69c4567e6123b006e2921661a8270321bbb6524ca23b0b762b66555137
MD5 e676acd6e3c6f06e65d8824d9e09e883
SHA1 3726cc7c7b6df3951e610f0014d541deb715930c
SHA512 c8f87473cd1b8ea54d484403e53b0a09025ae504c2135e6e8e81cd9a476aa39d6e0e432eacd3053b8b7b5b7f65c32ff5aeb4ab93798543140887b8d21ed21d93
SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHqVN/j2U4FH:m5dKTi617j2jF
TLSH
T10EC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 07686492bea26dcef2dbe453515164ca44cb87bee29cf3620290650e418a19fa
MD5 0036947ff3f8ae58fb190e68d50d1054
SHA1 f00682b7efe08a309065ae7c854ac8945fecdbb6
SHA512 7a9628b0c9d7c4eaa485725440f2a0c6c58ac4cb34ac148d42a963c96c251c2c29c87c0c0ea12b606eb73c59eb8ea6146863dd6ecbd1c987b7b3c7b56f397ed8
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5w2N/j2U4FH:nX2iyph5j2jF
TLSH
T11B95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 080349b3c852075bb7e8f8f72fbda0e5b86162c93aba7b0481eaf4fe3c2113a1
MD5 796991e96eddc9cd20f836c86fceebac
SHA1 e1a302047b51d896482af47259a10b74f4c27ba1
SHA512 1d7f2e1a98c22094107e126cb53eb7f14799a51ae25359deab42b2549ebfe014c6507f9e63fcf54ee65b8c0dca3a556828c8bdaaace0bad00e4dd82329157ab7
SSDEEP 12288:RqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RWdCN/j2GLl3iFSE33b9
TLSH
T1D6C42364E9E6F669F15BC37D43A99B555200FEECF6264447828116EB637CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 87e96198501106119bf054adab166aa1b7aa6f7eb5cf81dd9fae44b1fad1705a
MD5 53690e4ef8e97da3ec2e853dc7eee0cc
SHA1 10e00978be5f218ce468d72c6c1b09ac5a45c72a
SHA512 942aceafcaa59a2b0c1571a54c927dd7809abab9d89486422a75a75d27e4c7717fcf778e4da971b8484950115b9090d9ce31a0af38c46a8e0cdfe301d3c7d933
SSDEEP 12288:DbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DDdCN/j2GLl3iFSE33b9
TLSH
T12EC42364E9E5F659F15AC37D03A99B555200FEECF622448786811AEB637CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 94db7a987a703ae02236f2be660e55f0e94469595ed463828fdf981dbe832615
MD5 48acfc402bb1c9d6462e4a98434ba581
SHA1 b5a707f90dd5fbbc99247b6275320b58061b340a
SHA512 a18a73c8b370ef541c66538ec0f89e4c00ba88225bc151968a6eacbb8525e886a84685325d00e3bcb0556e5745eb22ab81f0902ff7e8afff3ffd73210fe5468c
SSDEEP 12288:9hJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9VdCN/j2GLl3iFSE33b9
TLSH
T156C42364E9E6F659F15AC37D43A99B555200FEECF626444786C116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6ca913abffd36c05cb9fce0ef754ec76caeac07dc9abce9c1bbd0c70e68c2a47
MD5 88516e096e6e4de907076ac8cafad78d
SHA1 bb60d8e35900abd0eaadc4d62eeab566ce3ba383
SHA512 4a4ac86b135c237389d10bfe1d9bb9d3b8b45d471c3953f72f26276ef245515b1efd638b9a7cc8b2212b521761aa5d3e79c7ffe5b0e1e82716997d07da65c972
SSDEEP 12288:OVwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/dCN/j2GLl3iFSE33b9
TLSH
T121D42364ABF5A1D5E06BC37C83B59A11E320FDE8F732458F86401AEF1B74BE89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 98338efc1f491a329076b7cb1c82aa25cf22480ea863481c15d75c5c34ea763a
MD5 d8ab03273ff77e13e70444579792327d
SHA1 6abe6dc970775e677cea76f9256b0cc2bf42c9f2
SHA512 284c5ee74859bbc777f63b8346deb5f03928a947048d1d6ec58379d0982decfe154371bd81d9f4e3b492979cff4b4bc90c84408a0768837466645350b2589ad5
SSDEEP 12288:PoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PIdCN/j2GLl3iFSE33b9
TLSH
T137C42364E9E6F659F15EC37D43A99B555200FEECF6264487868116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 5d2d19d84a46723cadc3e09e0f7e69752379e7b3d217ae530764024a75482479
MD5 fbba03a6005fc4032f28dbb2b0378100
SHA1 8805e39f931b5214cd758dc8347d8f1152f868f7
SHA512 8ecc1f8ee8fd10b5be0ec8f19dcd114171b62cc844db5ee0d34c3d4e24296a04c83ed726cc83a235000992820e75e027d62b3eabf2d567b7187948a77860a5ea
SSDEEP 12288:iXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:i3dCN/j2GLl3iFSE33b9
TLSH
T1E8C42364E9E5F669F15AC37D43A99B555200FEECF626444786811AEB633CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 01ef499000c1efb7c9b59aa720c91103d51720232579ec41f331512829fb0169
MD5 bf9b3ec7ef0a6daa6ac4d7c418f24d84
SHA1 cb370e564525e94927cf4594ce10b51d4247ade4
SHA512 62744e658e076ee0c908241bd45db15940ab90e0a558d6fd6cc38c83e65d50991e95357311ba74229f833b97fe4ac65c29b3e73aace2423ade79511de76ef6ed
SSDEEP 12288:3zJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3LdCN/j2GLl3iFSE33b9
TLSH
T103C42364E9E6F659F15AC37D43A89B555200FEFCF626444786815AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 48d0398929ed9a832a95a1b58804d777c1c8057b52a1bc0fa501faeaf4cd5430
MD5 d2aa8d3a222c59fff7522f5c92efae2d
SHA1 af5cca0a4d8b09e7df5ba87fd861307410a603a3
SHA512 bdb94b18541c0f40533d5b10ac776df00b0ae633792aa3f49bcaa65dd58bb0ef5359e946e0d8d5338c72f7fbd183a37e19840e6674e6125847e00b425d85727e
SSDEEP 12288:LiZwb6zzFEoS2cPvy7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2ZMSzFVSOjdCN/j2GLl3iFSE33b9
TLSH
T1F20502A4B39058F8EC67823EC9658906D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 9cc6bb7a05752194f101d99522461314f3c144748eea7049387e570cdc46278a
MD5 9ec7106babbd48a5333f0185d9932ee9
SHA1 7bfb9a8b92547a43293a311b8b09091225cefc61
SHA512 6a93fdd8e22beabfa370abc04b4e8c0d2b62f4e0bd6809d2248a5b755b71860e0084ad27bed2cfbd9dd088a2dc3162685b684e2a0217f57097a7e245c850cbb9
SSDEEP 12288:XOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XidCN/j2GLl3iFSE33b9
TLSH
T16FC42364E9E5F659F15EC37D43A99B555200FEECF626448786851AEB233CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 32278dbf74e0f24d8c5f7daba9fe77d49ddea9fd0d5a34c1b904f2a89fe6859b
MD5 4abf6b332d9a0da7124a38ee383946fc
SHA1 a619d25c44096eadd0e725cbcf306a39e4023c0d
SHA512 0bb4e7acc17310f32a72e9dc92776d5857bced36525e3a5b7a0d1f13836cae64c399ebf31b6d4962c3b6695e79efcff4c59d5cdf3b0a99f3d18c5785f12b58dd
SSDEEP 12288:9SJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9OdCN/j2GLl3iFSE33b9
TLSH
T1D8C42364E9E5F659F11AC37D43A99B555200FFECF622448786851AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 33160a74e4ce162a002f75f7eda7081be1d7262079e2dadd76fef3fbf4c350dc
MD5 d3e4e27003a527adc7cfce4ff45bced5
SHA1 e3224eb0f02eb911d4da0b3d914e34b982e0b766
SHA512 81f017d0a253f1ccbdd9b32670d86bbe7a008a3bcc27d7cb5e022206c17bcf849400b32b2c60690fd89cd3ad7ab0cc53d28994a7175d49437dc4a47f9dcdb63a
SSDEEP 12288:myPz5L8/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bzyvdCN/j2GLl3iFSE33b9
TLSH
T11EF40257B7A130F9D177823889A55A02F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8c7e8f69d5579169a9eaef77977c27f1fe4b23d942dc9764b45fa623859fa63e
MD5 d14011c3101512377909fa329404a856
SHA1 26796226b877953664136f186f822f2e7b028e39
SHA512 f986957aea20fb4fd097de04b826f8d3d481929fed6e8ab07cb18e499a24eecc156785ece4e9a716932f52b530f076bd887fd2262269bbb6a47d9a44614b4f46
SSDEEP 12288:kOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kidCN/j2GLl3iFSE33b9
TLSH
T1C7C42364E9E5F659F15AC37D43A99B555200FEECF622448786C51AEB633CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4a4ecd3e8ffbde228516d6de1b16b45b3db50224014247cacc7f671caf59ef19
MD5 6b1624971d02b20e19207562e1368a70
SHA1 cd4e97add2309929aafed883b7b926c0c1190821
SHA512 c2c62cde39f73292daa4f9a74ff3c798dddbfc9ca4aaa01f612e4cfe9fe94aa631e84745eb3460ed78e7f931d1389288e6cdf0e6d5fa48707b39c869c07a47ef
SSDEEP 12288:HOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HidCN/j2GLl3iFSE33b9
TLSH
T184C42364E9E5F659F15AC37D03A99B555200FEFCF626448786851AEB633CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 ca2a9c54368940420f2030d8e02ac4c9c5fe902bcbae01e076a6280bd1d42064
MD5 d087b3aceb15d6fde446a5dd78c56fdf
SHA1 2aee450f9ce1f515dc8c7ff6c00673573e231082
SHA512 72add7472e1aa52094683b44210708d3fb06d5ce892cdb51a019ae14cd23a38102f17b9a444d3445df79ef608c3680c488a2f5005004c150eb5c0dd2878823d8
SSDEEP 12288:lyPz5L8/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:szyvdCN/j2GLl3iFSE33b9
TLSH
T1BCF40257B7A130F9D177823889A55A02F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a1b3d7c275ae0bf069838927d8457b066dba5d2c0d358564597a70bee7523af5
MD5 2ab914ac46cdfde70d07c75a887b6aee
SHA1 66f3f32d979d25ac625404ec966c935cd576f347
SHA512 13590890b0bed7d78ea92c5c7c4142b78da025ba3d09ae799a5678dca2d62fb0a6175c5848b2ab83ce225c8ae530882a44f6ea21b82d0b4477ab7991c36b7c92
SSDEEP 12288:9Cd9eWYoaLHF3z0z04PDvhxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oTHaLl3z0zDFdCN/j2GLl3iFSE33b9
TLSH
T1AD0502A4B39058F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 25870172db322851c98e618200d875c4d46e8568327c0bf2e498cf3a25ce660f
MD5 3d0a2fc49607faff9066c902b7c40149
SHA1 742a39fb738e57271667d66e007ef38e36a96138
SHA512 c5bd5ffe29c00e282e9de99ce74c01813233f0750976b747147a95012a8882030814a96705cfacae8d3d09b2cc22f485f422041868764179471e26b64cdb7575
SSDEEP 24576:937d9CHKy7GZZdCN/j2GLl3iFSE33b9M:d7d9CHKya0N/j2U4FH
TLSH
T15625CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 4ba3af649f8251f2701926bd86b2f341b829cf1cb4b95f399e1e1c777d1ae9c8
MD5 f7944fdf00f4f1db4ea7cb587a911477
SHA1 5979691e25f9a6d6ddc1bfe8952f4afef648dc96
SHA512 3a87461aef81939c6aa0b8526622edc64779c8e28ecdf2a31e56d200154600cf1040db64f5c936453fb4c1797e6212f87a1a093cdc1b87c22f7766f3ab23fdac
SSDEEP 12288:bBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH3:b1dCN/j2GLl3iFSE33b9M
TLSH
T13DC42364E9E6F659F15AC37D43A99B555200FEFCF6264487868116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2d03cf59e47b19ce66210500e37b575fcdca912b040ea80a66f03d829c406f40
MD5 b839b370c5860f72c9a8eafc96c665da
SHA1 12c86c9b2fba811758d1f38bd5d762c87541de3c
SHA512 2a733f974b522817844cbe4924a574e3901b4a0493efe950217bf00a5017fc6066346cc91947985580c73442bf0641d6404f0582f36b1cfa324271039f0c5334
SSDEEP 12288:PfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH3:PPdCN/j2GLl3iFSE33b9M
TLSH
T192C42364E9E5F669F15EC3BD03A99B555200FEE8F626444786C11AEB637CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 9914ff42e636ebf0a0562d441d8481892bc8c0c5e3f53094207cc8c62a8b65f8
MD5 b2cfb9910135391b3659252329b73b5b
SHA1 4630f4fa2c4698ef5fc10c401ff518e32e622612
SHA512 58f434039ba83ec9020a3fe0a31fa4e2020f7aede7095c78ff54b7d44a76c7bedf93e31fe156ac9344ac98ff05f93ad4ffabaddbe59bea50eb824d686f0b27ac
SSDEEP 12288:rkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rMdCN/j2GLl3iFSE33b9
TLSH
T1FCC42364E9E5F659F15AC37D43A99B555200FEECF622448786C11AEB637CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 bf17e291a3b1618c8edf1aec92937a074a98e4971551f9d0cabeea7437ed6a64
MD5 bfcd03ab855c26667c26ef096e70d6c9
SHA1 a4c58b40d8d126ad13bfbdcb1cedad76c6519a8e
SHA512 3be3ce3234aae72863ac86fed1c59e6c09ac94fabc2e4db30ecec521bd6ca951f0fe8c7cc1acb392273614b6780a7ab1adb916e89a296488e1814693e9fc91a6
SSDEEP 12288:0OJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0idCN/j2GLl3iFSE33b9
TLSH
T106C42364E9E5F659F15AC37D03A99B555200FEECF622448786C51AEB633CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 64758e7ddaf7632554465db56c0159fee2677cd15efa8fb44a506e1513e0a646
MD5 8935b1ae65bf50655a1cc4b8bfaa745a
SHA1 fb0fc07cc7c61186d194a52eeef63ad2d30f813d
SHA512 66e4c468e3b04c9be35bae8c10dd87bd79a18cb79112950d6316a582ee2b48139e0abbed3021f76aa7b2e4840eff733105341e1f19e44ba3db308812b99094eb
SSDEEP 12288:ZNsfeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:eSdCN/j2GLl3iFSE33b9
TLSH
T1D6E40119D29452E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F3AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c27587d72583bd8fc6c121b958b8acc9bdfffe7f26cbb0abee29bc9bbc6b7101
MD5 912ed3e3893966b4e1d5f56c2cb1fed8
SHA1 e59bfdd68ff35d26a2a2361d26b6de436d9def56
SHA512 d947c5a7776a0653943c3379b9ebeebc8dae73c9db3e669afe6328d31088ecfa7ddeba7c119a9c3f8914b13e828c7e7ad547d6f4c123c6773679e9bb4b8deddc
SSDEEP 12288:QeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QSdCN/j2GLl3iFSE33b9
TLSH
T130D42365D7E9F656F17F83780369DA252200FEF8EF258487858116EB1278FE8D832523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2db27bb29f70730cf07f61fe4245a08cdfb7b57a872d7a478a26f8a40d04e4e5
MD5 6fd7c3879507ec3b3cca4c23388f0434
SHA1 a8afb903d395c4a141a07077ccaeab0dad0fa921
SHA512 0070d5a3b71803a423232e2f5dd169ee8c7db6d17374c0a688cd032d3887be058ac42b4579df24490b8c9e864e1f3cd0d9bcca997f8bd6ba156265a9598fc633
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQzN/j2U4FH:Za0hNYG4JwYj2jF
TLSH
T12D85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 cecdc8a49a1c4a5b566367f28bac4e6bcfbc4074415d52a4016763aeab754484
MD5 2868fa8ec9d4079adf372f586211f4b4
SHA1 8ea4d5c0b4610ed3dafe551b294b3fc7961e88c1
SHA512 1e6d36485addbe774902bf6ed560df941bd72eaa229785b1314c247bf530fa6d23f51deadb20e77140a50a19ba4ccb06e8a985d3c46f9da7e5daefeaaa32fd76
SSDEEP 12288:vhbHjfXCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vhbHjPedCN/j2GLl3iFSE33b9
TLSH
T1FCE4027D66AC21D9F176D27D86958A06D330FCA8572183DF52C182BE0F3BEE84C35A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6181993bf3461eaa57649b5d0da9b681fd3d36e4260f4eb045ec079a08dae59a
MD5 2ca2c2197898a3b4fab25c596bccec9f
SHA1 68f0e57e80d03ad3d2dbc7f6130e87e66704c82a
SHA512 37eb27d68ef3b632562318e9c0c4ce0b217178e8cef12e35d09cb57dc55b6d6da6b9e426120c3a2a90541b9eb6ff878de31408abf3e0c425751a1056e5971338
SSDEEP 24576:S3YgnJcRTk4yti+R5dBR/LdCN/j2GLl3iFSE33b9:SIgnaTk46pBR/oN/j2U4FH
TLSH
T1B245B02DF3B910B9D4AAD236450147B5FB71782D1F209ACB0170C538AF1AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 3354b097e3136627e1786ad64f5db0f6d525d665a44b67bc50e0732adee45840
MD5 e566140761e4870a1d66a4cc4ca8a93a
SHA1 36331346f592e64829bb07adec5faa04fd9957d1
SHA512 1886696d0d2d71f6c66ac6b86d6d496b80b9ae06ece08b42c7daa2ac29a9ef0fdcbd6bff4a376f2585746558e37e844cd58ea9cb4dfb684ca5bebad17a7dcc3c
SSDEEP 12288:iCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iedCN/j2GLl3iFSE33b9
TLSH
T148C42364E6A5F659E16AC37D03A9DB152200FFE8E73645C7858166EB137CFED8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 f358f2fa46e7f6f98cb624b09d829ab6583b76af3ed8fe2d1fc20726d727e75f
MD5 14d1291f8e51e7cbdc6c3c582294afc1
SHA1 c7da2a3338994646ea37a4f971b82c376f6cbc34
SHA512 bf7905b241070827c8aadf84aa871a4de14e386c2b3d3fed0d2809779563ac046db9303605ba763aef14279fb1ce88fdf3a27884bb497e17a92af960c5230d7d
SSDEEP 12288:lOb9A4LWOsvAYFTNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ipL3UTZdCN/j2GLl3iFSE33b9
TLSH
T10C25F154F7A450F9E96BC23CC5A68A16E271B89C0724D7CF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 b5a71fd04fa9f97f844ce5a513a5ee6a826a9a6a180c6d04e03c73d24ce008e5
MD5 984601d63a9af768b76bd3c10d5588eb
SHA1 68244af7d66c8e5bf5744655b9fad0030c10df9a
SHA512 411d901e82335224b11dd1d52d01adc56605fad752e195dc83e5c1053c66588d0d62cedc556655a888f8ec646f6bc6db42c9589b2854b62a709321c3961f5d58
SSDEEP 12288:4pFtpOBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KO1dCN/j2GLl3iFSE33b9
TLSH
T120E4022937ED20E5E17A923C86968709D330B8A5572247DF42D081FE1F67FF85C36A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 10fac420dd6817795db274aed12e0086437f207297621bb7a95cc564656f8fb8
MD5 67312a9f6c73bdfcec0ef7a8f377b52f
SHA1 e0f3f078a8adac645ad1b7b8bc6c2bf19dcb1909
SHA512 7d3e0d7cb2e8605bb4aa5ab790e61fe13735a7035b3166bb56b1a280ee5a686a945fbd3baefdda05cb121368be583ade79be7eef4ba19615ae00cee3c923bf49
SSDEEP 24576:o7NM9YqZqmWMUkPjZM48Mv6bEhsidCN/j2GLl3iFSE33b9:o7cBWMpPjN8DbEhwN/j2U4FH
TLSH
T1B365AE2E6BEC81E5D477D13DC9E28606F6B1B4611B318ACB1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 43158b42ffa54a28b22ae57d4ebb50801dc367ea9b357a443a4ef3b600cefa4e
MD5 8b2eee0a6e40ebd23222c04ea05a9fdc
SHA1 127f63569cb2dfa1469aeba635bf6786ecbb37eb
SHA512 e6eb3ebb62e12fe6d99656844a1ef81785aeda9166359019e11ae47c17f859faea71a93582841c3f0ecddea6e4c85d00ed9a2d3b3fdfc5b71e0c17f9107bf3c3
SSDEEP 24576:gW6BApg2YuyuNDYTabvcdvNYf8km1cdCN/j2GLl3iFSE33b9:gF2YuHNETovAvNYf8kmFN/j2U4FH
TLSH
T119858E2927ED80A4E0BBD27D45B6D246FAB2B8551B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 fae8110d330e61957971d939b6979140c69f21216e22eb2d1b72be9eef9ac665
MD5 39ff6fc2d4b68dce37c8c3476bd16f29
SHA1 178de40281b00ab2d7e0e1d035cd36d9d0343e84
SHA512 5a88da9b5455f36a6a4dd2e124dbba493365c4193176190a1e52c85685e5ebf7a4217e351c65a1b2fe3c5158ee1122080cf18f92c88ba1d08f0639ddf5411f5d
SSDEEP 24576:cAFs06+Omlf3NXEbToBdCN/j2GLl3iFSE33b9:xFs060lVXuTN/j2U4FH
TLSH
T19A65AF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b833047060967a6762ada9d50dc5a980d63ec6f77b776e049fb919bdb99c3934
MD5 9bb1c5dafc66fd464693cb22ac902561
SHA1 00cbc18ca134b781f5058a25b2188496b9a6cb9f
SHA512 f973571c5d54695f3bd8e88176417cd89c55ccd417a07b713d520036a03c05dcb0c9aa6fbd356f7b3c6ca306a5045726107ab458319020937429c88f3bb0a931
SSDEEP 12288:WCJnJ5D3VkrDzxuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nJnJ5D3WXodCN/j2GLl3iFSE33b9
TLSH
T1E815D02DD2A810E8E4B7C2B4829A1B56BF71387D2F2269C718B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 aa410e150178654b77da6357c43a096a60cfa0db957c42cb44d21b587a2569b2
MD5 41ae47b1760eab043bbbe280c3329b47
SHA1 17dbe5dae7e1413d27ba50050037998d2eb905e1
SHA512 35e85919e751cc0bc396a3139c235ff6637459cb7fff914d6d4729ac110ceb0a173439179518d708266c14b84081cc31cbe697a09fa64ce71b69ce7696d23348
SSDEEP 24576:xEPghm6/7IIXdwcXrif7qQncjlP65i3VuLdCN/j2GLl3iFSE33b9:2g06DIKdwc+eQnSt65aVpN/j2U4FH
TLSH
T179956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 aeb1a124fcb8b505aabc57bf650808e4390cce2d6098c58b81ea2141a930d21f
MD5 6ab453da0a3fc847b211ddc2bf84baa9
SHA1 0eb913716709ba61bb55260615946429831ace10
SHA512 a931583496153b03ae3bd41ba0b0a5941eb953ec3c57595326c52ae1836fe45959226c5b1a02953d5f1510c30f9069c7c7fafe3f338d0353d219e7220da2b117
SSDEEP 12288:lEP3RnxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mnFdCN/j2GLl3iFSE33b9
TLSH
T167E4126D6BACB0E9E12AC13D42918605D331F4B4AB2217DF42D1C2BE4F37EE85D39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 fc818225379235ddcc041fc17acf26d01136e25caa7214cf54a6047ca8dc83bc
MD5 4710f200745e129976daed83e4a5e2b3
SHA1 cfb157f95d9f59cd164ef73cadadaf87040ad8da
SHA512 bee9ae811527f2a75eb9acbd962009b7ac8c453693576767cde6ffff240dc2e7d5ef82b5370034709e65e6dcc2cc3292c14246ac1b89fd63fcc8a733626b540f
SSDEEP 12288:8jkybJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8IyDdCN/j2GLl3iFSE33b9
TLSH
T1BBF41214A3D4A195E5BA423C86B686649A30FC70EF2186CF41C0E77F6F3AFD49831B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 6ba6305de1e82adbdcef20c3d5648eb7635faf42cf82f52a8e1e624fe8d73d0c
MD5 28992a5e3dca8c4df2abae221b65cb3c
SHA1 e06a29b79157674ee305a8907a537b0e4bf119e3
SHA512 0e75ca89fe10af1630a8acd943c72c2e36479513738a69ec38f27c289cca41522282758f61c06510beb21379aea773057876de1b261512c6898dac2807ef5ef2
SSDEEP 12288:8yRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pldCN/j2GLl3iFSE33b9
TLSH
T1C5D42368A6E5F569E12B837C03B99F515210FEF8EB2144CB41C0AAFB577DFD89032852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6beb27c4a6cca63dbfe11bf68d76f045c18f858ef1284ff09810dece69181057
MD5 791f3c88a180858a475097532e53aa6c
SHA1 6b98c4546fac44c5f8fff64c68295d389dbb02f0
SHA512 e06eef22c27e92fcf97e00d1817dd2ee13bda947748336c14f17c9e3d61d4e80e0ab32df2923aa6c2ab4b7c75bc938d72a4f8ff5e98b80bc162e9c48b970ed00
SSDEEP 24576:2Q9MxZKdcz9dw3KdCN/j2GLl3iFSE33b9:2VKZtN/j2U4FH
TLSH
T11D558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 5f9b5e5d099b1faa821094b69fa08f6179dad278df2691159a7fd680bc3a4166
MD5 eb9e46f05ae28324ee92500f32a1ba77
SHA1 5e9176537e0f753598c1b69441ecbad0e5111f45
SHA512 92e0d679f6395823680c846343466f35a07b6601a7617921d8ca43817ac8deae4df1bcb07cd7a7249fcda40b78340b71b184df7538b682cf614d1320350a88ee
SSDEEP 12288:OyoKo2JRple9p/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OyocDApvdCN/j2GLl3iFSE33b9
TLSH
T1BAF4E01FBBA940A2E076823C89858745E773B0709B6253CB5591C37E4F27AECBD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bfd9b99c1ea155c5e25d54ee70a6d9f254bb26fd392253543c9c811e6ae896fa
MD5 b8d6b99844e94d2bde4194fe329995da
SHA1 03316ca78f419a496c5835ef7cfd9075775a783e
SHA512 8a2f1a3203cc667133b27778dba5e2a1c3bddf4823ce5a75c773ba6dd53bd97a6bd024e791b830c08e24c30bd47a0ccb5375a2693f489c187f95ab866959beb2
SSDEEP 49152:DWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK8N/j2U4FH:D0zuNIWj2jF
TLSH
T1EFA57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb3c6093c567e35c4f2100f2e56d8cd46fab0a054470bfee43f19492a8b57bd3
MD5 e1d3e48a9996bb882cdaca099ce620c2
SHA1 66fac83339e99c6487723b629c0bfea52db0cffa
SHA512 7844bed00267fb783180e57db5a1788654ad36bbafdc898b89d0f18dc21841d0b940c0a673c7737d06593e03a3f5a91d8f0d84e8ca8f5791c73eb3b4275dfdf2
SSDEEP 24576:/1QT7EcpfxR+N5AWAz3ooiYtjMqbFdCN/j2GLl3iFSE33b9:CTDxR+N5YzTfjM3N/j2U4FH
TLSH
T1FB55B02EA7F855E9D17EC5788B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-330-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/684-409-0x000000000CE70000-0x000000000CE78000-memory.dmp

Download

memory/684-595-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/684-414-0x000000000D390000-0x000000000D398000-memory.dmp

Download

memory/684-413-0x000000000D390000-0x000000000D398000-memory.dmp

Download

memory/684-340-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/684-372-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/684-356-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1348-464-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1348-317-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1616-380-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1616-279-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1656-0-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1656-9-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1656-8-0x0000000140000000-0x00000001403C7000-memory.dmp

Download

memory/1764-308-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1764-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2016-325-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2016-594-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2124-39-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2124-51-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2124-230-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2228-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2228-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2228-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2628-305-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2628-411-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3096-232-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3096-77-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3096-79-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3096-71-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3100-324-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3100-272-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3248-249-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3248-255-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3248-248-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3248-316-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3336-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3336-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3336-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3336-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3488-262-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/3488-270-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3488-320-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3488-267-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/3952-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3952-62-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/3952-56-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/3952-67-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/3952-70-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4284-322-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4284-545-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4340-441-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-416-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-431-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-433-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-434-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-435-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-437-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-438-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-439-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-451-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-453-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-455-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-454-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-452-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-415-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-420-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-430-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-429-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-427-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-428-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-426-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-425-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-424-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-423-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-422-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-421-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-419-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-418-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-417-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-440-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-432-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-436-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-442-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-446-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-445-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-444-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-443-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-449-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-448-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-447-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4340-450-0x0000022C2CC10000-0x0000022C2CC20000-memory.dmp

Download

memory/4396-282-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4396-289-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4396-407-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4396-283-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4500-294-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4500-300-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4500-302-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4500-408-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4576-244-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4576-239-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4640-463-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4640-313-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4664-215-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4664-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4916-243-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4916-312-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5072-329-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5072-275-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5072-412-0x0000000140000000-0x00000001401D7000-memory.dmp

Download