stealc | 90c0c3077c8a1174b97f404fb39e8519a678e104d3cd79b3653de0169b3b7c74

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260922-rtpmravwfs
SHA256 90c0c3077c8a1174b97f404fb39e8519a678e104d3cd79b3653de0169b3b7c74
MD5 256cd09ed8fd748fbf5887aa78fd4f56
SHA1 84ee16b918948a1e38efe2a0f2c2b858794de37a
SHA512 afd1d5fb3181277b45a38ca082cfc15c7e7caffbe3fa3b55612c9be00b9d000e0d29faf59721d918e6152d39148d44f49c3946df067920d558bd9ee9370ef87f
SSDEEP 49152:8wlhO9jlOb9hP65baFY3Xemz1joiEq0bOySQIxcB8Q/sASaQeNTlGSaXN/j2U4FH:nc9bES/+zbij2jF
TLSH
T124267B1BE2B941F4C0B6D1798A979617FAB27819973297CB0291475B1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/4596-82-0x0000000140000000-0x000000014047E000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
6056	alg.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
5536	fxssvc.exe
2184	elevation_service.exe
3408	elevation_service.exe
928	maintenanceservice.exe
1516	msdtc.exe
1524	OSE.EXE
4248	PerceptionSimulationService.exe
2028	perfhost.exe
5484	locator.exe
2036	SensorDataService.exe
3448	snmptrap.exe
5960	spectrum.exe
1284	ssh-agent.exe
540	TieringEngineService.exe
5696	AgentService.exe
4560	vds.exe
4732	vssvc.exe
3224	wbengine.exe
4652	WmiApSrv.exe
4344	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2306f5794bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac0fda019f4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000164a35019f4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006bd07c019f4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8e516039f4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc5b0d039f4add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f9527039f4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
4792	DiagnosticsHub.StandardCollector.Service.exe
2184	elevation_service.exe
2184	elevation_service.exe
2184	elevation_service.exe
2184	elevation_service.exe
2184	elevation_service.exe
2184	elevation_service.exe
2184	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4596	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAuditPrivilege	5536	fxssvc.exe
Token: SeDebugPrivilege	4792	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2184	elevation_service.exe
Token: SeRestorePrivilege	540	TieringEngineService.exe
Token: SeManageVolumePrivilege	540	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5696	AgentService.exe
Token: SeBackupPrivilege	4732	vssvc.exe
Token: SeRestorePrivilege	4732	vssvc.exe
Token: SeAuditPrivilege	4732	vssvc.exe
Token: SeBackupPrivilege	3224	wbengine.exe
Token: SeRestorePrivilege	3224	wbengine.exe
Token: SeSecurityPrivilege	3224	wbengine.exe
Token: SeDebugPrivilege	2184	elevation_service.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 5516	4596	2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_256cd09ed8fd748fbf5887aa78fd4f56_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4596" "1244" "1144" "1248" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:5516

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:6056

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5316

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:928

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1516

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1524

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2036

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1284

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4032

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
PID:4344
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5116
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2731af9963d956c663012e8c3d507f23539adaa5e431ec32e7b8132c2e760cf6
MD5 5c94c7b475fe1756e9b8e88f9aa956e5
SHA1 745834ae335096510c73a25542cb57dd8a32bbd2
SHA512 c76f5c6ecfbe48744edf6402cf2a5c331607f8720dccd9d6de3d4b5150bfe398266e3447f14d35133d6fe1a98d66a01191fa0d8ab6700ceeb229179a235c9d52
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxniN/j2U4FH:h3q6HjBLj2jF
TLSH
T1F2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 53c63a1f01e25a56bd53fed0f7eab6aa3a308d99203e27094767aeda78458376
MD5 e1f793e0e7fb438c37abf910e7cc379e
SHA1 7cadcdca9935151dd971b96d2d94a6aa6cfa89c5
SHA512 609dd516aa19861f58c196f0e381b6f0a6e63cf75c930ee1e9b9ccf0584beaa957dd93a749a46182910bb2fa81979456fa81af566834c6e79b4520d2926b4140
SSDEEP 12288:L1XLsswWkxy2lRq2czAqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xXYfDtczAWdCN/j2GLl3iFSE33b9
TLSH
T123050128B7E049F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d540d0f65bb82f99e5ba6a326804a369ea95b9c89775ef53ca2798154d50120e
MD5 25da6dcc04795021c89998dfeec1bf0e
SHA1 516252b8dafb3b35a0b00ecb4ff431712d383c3a
SHA512 c00d87742f8a9d2d7a14286d8bb61264d115e80fff3961152d03953409575407bf4484fb1d4590430450b5886737158ef43c8193a0d95d27b2e6d250e59c6328
SSDEEP 24576:x0Le5ji0hmxirMMdCN/j2GLl3iFSE33b9:xPji0AcKN/j2U4FH
TLSH
T1AE359E26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e6075ca8532653586fa99d2c0370f570dd858ea69f8807ac977744a4a9e5c2a5
MD5 3157e398a3560ff72dc04dc3ea009667
SHA1 1101106d93d882013de2b0a93eb20ba8d55a1e03
SHA512 1c57b858ccc3db7edd8f510432305aba52d5c48ed48b529d5023e27cafe6069ea89a68b9e88c68c5b45d3c31e6be59fa57be41e6e70e009752584e8df3889e46
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyu2dCN/j2GLl3iFSE33b9:m/ezSC6vUzPvxHjyGN/j2U4FH
TLSH
T170755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 265e75faed89e1026158ca98ba74a3999ee15c417d88e8c54ea00ec03c1b1f98
MD5 e664a3f984090d7ebd90642c168a3db6
SHA1 a2f4911b44eac6ed91d030d17bef2c682b1150f1
SHA512 ffc1d2e2510c07c0decf24d6201ee098bc7a74aa8aaed62d1badb2ef7cfb4764ca615d843a08d4f50b2838c9b758d0d3f238107cf49147c0442b33d6294bda6c
SSDEEP 24576:rVbqPb88hv/l+67dCN/j2GLl3iFSE33b9:rVO88hXl+jN/j2U4FH
TLSH
T17E559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 d1b4649bcd19b73d0bfa95201842b51142a75710feadeeaba863c673257869da
MD5 1750c2b23359922d8f81864fef3ef005
SHA1 35e2e4f8076c2ae673d099266efb1c91451bfd15
SHA512 c9785a20cd79636a81b007d8b200c121c71f44af8a1777494d7e3e7406d09b9960ed2ab7c9f0de56ef48ad81b394a2ce22898eafef10402748c4d81164712406
SSDEEP 12288:2RwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2RAdCN/j2GLl3iFSE33b9
TLSH
T12DC42364DAA5F565F26F837903BDAE656200FEE8E525884785917BEF113CFE8C032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e21c79a9868a6c1a97eaf5b525c74b0f62b204652bb9b2821761576e1692b1b0
MD5 583f325c5d525257ccd38f86d1daae14
SHA1 37deb9e6f3ad20fba5196672ae16b1365011b363
SHA512 59f99da09111c42b3c3d93819f1d67f4b1ee32dbd9dde8cbcbaf5475aea571923e6f920f052f1ad094ae40b295058b112a91668e409651443dcb7fe88d6a80c6
SSDEEP 12288:meBNUbTVO86ULJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mJIUTdCN/j2GLl3iFSE33b9
TLSH
T10405CF3BEE28FCE2C27E8DB85791C700976278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 add7e15318dcc3425ab39c13efd1c718ba425177719dd69ed56aa2b219610ad1
MD5 61dc6c6695a9a8a5ac4988fb80029573
SHA1 7d5dda0d2ea84a0f61c97d75236a79c6a3dd56fe
SHA512 aebc46d48aee0dc436eeb69247e3d0c10668ae097743f5f62ce21dd7d3e20fb75da317b4c0130b75e0ac46beef21e2b0bcd8729fe4cd18a53bdf5aa6001dc81a
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH5:hQvGAdlCEL8c/yRNw5Cnj2jF
TLSH
T135267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6f802ddc5df443d468a172e511c5f6ccede0032f610efeb486e1a4b304e6b440
MD5 23e1bdbd3a108b8be15a0e6a5d17dc9b
SHA1 0e66308cf8198ed9bfb2864f8d40b6e831aab875
SHA512 bafc8709b6a3c7d9d0a492bdacdfa5ad70e60eb2bc605690f3abbcaea28e9a0c5494254f500eaa045ff792912686a14cdfaced486b3a895be765e6201f05cccb
SSDEEP 12288:BAwSfxL/2Dc34DLLmt0LDQewsAjxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:idewsAjFdCN/j2GLl3iFSE33b9
TLSH
T17E15E031FE74E436C27F0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8ec1923751ce5aebd67629a591fd2ea04add66a8a17ec2081810c1c64ba1cefd
MD5 837db7cfac5feba308f3533b879683ad
SHA1 e0882f3b20aa756d1e15296a8e0509326f8349eb
SHA512 ee3d210b3f18d5820203fd8baacd8b174716b7509f1448d867b9bb8e6560940c3af0baa59537f17203043e78906488eb957db063bd958d9b7a12c9b0038f90b9
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHS8F:EUEtQevvqc2W1cpV2EI32S
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e81ebd36b195b8cb64dba8c201b86a28a8d598ca230a4dcde94c6e918d0e759d
MD5 bb467733773733c386ee313eb1ceeb54
SHA1 8c693bce476ace989bad6e31ccc715566d8f3d3b
SHA512 8933149ed01439e27f8768b61b6fa659547294219bb55b4e782baa20dbce9cc54158133e00e36e575a8a6e7068a63fb226c812df72b2b52ca1a578cedbd749d9
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zaN/j2U4FH:7oqtVjnm7j2jF
TLSH
T163D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b2425c0508d85de426c2eb278e4f0d9d72d5638f51f5683d5c5d9ab09e64b18f
MD5 4fad567fe5ddf057cc19e9b74d3eb020
SHA1 1fc20c50d87bc674ad54a44dbde89966f84cc13b
SHA512 cabcdf08e788486b65683190bc5f69a54ae4fb95a6fa6f17374b852f9a3a71e836120240a5c8162bfb2be3389cd5ded4d2dda05c0af49433c6a842e93a960045
SSDEEP 24576:6AhGLJIFoiwtA5l7S53ydCN/j2GLl3iFSE33b9:6AMyFoiq5FN/j2U4FH
TLSH
T11F35AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 79f18c109376eb0a00b22717841f8ab9b73cf517631fbf4db9bdb2c7d8396dd9
MD5 c2975fdf3562e5a763ef139978bc96ce
SHA1 694f93f213d3dfb4edbf83adcc42ab0ac690c024
SHA512 61bd2f8f99a8eb16aebefa1f80163d804c138236d906b02866c9b3eea2f3c4a480579eda21e8d2deb77e998a56ffe7b6a41977dcb2ae3fcb5e66da450669031c
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+CqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gwuoOWRdCN/j2GLl3iFSE33b9
TLSH
T14305F14577E41CF9E56782388697C536F7B2BC512A21CB0F07A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c9d6a244a683199b2123379dbfda7df5220f4e037b5ed98dfb8fe404784ed7f3
MD5 90b1f9b65a9222b8f38f893aacc0c045
SHA1 deb594e0e3bd8d2c79fa5ebc0ac5ee8651c3c948
SHA512 6720992176f5332cd5bd17981c68837c23b1db6f72feff63d22f39962b31956d01a512ffcc2e94db3b2bcbc87eaf0101631aa01b476dc1b1bfe2569d1ec1344f
SSDEEP 12288:QBZ1IyBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OZuEdCN/j2GLl3iFSE33b9
TLSH
T1DFE4125937E471F9E1A7823C8AF59A05D321B8A5A73243CF025046EA2F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6c6f60e5a062ad1f39b7500e4471d9db03d9b3f0ab64a93f7f34d16bd1b60582
MD5 2310b7c17fb0145395360837684c0c95
SHA1 87223513027adb524675c17d3ae7e785447707b1
SHA512 8b86ecfb2f17ea150dc401aa65b68e3742aff41aaca34a0f04e954de38080b410b14d5be7b1881f92d394eadb710d872439b0cbfd86f6cdb03921fc4560b9587
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:EQRQyi36YOcPQLvw2gAf+PN3Aj2jF
TLSH
T172667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5083ffa01059fe133fde2ea0a8d42cd60d5f550a211f2f681427c794ce209609
MD5 ea85d8c42f7b69610383b0e40bcfc7a1
SHA1 3631a81573358b5e003f93f355e151ed2446b89e
SHA512 53c7be0b578b0cd7963da1b8ffb6c71cacf031fd1bfa4ff5f6e0c3ba0ad2e9afda25858ecb5444e1c03ddf6bd9daf6cb4114fab3ac39d37c7c708a0547bf2561
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:6QRQyi36YOcPQLvw2gAf+PN3Aj2jF
TLSH
T197667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3d52c6dc4bed2eb3a3f54951ecf72cc7ee515358f454f390e6da907584010503
MD5 cdcd881f7475181c4c7c3756d5c53a6f
SHA1 87affc6a6afeb68e902e5a023ac590e8657209e3
SHA512 ae5ca2410d5d8deab368b5f2f6f32cf8769753296407e72ee843274059396a059e3951b081808a6b6237bbad5d5f335df03654b26c1d2e60c2ade968a1e19454
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0UdCN/j2GLl3iFS+:J68Qg55nhheWu7PNU3/KN/j2U4FH
TLSH
T1E4B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0d264ee4fbb7af7a7de1a93541a0a8dbf94ae2f1697ba185199013ebd309a3f0
MD5 59ec5496b0e1a5c05ba1719ba7f8593b
SHA1 3d9bb8c44ac00a198386c647852ad4ff95643b14
SHA512 163de5763d3c070c4180c2de0c32a49856ab28b2c9d0b99975d3893a4aba619a5ef4c2ac2b94908599cb1677214e0b046247c51ffd86ac6dee10f501341144d1
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:3y5112gYy5azzVvL69nLKnhZFj2jF
TLSH
T10F168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6dbb9fb7fc6715728824056170036e001f3bb510e496eaed298114db3bde1250
MD5 ee39e8a331c62f19a8d4af81809e55d7
SHA1 c329d9b4b1086f3cb8435d253c94ef50aca5c436
SHA512 c4559a112910bdeb53085e853552a1463090fd10c573afc8851d1b94a5c50e00b8a8d75fb2cc55a08f51fabd3a2c6350433f4bc147a09165db68b76a5b26936f
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJN/j2U4FH:Wu6JmVxd2dHj2jF
TLSH
T10DD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7b3f2fca88f5dea80153a5d7b0e9f874bbc6159b8e6cc9762c5ed83869330659
MD5 1a39384669d364f3e9dce2700745fe2a
SHA1 dd6c4149e3e11b8a38d6135bc15a373a5d25e70f
SHA512 97e4102c14c3b6691ea4b9fbb707519586fff442653da3e72ae2750464c7efe9e8f0cfb3ad0927fdc48b2e513c71f127d0f49ad3cae3cc3cc65c5e3defcb343f
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xwN/j2U4FH:WmifPbR7j2jF
TLSH
T171B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e34b2ce1cf1d524d8c5a3b27cdef9af9c4bff80af46751e1d2ceefaf59f209be
MD5 2a88de6498a67671782371b73a0d7d49
SHA1 e5ac7b3a10aa485d6b1ad1ecdaa7a6db8be3eee7
SHA512 eb92c2ca2f4ce7b18665240957b1f6a74951947b69ad74f041b4c7fe5e34240c378434b711ce3e2c5dd7a89d4056c8c71fd155cd04d2b4d38dd3d8bbbe6b24ee
SSDEEP 49152:6SuZQIY0Be2KRRVtOnks6NMHqvN/j2U4FH:k5dKTi61xj2jF
TLSH
T1DCC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 861c7391bffcaa4d302e2f9853687ccc2e35775a915558eda8c61555870f0d65
MD5 924369f9aa289bf46c6d6f3e2e117bee
SHA1 4e75cb05977572969db3367dbe8260213d92f6d7
SHA512 43fc7818524e6b9890741a623221daeb73718c5e679ed7cf96ed5eda855857076d1a0826a95e677c0fe1acfccf70210459b1d29ea2b199611cdadb8bd07cfbe8
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5w0N/j2U4FH:DX2iyphfj2jF
TLSH
T1C095BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f88ecc46c0b20c0c2019cc3b7ce4083fa463352da43e797ea430160c7456d6fc
MD5 928352dd6de6f97f4aad3196b7181d5c
SHA1 503a703ef37e332a595d028319ba4ad75a885cdc
SHA512 7a2a870ca0ce69fc067936615424ad32803220bbb5994f76b651c9b118a5d97e993c4cc4a28f5b566d40f704a68feef45b7efca87b9a302fc96e4f5ce34ad1c4
SSDEEP 12288:w4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:w4dCN/j2GLl3iFSE33b9
TLSH
T102C42364EDE5F669F15BC37D43A99B555200FEECF6264447868116EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1f30571b550d95e191352c6453569004c7b83eceebff463d4b0cf14e0fb6a537
MD5 fc2b00286582bb47fbefc22bbf5e21d3
SHA1 443c0ce7b27bf0b6c91fce0e91a0c60c88ac84b0
SHA512 9071d1160ff58db465920844c26097545df49346c40470863883c0539ef10af069258fe49f1fb155bfc147446534d514471368c8aa42de0b76a740f541e897a6
SSDEEP 12288:KtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:K5dCN/j2GLl3iFSE33b9
TLSH
T1E7C42364E9E5F665F11BC37D43A99B555200FEECF622448786815AEB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 79ee0094d47ac11e75b4830ba436359c24dff9fed0b3322960191ca4159b4fa3
MD5 8d1a38c126b617ccb157471fc25afeb2
SHA1 1e9ab1840a36ff14c0db9d6246ead51dffe639af
SHA512 627a5c5f48d56c15a97ca6d246a2d3fff2ce95466bcd66f1df692ac533d115e9069e868b4944e5106408e985df4372e65f08e734c93dc21c0e3c56c14bf23b40
SSDEEP 12288:jzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jLdCN/j2GLl3iFSE33b9
TLSH
T152C42364E9E5F659F15BC37D43A99B555200FEECF626448786C11AEB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 fd3f11029441218e4c1b8bc31ed6a99547d0726678081cfff1077228cdd4bc62
MD5 d39ce2d591990eb59644e2731dd6bfdc
SHA1 51453d1c6603b060bf52e117c627ea644efed2b9
SHA512 8d4c246c6e107a3ae3d202456e65a26b17f29eaee22aed2af55492129adc7ad4ec7a35c0b300f6c197767e0ed7270b046f54620c0821a26a02dad3068bcb1cfe
SSDEEP 12288:2VeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NdCN/j2GLl3iFSE33b9
TLSH
T17BD42364ABF5A1D5E06BC37C83B59A11E320FDE8E73285CF86401AEF1B74BD89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 64507601e2d6223cd24b426a5cb1769f0abad46e170cdae22f35fa262dd2bc64
MD5 34302b3d5e81ce1e364e1b1810efd9f2
SHA1 cb2f2edadf7bd7ceaa5ee747a21518a865f38cfd
SHA512 b2348daa1a1adce8a4ad22328c7fbc16f079e89cb0dbb965a37b19dbe8ccd975fcc8f9aa2e7a2c911813e15447b7d3a5aac669f200e95985549aeb2c6c7e2638
SSDEEP 12288:+WJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+adCN/j2GLl3iFSE33b9
TLSH
T1EBC42364E9E5F655F15AC37D43A99B555200FEECF626448786C116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 7ce8eefc148489d4e47b12061fa3cc7afe250434bee6a5c5cb9c9224e7fbcbfd
MD5 3184c1407634d748639b3a36a35c1263
SHA1 a30df78ad91f769634cd13e4fb0a71bd05f7b316
SHA512 16d3fb7d543cd40a7386644dc10e43a24d2823cf980fd978a8560baebcf7916cf9553d0d94cfeed527fab1d90cbdae0a18118004a05d2c895ef6946805f33077
SSDEEP 12288:Z5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZddCN/j2GLl3iFSE33b9
TLSH
T1B7C42364E9E5F665F11BC37D43A99B555200FEECF622448786815AEB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 79794ca9bf2284f74cc911a4743965b5cb580d71b662132771410a2fc467c6cc
MD5 fc468b47144c78b821e9da2c24b64a17
SHA1 c6f4b10f78d41f7d6a18701762021b0cc84a119d
SHA512 2fae381fda861e95e95c7c4d3caa11c310e5b4670afc32971d8e549d858b815f2448b36507ead41c660fa2a19881e76b16e5ec804af3363efec1102b45bf8e8b
SSDEEP 12288:LlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LhdCN/j2GLl3iFSE33b9
TLSH
T1F0C42364E9E6F659F11BC37D43A89B555200FEECF626444786815AEB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6916c3775ca59666b7353f12b787e33feb30f55da3e5dbe1a57cb0de6fb1ea25
MD5 008b461029d1d0de26eb823f0f97156d
SHA1 97bd7f47fc04d545c3549277dac0845bea1507b5
SHA512 307972ec5eadf31d3d58a9a5dea7fa23533f516b2a27dfec7dfbb962404ca1c12dc3fa2556b651b4181423a55358256c55470979725b7a766a0a64aa2239c417
SSDEEP 12288:CiZwb6zzFEoS2cPvyNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lZMSzFVSOZdCN/j2GLl3iFSE33b9
TLSH
T1030502A4B39058F8EC67823EC9658906D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a485250d22be4d2945400883256c5d2be8a5d7b46028a51eb7692537356e3312
MD5 81fed666a4fdd04162d4c9576c631ea9
SHA1 17aa990032339a043bb9b31cbacea6396d6cb992
SHA512 65a1a8c243063a6589c90b8f63bb3a5d7c9f6b93cf1893cec2307f88b49cb4d2fcc3c941c47b0306a0a37dce9e8eaa71680c426dc3eeff7edb88f333eed90134
SSDEEP 12288:O8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:O0dCN/j2GLl3iFSE33b9
TLSH
T194C42364E9E5F659F15BC37D43A99B555200FEECF622448786851AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8df267fc5eeea54dc53f0448e64a4ae25a69683573b87b3f5533776aba553040
MD5 db4ac20834e342936c2c6ee58f2164ff
SHA1 04d61d1ec632ebe99f753072ff5644ce5eb02725
SHA512 20b31554246875c82df91b901069c4314b50f290c4ade3af977d4ca71500ee845d9f0b42b953049a74145a879b39a4a9c3d56216e5eb5396d8732421d7934206
SSDEEP 12288:4AJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4wdCN/j2GLl3iFSE33b9
TLSH
T1DEC42364E9E5F665F11AC37D43A99B555200FFECF622448786815AEB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e6d42a22a77e2ff57ed4035a3d43df87f98e1f8fcf42a55b0995f7b01a006ef9
MD5 6e39be40aadd40eafad8266d50b2cd71
SHA1 2fc310d4efc09b1a3fdf63ce4f5a59fb19e532b1
SHA512 cd1c0078cf4106a53a862ca7bd7adedfe538df57951dbb21e9226cebc4db1c06845b44034bd8e7701b7706843a045599d8c01921f50fd6f06eaf3318c404434e
SSDEEP 12288:5yPz5L8BJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4zy1dCN/j2GLl3iFSE33b9
TLSH
T181F40257B7A130F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 300f83f6c97f63de82490f3629c39718ec108496b80e221a293c83fb05db454d
MD5 a176ec9a6dbd98d720e496e1c4ba1461
SHA1 0ed1746f55a44a13cdd884e284fdade61107f8ce
SHA512 570d942451e30c3771b30ee63e8623958bba1fcb6899ba1aa6f29e658bc69ec7848b255f9ad0a1654cee78d455c40fb7664f42e53d705b329d049e52025bb8e6
SSDEEP 12288:d8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:d0dCN/j2GLl3iFSE33b9
TLSH
T18DC42364E9E5F659F15BC37D43A99B555200FEECF626448786811AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 929efa94d342098bd920a69763a90c55b3409561d06e8cfa969089f29ed0fdc8
MD5 3eae31e416d70f5af1ac9782a987f48e
SHA1 df3293eefcaadcabd883c2fda562108296ad8e16
SHA512 3f11a533f2b673c0eb183c211a771003081ff5a993b7254adeae696f3db2a5779d2cbb92c2cf1e18d934d9010fe41dcee604254e04320c70f76754673e4f48c4
SSDEEP 12288:r8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:r0dCN/j2GLl3iFSE33b9
TLSH
T15BC42364E9E5F659F15BC37D43A99B555200FEECF622448786811AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f91b91e089968ffa7c25181508af04174b0588e1337f712a0f0acdbf6fab7d4c
MD5 1e15aa819a62d017ffa0e42c6874c2f5
SHA1 98e8c3626e62871a852b7521a1ca623911ddd1c2
SHA512 7be4b3b97f791204564ec2820aac4fdc7901b64c8091cc05900049a4c90b59747e7bd792bac5d41b845956056fa5ca414bc72541cf6d7ad0ee7d9e488672627a
SSDEEP 12288:WyPz5L8BJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rzy1dCN/j2GLl3iFSE33b9
TLSH
T1C7F40257B7A130F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 18dd4b28420e80f3de5a3fb60022a45edaebb26f042e2ca938904304f4072f02
MD5 c948bdd258c828cd5409041e1476637c
SHA1 9bb57e68119ed7a159873730a99aaa54e0ed13a2
SHA512 dc4d5c551e172f03d762279a6326edaef5cf5a9af3d7384c1e232e96afdd78b0c234fb443122ed8dfb2d1e232d6a1646f4b4f4c402f1d0fde7e6a336ec7cb84a
SSDEEP 12288:gCd9eWYoaLHF3z0z04PDvhjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5THaLl3z0zDbdCN/j2GLl3iFSE33b9
TLSH
T15C0502A4B39058F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 94d6375a5290ba5f317b03e05d3aeb432886b7e514dc4e5cf2e1a53529096b6a
MD5 817ccfccf0dd0cf61c8268e874144b29
SHA1 8e4ea48b7367e3d21050c421214c4c4f0c22aa2c
SHA512 86171dbb56675e5822f399dd1accb3fd91d7753a14e6d5e9e50d73ac1cb17e0b73581c27bd27bb5d1c680d42fa895f5d1d37d05cfb0d354f24276f93e8987867
SSDEEP 12288:Di4e7+RdTfgwCHKy7GLbbdIvCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:D37d9CHKy7GZfdCN/j2GLl3iFSE33b9
TLSH
T1B825CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 5899c601ec7ce36f0d2d7e5c34e595bf421a657e09f15941a94a14dff6d7127f
MD5 9ab105f96335617ada2c276ba8d46cde
SHA1 246b13f3de8a36868da83430e2e746352d439108
SHA512 ed9df42d94acbb45cca927475218469fe4d65500b07faec2d432d42bb1da1e17d02d598f1eb87b9708d3d72ddfa39f7d14667a536c8dc62c394694c183353d8c
SSDEEP 12288:PTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PrdCN/j2GLl3iFSE33b9
TLSH
T13DC42364E9E5F659F15AC37D43A99B555200FEECF626448786C11AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveUpdaterService-2026-09-22.1429.4596.1.aodl

Path C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-09-22.1429.4596.1.aodl
Size 10KB
SHA256 2f157654e7ca5a2e384e9fd35ce7f74f789c4c712bdbb45db43a20e5dd351a71
MD5 c47bd0420c235a5f153e0d2c52db970a
SHA1 f69c4554161dae9ab1be8fdc6fa8c4489ea036df
SHA512 a63b0ab46ac0238ede464e4dc7d70e1b8f0feb285cd67bb9d429e1125632e594aec75f6bedb688e4b41ac6aa6c51725ee7c3a223f50c8d5ea5abb98cca899d42
SSDEEP 96:QX0ipBDw1UDoVWfZ+KzBz84T44+4HdkHJYeYWHYHH5ijiGaLKVK6k46kp5XLvSP+:QX9tg+CpPP68OGaL6q41p5XLvSPv3jSn
TLSH
T19E32B0DBDE458420DF62313655A1CA4E2AF4C8AEEC93F82B72C5AD86145771F27BE301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-09-22_142923_4596-4656.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-22_142923_4596-4656.log
Size 1KB
SHA256 75c4aaea123521939cb007553e051550fb8a574aff206bf9263cf05b6889b434
MD5 bbdb7b445f1f585da67ec25e0119556a
SHA1 91d4e9013a16bc898113658b3def1965f2b481c6
SHA512 e336cc72cc019cfd7a87f7e1eccc5321d6f1ee62c95963c1e76b3ec283f919d8b93e0a23b37f1762d28cfc1f336c06a8b794867677811623a617fc802e0120fe
TLSH
T1AC21601F6FD41A15FBFBDA8158FA14535E3579926835C90C10E0428E0871F84FDB1357
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 849b6f519fd40832878f358cd2be1a67333eb577d43e085b9afcef517a6879fd
MD5 fab55845c864a4c47d42894b7359b838
SHA1 327d3af2dc2cc9f94c070f205fb6b66773afc906
SHA512 d8f1a888373b92d106f0d225db570223507fb4e0811cedc09c3dd633a29b3a94bdcfac0f492e71fd0c66d9556b8dc1b7e852dd8bfbade58925af9c32e99bcac8
SSDEEP 12288:uNsfsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XEdCN/j2GLl3iFSE33b9
TLSH
T1A9E40119D29852E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F39AD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9de4bc4f6ba6b7cb58525018934c47624325263e35a0fa89a02df4bb4fda0ed9
MD5 ed6934ad0f7c0dff7917fdebaf8fbd01
SHA1 af61208c1173d8a8821cd9c2768aab9430bc6fe7
SHA512 1efba48243e695609c12c2b1555735d5a122d3df808bda3b15db6c43818f72e863eca801250ab5d5f07054be2d3f82d09edfcf7d583a0e3608ff8a706de53416
SSDEEP 12288:AtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:A5dCN/j2GLl3iFSE33b9
TLSH
T1BFD42365D7E9F656F17FC3780269DA252200FEF8EF258487854116EB1278FE8D832523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c3c164b23fbcfcd81a6602514323511a2e71496a46b8cedfed87f9c7f170a329
MD5 bbdf00554e5fb952d4269e58db7efe2d
SHA1 479b94c266f14cac51c22ee201c9b3bfcd029100
SHA512 032c66a02306e404e33df9e0bae81b6cc82e710ace6b4ec9269986426917c86489196651c4955536fbfd4bd2ef5d5648a27c07ebf1505b6e3cea4f21b09cbca2
SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQQN/j2U4FH:Ya0hNYG4JwBj2jF
TLSH
T10E85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 4acd6f3205fc2be30254690e90270515317794870a81625320c3f029e538cb82
MD5 e8a742eefdbfa16bc384641518297cac
SHA1 52ac5e0f5103af1d955e363f8431562d4bb6da97
SHA512 6c46b20f4115c87742dcd76ff763ae877a7ccf466e970c37d60fa01226d5e73637df322f067013d74aa50223309466be76b002ac9f6128030c56374d47313386
SSDEEP 12288:chbHjfXAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:chbHjPwdCN/j2GLl3iFSE33b9
TLSH
T195E4027D66AC21D9F176D27D86958A06D330FCA8572183DF42C182BE1F3BEE84C35A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b4692181d265d02c94ab6da0f35f7c852027db69382942d7cbf0509c2a3a84b9
MD5 a663accf2924299a20f7ae651099a612
SHA1 6fc897ac6535b8ac2dd3dce3fb7786e5d2e2f1ad
SHA512 d82a2fb4896108946b01839e4bc782a4c3e05137ae78712f88d09fb47a257cd667560dd4cf4ffd3e3515424460613255372125ce38bfface7f145a0ba6b3ee2a
SSDEEP 24576:c3YgnJcRTk4yti+R5dBR/YdCN/j2GLl3iFSE33b9:cIgnaTk46pBR/DN/j2U4FH
TLSH
T11845B02DF3B910B9D4AAD236450147B5FB71782D1F209ACB0170C538AF1AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 db664b205a785181afab59e3d3f8147b00a2b42b5a56a48949bf327372aa79d8
MD5 a547eac17e507f0a935d293067899873
SHA1 f3b8ee5beb9be06c68061a2e8d2be2cfdece071b
SHA512 69a8802d66c2bf1aab2c32f5b27456db10203b8c2b1ac328449149b5ad55c4d545260eed11189bf6c42bdd150634883750e52fef1971e23c00cd0d41c79f49e8
SSDEEP 12288:ERJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EldCN/j2GLl3iFSE33b9
TLSH
T1A4C42364E6E5F659E16AC3BD03A9DB156200FFE8E73644C7858166EB137CFED8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 7b92ddc45c22ff56d6a5b659b06af2661b56c83202cfc967fbd745a2500dd00d
MD5 b4ebac9adb53a6081762bc4bbb09640e
SHA1 f1cff210425aee0658520fb63e59eb1d9dbfbb3c
SHA512 6bb6f05baea579721b16d8bccd1713966dadc74965d25e752971aa148436855a25d5fc9760d2e2cb024997bd52418a26749eb6eb6e804de5d1a67362d3f2a47a
SSDEEP 12288:FOb9A4LWOsvAYFTOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CpL3UTidCN/j2GLl3iFSE33b9
TLSH
T15E25F154F7A450F9E87BC23C85A68A16E271B89C0764D7CF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 2b6e1c8c4415996aa08f505fefcf0f030bb634f8e0c7534ce781ec8b46d0f7ad
MD5 a794c96e19d85213b9853eef2f068256
SHA1 2bbb672671b3a7f9a41bdea7c356441ba339320f
SHA512 9bb8265b2a8fa57d37704112ac5cb85e38cfcca4d6741b7fc766dc7b8fffddb5d69606479fa8bb93b42758ca8db5b26456e1a8abe73996912d49349b19635413
SSDEEP 12288:ApFtpOSJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:COOdCN/j2GLl3iFSE33b9
TLSH
T13EE4022937ED20E5E17A923C86968709D330B8A5572247DF42D081FE1F67FF85C36A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e03574cf2995ec40de390ac90160a395f0323dcdb18e230701e4ee1d7cb358ad
MD5 c7e75c75b28d65cc6820442f7090bb29
SHA1 9d17885aca877a196c3aefb7f4c7b9b656659ee4
SHA512 875bbb1b0f07dc498fcedb8cdef55e8c125ef51efdf4781c0f3866dbc927a3b0b0aa641bc4a1042f397b4a23518062719f43c618d605553ffe44ca9d045b34c9
SSDEEP 24576:L7NM9YqZqmWMUkPjZM48Mv6bEhsJdCN/j2GLl3iFSE33b9:L7cBWMpPjN8DbEhLN/j2U4FH
TLSH
T1BC65AE2E6BEC81E5D477D13DC9E28606F6B1B4611B318ACB1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9dd462e3babb167e745b317afca0b95a92765d30e50af9c809a145f1dc850aa3
MD5 e069d8ceef1f268e6ee25e3115ae9e9b
SHA1 a892cc9c4fa5fb6df1418869d94adc1ce0c38ec2
SHA512 284f3e7d86fd07669f40ac1cc15f31185b9336ec527376e63ed661eca746827fbf8a29291444a089b7128c2d52aef07ed2bd0fd85142ff51a619c06575475434
SSDEEP 24576:YW6BApg2YuyuNDYTabvcdvNYf8km13dCN/j2GLl3iFSE33b9:YF2YuHNETovAvNYf8km+N/j2U4FH
TLSH
T1AE858E2927ED80A4E0BBD27D45B6D246FAB2B8551B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7ca8025ce5d46d87faa92e8960deca919e453da1728711d74cea9c307240b8d1
MD5 a3cb27c80344ce93c9552bfce85ea6e0
SHA1 733133972ea0d01bc011d83d262d9193a0ba90b0
SHA512 a4b3cbef3a0803554b01acc1fc4e8d85b023b23ce2f6b85a6f5211be0e08049d06402ad36cb351ff2432a35fd6b771f734dacd6d4ad9fe88d21995ecdfc7645f
SSDEEP 24576:WAFs06+Omlf3NXEbToqdCN/j2GLl3iFSE33b9:/Fs060lVXuwN/j2U4FH
TLSH
T1C165BF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 51e513946c952e1287de3b9381922b2303ff9aeec9fe04e8daeb46e2ecb1c8a2
MD5 b3f3d6b86cc722bdd7dca5fe278b1534
SHA1 6bc805ca0906487b4e35367f0b9855fe84ecc7b2
SHA512 49b8f363ffd68e146858f107079be125016fcbebd1d79d1cfad9fb6c0aa388deeb985acee7c6d20124b21c4b2856d927c63a2afc74e8ef0514ce7d0e0b0f46d2
SSDEEP 12288:gCJnJ5D3VkrDzx9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1JnJ5D3WXzdCN/j2GLl3iFSE33b9
TLSH
T1CF15D02DD2A810E8E4B7C2B4829A1B56FE71387D2F2269C718B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 07544b2803c6b6dc98072bd913ddedfaf49d2ef8c702f92d60e49df9cf8a196f
MD5 41923ae40700ce3554b27457469a86e5
SHA1 23b9551763121989d4a2180e3ec046e8356cc2dc
SHA512 c893ceef7e5438653ddbd438d36cf484d36b46683a48fb946c8241f0307e305613f6cdc4574fc8d34f79869975ad640f5ea31e32ee3fc686238fa6cc10827949
SSDEEP 24576:wEPghm6/7IIXdwcXrif7qQncjlP65i3Vu4dCN/j2GLl3iFSE33b9:Pg06DIKdwc+eQnSt65aVCN/j2U4FH
TLSH
T12A956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 bd3e055b2fb7723adb07246a2542c24803cf178ee2839e03bfab24661e5fb22a
MD5 4cacb510dafe187753a43316f1cdd00b
SHA1 5f9744edbb542b76a5fc2b7cf47666d80e2108c0
SHA512 4469d6954ef3c2ba657391b1dcd7cebc6d228259e0c77ad989b22272630067cd3b88fb5623c1f63cbb53012930404f7e570aefb4e248535bdf6b1bf61d8a9105
SSDEEP 12288:wEP3Rn3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LnXdCN/j2GLl3iFSE33b9
TLSH
T12AE4126D6BACB0E9E12AC13D42918605D331F4B4AB2217DF42D1C2BE4F37EE95D39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 0ebb46b4e559db8b94b20d6611c076ce0998dab823e1c0f456aef85757f6b701
MD5 e72f69576c6e39049a604963c2de6bd6
SHA1 7fb40ac6a58bd177537000503599ffda5d818607
SHA512 d259e44f1ae989cd9c757c5509f10f610a22fa26ad9f9861fa9d0553dce0502df12cc173f2ca9e2df2e6056456e5333f6d20b1111ffb5a574cc384066678dfe1
SSDEEP 12288:xjkywJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xIyAdCN/j2GLl3iFSE33b9
TLSH
T13AF41214A3E4A595E5BA427C86B686549A30FC70EF2186CF41C0E77F6F3AFD49831B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 2e50f865e9115dced592d6a7ced7e5ba4cdaf7976af8488c7eb34ecc3f6de4d6
MD5 7788940895b5e70beca0ca1a426dfad5
SHA1 24f9fe70d0f7f107d106430f1140b2e011e6bee9
SHA512 7f7542706c71e875c2a17db923d6c7353ef1534a7d48a1178cd9de06ebd2fed8f06bd432718c31ba2e9e8e82977540799250e4e9ce4dc9f0fd0f455dcd1e4bca
SSDEEP 12288:YyiJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:V+dCN/j2GLl3iFSE33b9
TLSH
T11BD42368A6E5F569E52BC37C03799F515210FAF8EB2144CB41C0AAFB537DFE89032852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 637f31191c2490dabab956b9558237c280714232b6cb1d85291bd71a71867ca2
MD5 afe37db30f10e0087b4d8b484dee0089
SHA1 29291293861ce74c809856685034f3ebba83c409
SHA512 e7fcc41d468c9f1725c010cdded934a999304aa763afb6a3c55811c8f2b523f3b2c05acd16437df9102c322e19599d0077b1c986c071a16637b21b04d7d0e411
SSDEEP 24576:iQ9MxZKdcz9dw3xdCN/j2GLl3iFSE33b9:iVKZGN/j2U4FH
TLSH
T1D6558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 3ddf4b8b560c99e61a90d230e3f1c04f3a33ccc94e7c28ab20fefa5b5d460fc6
MD5 d38cfee1df794edd97640ff22cd01c39
SHA1 958f1799f1a240f74250e0892ba9ba7e20e4ec78
SHA512 42ec4396370af13416610d3b8645001a5bedfa509fef9a428a29eea0076c56e37222173597a8717c3d95eccc8d4a53a4bdc0be39d230b722dcb3e5df38361122
SSDEEP 12288:JyoKo2JRple9p0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JyocDAp8dCN/j2GLl3iFSE33b9
TLSH
T19DF4E01FBBAA40A2E076823C89858745E773B0705B6253CB5191C37E4F27AECBD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d6f990c1ad15f7d921e7b546bbc15d3ac2c3b3049574cf0b6c44c4799ae2697d
MD5 898f12f65654c493b2bc1362187ef81f
SHA1 063f6b3f318500ea0f870da4628a9212971b99ed
SHA512 16dd967ef3022de5cc40698a35fdcaae534813d0abf87e6ccd09a46c2938840f75df56cf4458b1ff0f9ee0c53b89feccbd1a1e1a06a634ad117a8891f974ac95
SSDEEP 49152:gWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKnN/j2U4FH:S0zuNILj2jF
TLSH
T167A57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2798d7394faf39200c406c97366b14c7eb2765f1956c4fe983df5f969599abd4
MD5 cf19f2408d5d65e37e204b66bb558684
SHA1 2029dd7fc8adcb3e415f836471fa775c9fc4203b
SHA512 811f7b0b57e7acb28bdf85ac60791e9eabafdda76fb0d32a819449b1f1bafbcf0ea9ddf807999c06f1da9670fe6e4c1e8a30939c01ab182b23f85fc649980884
SSDEEP 24576:71QT7EcpfxR+N5AWAz3ooiYtjMqbXdCN/j2GLl3iFSE33b9:GTDxR+N5YzTfjMNN/j2U4FH
TLSH
T14C55B02EA7F855E9D17EC5788B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-376-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/540-312-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/928-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/928-69-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/928-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/928-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/928-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1284-375-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1284-307-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1284-309-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1284-301-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1516-83-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1516-247-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1524-85-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1524-248-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1524-87-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1524-93-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2028-269-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2028-270-0x00000000005C0000-0x0000000000627000-memory.dmp

Download

memory/2028-327-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2028-275-0x00000000005C0000-0x0000000000627000-memory.dmp

Download

memory/2036-377-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2036-335-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2036-282-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2184-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2184-30-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2184-36-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3224-328-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3224-380-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3408-41-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3408-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3408-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3448-373-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3448-286-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4248-259-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4248-258-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4248-322-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4248-265-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4344-336-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4344-446-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4560-378-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4560-321-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4596-0-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/4596-9-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/4596-8-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/4596-76-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/4596-82-0x0000000140000000-0x000000014047E000-memory.dmp

Download

memory/4652-413-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4652-333-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4732-379-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4732-323-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4792-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4792-23-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4792-38-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4800-395-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-398-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-415-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-416-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-417-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-418-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-419-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-420-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-421-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-422-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-381-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-382-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-383-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-384-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-386-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-385-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-392-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-423-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-396-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-394-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-393-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-391-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-390-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-389-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-388-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-387-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-397-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-424-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-399-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-400-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-402-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-401-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-404-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-411-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-412-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-410-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-409-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-408-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-407-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-406-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-405-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-403-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/4800-414-0x0000018978830000-0x0000018978840000-memory.dmp

Download

memory/5484-332-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5484-279-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5536-63-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5536-86-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5696-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5696-317-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5960-289-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5960-295-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5960-297-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5960-374-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6056-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/6056-246-0x0000000140000000-0x00000001400AA000-memory.dmp

Download