stealc | d0381b7bce0a9957b6de0a39ae74aeab743a6c57b6e949b5f41d409dbd1bdbfa

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.6MB
Sample261001-qq2bpsxfpe
SHA256 d0381b7bce0a9957b6de0a39ae74aeab743a6c57b6e949b5f41d409dbd1bdbfa
MD5 606c4f1c4b9f6fbce8fc8c51c5615836
SHA1 2a607d36b93df240ecce1cbfdd7d5cd3872d84ec
SHA512 7bccfd615c84d47c82c337e91841f5b9f47ee7ffad4a884390562c68656dc07333f4b566806016a38ce2946e16b20a51cb303bcbd31f197c60c58e16da8385c7
SSDEEP 24576:wHm+hLA3BVrYRd/busqjnhMgeiCl7G0nehbGZpbD:jWA3jUFuDmg27RnWGj
TLSH
T1C275D006E3F905F8E0A7D1798A778901E6767C4507309BDF13A0957A6E336E09E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/4776-14-0x0000000140000000-0x000000014023D000-memory.dmp	family_stealc_v3

Executes dropped EXE 22 IoCs

pid	Process
5872	alg.exe
5144	elevation_service.exe
2872	elevation_service.exe
5204	maintenanceservice.exe
3036	OSE.EXE
3056	DiagnosticsHub.StandardCollector.Service.exe
2776	fxssvc.exe
5132	msdtc.exe
2588	PerceptionSimulationService.exe
4356	perfhost.exe
3584	locator.exe
4536	SensorDataService.exe
2624	snmptrap.exe
4460	spectrum.exe
1628	ssh-agent.exe
5312	TieringEngineService.exe
4168	AgentService.exe
2800	vds.exe
1440	vssvc.exe
6028	wbengine.exe
3320	WmiApSrv.exe
2572	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6d580aa44bb6346b.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086158dfda851dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000531ad6fea851dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031d9b0fda851dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bee85fda851dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000179e96fda851dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6cbc7fea851dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc4037fda851dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000174de5fda851dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c58e45fda851dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5144	elevation_service.exe
5144	elevation_service.exe
5144	elevation_service.exe
5144	elevation_service.exe
5144	elevation_service.exe
5144	elevation_service.exe
5144	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4776	2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5872	alg.exe
Token: SeDebugPrivilege	5872	alg.exe
Token: SeDebugPrivilege	5872	alg.exe
Token: SeTakeOwnershipPrivilege	5144	elevation_service.exe
Token: SeAuditPrivilege	2776	fxssvc.exe
Token: SeRestorePrivilege	5312	TieringEngineService.exe
Token: SeManageVolumePrivilege	5312	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4168	AgentService.exe
Token: SeBackupPrivilege	1440	vssvc.exe
Token: SeRestorePrivilege	1440	vssvc.exe
Token: SeAuditPrivilege	1440	vssvc.exe
Token: SeBackupPrivilege	6028	wbengine.exe
Token: SeRestorePrivilege	6028	wbengine.exe
Token: SeSecurityPrivilege	6028	wbengine.exe
Token: 33	2572	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeDebugPrivilege	5144	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 5180	2572	SearchIndexer.exe	136
PID 2572 wrote to memory of 5720	2572	SearchIndexer.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2872

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5204

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5004

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3584

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4536

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2624

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4460

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1628

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3748

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3320

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5180
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 16ae19331d8f2f56254752241c87511ab16f70330c5a3875a44d5550a279abfd
MD5 29684099ceb4b54eb8154cb071fa8d93
SHA1 91c3631971136ae78dfc26fd630ca4a2d8097551
SHA512 49d73309951de0d4bee9ccfb2d7008afefeba455b11b8d635f941addb8c3d35c830b92111c1103e69de6adeb33aab54920d80401ebf64ff159ba07751a3dc42d
SSDEEP 49152:kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnnDmg27RnWGj:e3q6sjBMD527BWG
TLSH
T119D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 88acd7d4cc2dfc341a910c330d40f7576aaca2fde818b9f72ca6a0bfac4e3d07
MD5 1b909c41f25278d286883efb5a08ec34
SHA1 1d13369fdef1bb9cb03662203b0c9c15454061d1
SHA512 5ef45500fabee1e2915848390a60b7a2100bb0fe664ab6e9c0d9b90046cc9cf435d5dcedebf0602d3f043d1f2da9f3533fd35f6df7d0eaf774920ffb10ce9339
SSDEEP 24576:MXYfDtczAMsqjnhMgeiCl7G0nehbGZpbD:rtcpDmg27RnWGj
TLSH
T1FB650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 691dbe18c3c6037ba583a5c52855e480475bba36760ccde251402fd511d4724d
MD5 f8cf7eaee08779ce3c05c5df2411d856
SHA1 9263d7df1e97c6f9eeaf78761acd6717bbd0dfc8
SHA512 3dbd241e541013c84525156aa9ecfaa8a4e0ae4d5e2319387a0f2632bad19eb379ce51643de47bfd3f84c0ca149fa1e1b4e6e7fe659709a9c5dc9cdc3b224ffd
SSDEEP 24576:90Le5ji0hmxxrM7sqjnhMgeiCl7G0nehbGZpbD:9Pji0AjWDmg27RnWGj
TLSH
T1BE859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 094c058faafa0f5dbe11db4bb4a355fa730c5803501ffc8a306349edad84d496
MD5 cda6b346de511c99eda0cfd3a46e288b
SHA1 bcf0bdfb0e062292f5ecb669ce210be731caaca0
SHA512 4bee7159bac45941ec68563963da5039390e891c8599c48ba287aedcba6ac889bcd3aaaf164da28835e6af5ddd6cf3196ab030c6c47c654d3f8656ae91bb1454
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyuFsqjnhMgeiCl7G0nehbGZpbD:6/ezSC6vUzPveHjyyDmg27RnWGj
TLSH
T1EB755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e1c37cb864ba675b1bd67e634c774130851af5709f7f580da1a9c727a33ac8bc
MD5 2c0f80a246335e85dfd6e659895b3528
SHA1 49d5adc841915a492482c056190011c1dbdf673c
SHA512 6abab035bd1937ba777b8cecc266e46c5cd4d13742da40dd98df558eb3a8058b907a1905a24f25513d207a804e25211a31d8090fe0d66b41da60b9f42c076664
SSDEEP 24576:GVbqPb88hv/l+YgsqjnhMgeiCl7G0nehbGZpbD:GVO88hXl+RDmg27RnWGj
TLSH
T1F5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9e857bbb8736cdef5e3ef09d5d01954e04eb1571af063a4b9cc217304ce6fbb8
MD5 67f034995be93ede8eb4ceb793797f20
SHA1 509324919bae6023c2e7bcaad92ed0dd1ceabe06
SHA512 b6752b088df64f3db9c84670e5b78475cdcd22e4ff4950a288fd8ed282a9f575d0b807af4576b72872383a66ee78e3053b13c3df508d96b1146cd0c90ed18370
SSDEEP 12288:tLvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tLvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6f88c92e014f4a05630dec67bee8efffcf27703a9f3fb471fce4afa346d1c73b
MD5 abf126fca62bc5f71a518616e2cd1b5b
SHA1 85f3f2d767520f770dc8c5e9be6dee1721e6a518
SHA512 f32269fa23d7dda978b9d80272a5b74e2e0d704d1fd8b1adbd8388f44909a355be27feb5c6c7efd3b353141d0041ae9f2e3aed33cf8f7a0e50875ff40d559c58
SSDEEP 12288:feBNUbTVO86U4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:fJIU4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19165CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e5ab507ce6769d4ec6813bb8d2fb3b4116399ead277395d758d684b3b1676953
MD5 e7aabdf1feb7e4fddab8b2328e5c88f9
SHA1 1255ed28bd222916aa8ddaf6a2d1c652a6abf994
SHA512 827cdbcf227c40990a666dc12aeac104d679956a5bf0ff7ce88af2d2519d32cd6c0865bc00936bf31e3e9d5fc5a00e35e1fb8a03760bde339ba0281242206b63
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THH:UQvGAdlCEL8c/DRNw5CJD527BWG
TLSH
T1D1266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d30d476b101244dbaa24fed1d709db4d25eea73c7976946d6d35534a3798f3f3
MD5 2714ab9330d0916bec9242cbd92d85e6
SHA1 51a449f0cb34b5d1c361b42b1a7231cd9e4d7999
SHA512 a294cd31e3b30763da51f44ac6362e127e1c8a813a01947a42c30e0b0b9ca17b79e67f997a9c22c9a4087b210340989b28bb20f19743d2911cca2e1c2802b21e
SSDEEP 12288:QAwSfxL/2Dc3RDLLmt0LDQewsAjiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:l0ewsAjisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A575E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 749969dd42f35c21c7db47bda08412399dc7ee34ae81c6eaa18c3f8a3889f471
MD5 dc6dd3c6d0159380d43d8ab14986d36f
SHA1 2c44948f74fac9ce2a541699d1d35684727b2ece
SHA512 4cb5504781b108711221720f789aba8219322345294f4ee6ec9520ffa72662f09948a86d2c76762ff2b8903cba719726cd527fcf3bfcc016a9c2d3154ccd1694
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHeVQBWG:NUEtQevvqc2W1cpV2tI32RB
TLSH
T1A9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e79153808aed29820af0fdc6d0d6af52ff68f60c321751b343eb22b245996bf9
MD5 b4e6dd2afdaec2953c64e9c7686f01fd
SHA1 066944eef296e13f95d46100e9f1856dc154065d
SHA512 303602e74002d0e9575ef5306d3115e14ec439fe16510a49eb1d0ede35bf75db22d2ee67d6678e836910f5c84a7ac5202b1f60abeedb1719afec56e94173cd3f
SSDEEP 49152:HCbRquA/m2yL5zTfFiV+XenmE3/zGDmg27RnWGj:QoquVjnmlD527BWG
TLSH
T1EBD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6258a80fb495d7bba95d0f239e7131034c8548f9e5480a5d4e05a9dc91bb22f3
MD5 a8fd596e6651131693d17d1f649f0b7e
SHA1 cd5194f232a32091d798cdfdd27e790c8e73e303
SHA512 f9cdd51a3780d66fc3c00242831f84246cc16bc6b790bd9758101ff84866cdd42a7d301b400cb33374cd2578e5b7eea83e69b65c15c0d004b9892e5b7b23dc02
SSDEEP 24576:zAhGL3IFoiwtA5l7S53xsqjnhMgeiCl7G0nehbGZpbD:zAMUFoiq51Dmg27RnWGj
TLSH
T1A6359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0eabc95991819a9fabf1c44e6b437e6c566f23ba55d857407ae1e9ccf94d6d54
MD5 4ce3f4dc7e72f5e73cd1e55ab784d895
SHA1 9c2b9c22ff6280f68e0fabfa27c5f451d911b384
SHA512 4a608bd070af75214676859e7d18dcd2538b5c950d437916d1a809c1fe5450a0e67f9cfd1e768bbdf99f7191ef9bf8b660a4efc37fcc30150186cc0187dbf780
SSDEEP 12288:+mw5HEjsChNVBFgl0WDm+ClXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Xwu4OW+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 43e84b2e18aa7d82f8ed9e14ee624d5cd09b3521058a585d04e85235894af8c7
MD5 d6f488475d49715914093233c7e51302
SHA1 d62295d6315572d41d3dd5fdf9229bd754903a56
SHA512 636edaf63a7965ae4f6b9fd59dea91b2ec436baacb2c8c7ab6af632b268ad79ad723c33f94f5c27362c67321cba8cdd282d32707db228f96baf17e375ef9d8c2
SSDEEP 12288:MeZ1IyyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VZuzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1425512AA239820FAE163417CC6E5D609E7337C62673043CF166259AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9b80a75463e4d044cb7d82513531e69928c79fa6c63926c065446d3c5251e6b4
MD5 08bf00a5af4d58a38dff5152835a1559
SHA1 93712d40328a3038861fd4d2c2b41118d9e83c01
SHA512 63e449825bb74c6ad69c8d4e9349dc1114aef27fe0337108fb4ba37478e0ee415761a96c83a3d393d340647ead39cae017215f18ecbaeef63c75555c66b63dfe
SSDEEP 98304:fQRQyi36YOcPbLvw2gAf+PN3gD527BWG:uQyiKa/X+PNQVQBWG
TLSH
T1E1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d6e3cbea5f35a6b4776ffb3e16ac94e8accbe44d71907a35601c0416ed6c361e
MD5 d99c660ca5511f26ac2d9f727deec5e4
SHA1 71141150eaae2182d5e7114dc3f6ab9e65f4b7db
SHA512 8851358db35ab89abdd465a39db1c6d72b4682daeaf1853777bb2674994dea3dafdcb4533db42e52a88e5a5949bbe8e91848d24de4dc48578e1407ec7b2f13ac
SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN3gD527BWG:TQyiKa/X+PNQVQBWG
TLSH
T163667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 47c21c208b54d2e58afe1254297b7a9403ee9001610b2618cd1204baebfbbe0a
MD5 34a4caab153764bf31973849d4172a8f
SHA1 9446aafc2434c4c4070347311beaa1645a78321c
SHA512 978ca7e99b90af357f20ede94d9c272db87516e49d7e44c11f47f8d6eaf91ed3970498be23dbf7f469d4fbbff4004c8301dd27e2742c96d5cf6c5862d5e248e1
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0jsqjnhMgeiCl7Ge:768Qg55nhceWu7PNU3/WDmg27RnWGj
TLSH
T1ACB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3f8c6ce6116f181ddc318398c12268f535221a377e559c6c4026d7ad21fd95db
MD5 e5e6629f5207eb398236f76d037a521f
SHA1 2a0cfa683c528aa50236a88dcc78731c2fb62114
SHA512 5176bd1afd0382a6ee216027c3350880c8add19906c53a4d0e757312ed16c6aeaaa786becf7ad7a5b4912631611fc97f03bb55e6e8c9797eef2ead1d32bc9fff
SSDEEP 98304:my5112gYy5azzVvt69nLKnhZTD527BWG:XLIHEWh9VQBWG
TLSH
T19B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0b0d13b13f216a9c95d2391c66780562a30ff9e3d913a805adf6dd5f8c966496
MD5 3e94bdad816dad37bd8b14fd3ee0953f
SHA1 d342847c2c80801cb4f481cb476ba6a034575202
SHA512 32c97df1a272091e371a81b6cf672e2de3c69afb95575ddff248bddd94df7527a6c928b0dce8d23ef22a64af5bea6c6e712884014b7d8759d52bfb4346069d11
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gloDmg27RnWGj:/u6Jmdxd2doD527BWG
TLSH
T114D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f2cb2c8c12e43538fce0c275b558ccded7dba327ddda0a6f1c491e698f48b5ee
MD5 7189dbddb0760d507accf689775263e8
SHA1 bfcc90100c9b39482fcfad0035b5e998187a9537
SHA512 07046afa9a33bf2c8d16310740fe2f5d76296518b93bcdfb7ac2f7aa8280dcf7ecbd50aa0be7a2da991d45597165d17a9d515750b15efb613d38004af84aacf3
SSDEEP 49152:h1hpsNoJpF1A63U44CwH7R4xEDmg27RnWGj:hmifPWRlD527BWG
TLSH
T174B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 934e4f272052cae220f4a6bd4b9ecf0bfac2146934c343f5af2e74b103e14c81
MD5 a6f3c13c452b27cb77c4b789ad4bd974
SHA1 a92455ec8f57e0ba7394591e5d2d31d65f2fb2d1
SHA512 880f28b5e62af4bb8f56684c136c43252bda512fe61df5d5b28fa6913fe24e445c46815fb96f7ae623ffebc2b867b811a6ca074844c3ac5fea06a5d7be24020c
SSDEEP 49152:1SuZQIY0Be2KcRVtOnks6NMHq3Dmg27RnWGj:b5dKii613D527BWG
TLSH
T1E2C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1d0f4cc4abbb5ed06e02d9bfc52b610be55fafc4aa8e7f49b42220bc94525b31
MD5 c9e30a5b1996da600d70a117f6ead448
SHA1 5a8d1e67aa6d9a0c574b4eb64d9e9193ed7d9683
SHA512 ec485c4e5ae01d822e6392d4307196720b066b10d2eb7f5dde6b3e3075261f4ccabca6ad9a6cd21e13e2e522b1126079efc52da3162ef96730de6e40ac3545a2
SSDEEP 49152:ThtSn8EApI0fig3giDn0AP5w4Dmg27RnWGj:SX2imphhD527BWG
TLSH
T1D095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0e54b9c2d4b7a0946a923890b90bba626727d384cb137f0fb39be34a4a9031bc
MD5 600b0e150037fe39f092e9aa5d922822
SHA1 ca4f2be0d076e4a7bc2e6dd756f5df4977531bea
SHA512 a102c4ac228c1b63c330964ad80b966b54d339791feeb2998cad462abd9a3d07a24cf75c15dbd20eb6c542760c63cecfb76631495b42fc8af973915a8981c5e4
SSDEEP 12288:7nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D54523BF955C41CBE52648B5C3E5F10EAC073E5BE92004937A577CBEEBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7f0e8d15b6a7258a82aeddceb7bb5ca1d1e7e653dc291250b5573e86eab7baf0
MD5 624fd87e3bea482c6f7f14bd888ec66b
SHA1 7d91056ab8da08da0297c111fa4d390102b97151
SHA512 6ecb9f53c00a07ec63f95cb33eb69a84576f39fa8caca863e6cf9e8dab27a670003dac42f3a1325198b57b60b233a1deab4419d81b6d29474d1230a9bf86121d
SSDEEP 12288:wGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1994523BE955C41CBE62648B5C3E5F14DAC073E5BE92004937A977CBAFBB14984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c8310eb4987a144a5bf76697e7296bd448ad93c8933283bf7b76ac144e37951e
MD5 555f842eb42bfea961de2850e2b375af
SHA1 151c200fb12b6cb5d5a6ad519c24062cfa0625b9
SHA512 1112a61c83874bb5e127f77b038347b392786cbc25d64cd9c3a6b2084865aba72c63cbc67e913a8805c48c06b0df02b5c9366f2c79630d896d4b471f1a4f145e
SSDEEP 12288:rQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1774523BE955C41CBE52648B5C3E5F14DAC073E5BE9200493BA977CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d301e8d9d44b0c96af9ff282b31016ef652149523fe98a14b866c7ca223daec3
MD5 4dfadadc8a324b7d125b03e53060b261
SHA1 7c3c57d851f7ab730325d55387aa679e04826689
SHA512 23704572df78282c152c940875d5bcad623ac16302313188fff97a139bdb2261eb419728a758b1ea778c1624c161213a419d986ccba002e1057ff40455efcb84
SSDEEP 12288:tVRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13145236F635C01CAD83685B4C3F5E11DE8237D96EB30059B6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 beccd2fcdf01ca9ddaac200faead67e734993bb5eff610528a964c13207b92d1
MD5 c70a3b95410f271d3442832654c503c4
SHA1 cbe226ff97dfc33223a4cd36c536cc9db42a359b
SHA512 c9b78e2b6f4fd4d1f4135dbdbeb0ed8a9d755497f0e9c733500891b44984e2d710568b4559fb74380aadfdcf71438d96a1d5624b08d9241c61a63fd6afb9db31
SSDEEP 12288:EZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BE955C41CBE52648B5C3E5F14DAC073E5BE92004937A9B7CBDEBF24984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f945b7265ebc081fe1703881cd27edb6b9b1affab42e15aca14f7ed4f63c48f4
MD5 42837e5fba248e9bfc9e12903d6755e9
SHA1 0b5689f0e2ec71cbdc6bfc5d691ac84a1f1d3b78
SHA512 7eef2fe933d8af5e6ba95f6d766d4ec62514167e8cf57b5278faac29ef2925a31bb15efb854b80040c09e0e1802a5b975ad08700a2f80e345e0300de088b5f77
SSDEEP 12288:MaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1154523BE965C41CBE52648B5C3E5F14DAC073E5BE92004937A977CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 03de534dea27038932be2afd795528037eafe0bb231c3f556b140509223592d5
MD5 c97cda4542691dfe42953be1b9b6f85d
SHA1 90df81162bad4794403eff2cc7e2ac36a3528dbb
SHA512 814b176aad17166cd7fc5b512a5113ce6e154080186933ad8ae6f12f6179b7ac4955a49bd5542a106453bed619cd02133f5b04b51fe35f9524e7a1fcfa6ad613
SSDEEP 12288:buXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:busqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BE955C41CAE62648B5C3E5F11DAC073E5BE9200493BA57BCBAF7F14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 150bad6ac221ed05ec5196163927ecea33da0e89ebf43db2b62f696c6223aa6f
MD5 c923c8390b7347a9aa3a9853ec37b906
SHA1 3959e7979416cdf9c4419bb29024eeca47cacfbd
SHA512 b9902b11c1e6dd805baa1ca047e76379bbda0cba2d30d0d9bd4b7382a89d2958514ddbe45d8611b59e33b6a90e048caf9dc83572bd1e41d54cdcf507468d529c
SSDEEP 24576:rZMRzFVSOmsqjnhMgeiCl7G0nehbGZpbD:rZMRzf+Dmg27RnWGj
TLSH
T1616501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5fa80d4868f90e1ba8257a71641778db5985673a785cd455d290625c120c0a85
MD5 78e7a5a883c42f1d1fee1e927ff44db4
SHA1 35c1e33c4adba8ddf1b7e5bd55dc6d5d61ba21de
SHA512 379c6e21689b52aa141d22c88f4c34bca1afe8a0f3f3448f97207d877ce5bb2863b863f1395f4a5a370874b3b39013474c6dacd3ee0d217ecd15f63260e285ae
SSDEEP 12288:tDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF4523BF955C41CAE62608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b146ab38744ef43f728c4c0976baa7a0e248748c4a27efc468e03981087321c1
MD5 bdd5d105834791b6f7f4e6747c4d0ea2
SHA1 df0dcfb0462d9ee4fd97b5c34918e035c2b44c47
SHA512 bfc77d01672a1df7b2b53dc0dd8eb042bc531a408b36e1c4c49a390cd9addce9ef4ae6af35681bdcb688bb95631d4c3b133b4182b71c0a03dbb238700a87bffa
SSDEEP 12288:i/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BF955C41CAE52608B5C3E5F14DAC073E5BE9200493BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c4691379431659831fcb57cba035872dc9096abda1e40499a11944e502599f81
MD5 0fe70360d7cb088df86df8b531c801df
SHA1 98024de3bd1b4f79b16938a3beefbd710787b7b4
SHA512 90eab34e19abca1c060280e2e808610152966978b28ad9b253be345bf2af43f20ef0cd1367e3f1efcef8790b02b05da9e39c23cd221ca09c56907d4f683f3e03
SSDEEP 12288:RyPz5L8yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AzyysqjnhMgeiCl7G0nehbGZpbD
TLSH
T17655125B73A530F9D1368178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 09799d47db99e81dfd7220c8c56bf21649499f09e49187f01e248f54127b5015
MD5 c0292605d97cd93cbb1c97c3b26cf8f9
SHA1 3514caabb96fb1a13a094cb9e43c9d2b3fa0dcca
SHA512 1d1bba9f76c76e52ae39606d6cea9b7208af28b82d8741a036e1ac885bf33ccb3b4b160c3d9fa3e2f3f6a6b7749f36977989eb2633b6e5251e5fb3dcb4d1d1e1
SSDEEP 12288:VDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F4523BF955C41CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 91a1d290a7dc7eef264cbc2559fb542fa2797af556f1691f0985e482ecf4b29d
MD5 4b6c166c82201ad2b0ecb8b43b2089a8
SHA1 57e88a9047091429a24484895695dae7afc7252b
SHA512 1f9e9f338198f7a644c202efd113cec959c65ba54153c9b82f89f5cf3bf025cb44d4c6e9d5710cd84c3250b6c704b3541fcece87c1062cd9bec7d686ef796e77
SSDEEP 12288:yDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1454523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d52696e23501e530c3d11d464a1845ba8839b6ff936f2ce1360f3f76007c2904
MD5 9a7bd7e8856c6cbfe417e4b51e158366
SHA1 eb4f95183f20229ef22399b07070f91e52df0469
SHA512 bdba013a855943424aae0e60eb93656d9a35b041d121f43df5d8394f99afdce12295cbe60189931d4118ea6f57fbe01be3adf9ee14fd637f79680c9c59a1b850
SSDEEP 12288:hyPz5L8yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wzyysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C755125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3c6ba5bc4604e139ea890e87c3547430d3eab25ad9e844a02f86387105cdd223
MD5 0798c727b0ae0940fa3bfc1ff709db18
SHA1 d34aa9da1877c886de02e15fd8d55537eede43e7
SHA512 a73e6345c2c8cb43a45d08e268b656f857be39c632e11bbe5e546d3fb5f3a45b42b15b28ad18cc7bb48343a42e59bde4cb13509679c403cd9225592ba5b4ffe4
SSDEEP 24576:PTDaLl3z0zDAsqjnhMgeiCl7G0nehbGZpbD:PTuLlj5Dmg27RnWGj
TLSH
T1A86501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 58e94130b33eba99b3e4ed005441aae2b4885cadddeabc7ca1fbe7954426b773
MD5 0543663fb5017028620473efacd236a8
SHA1 c5a89bc8728ebe5b8f24416bef34c793ae805644
SHA512 9233912aaa75e8276b7a180b0064365ccde9ef87c185c1ec358498d787c5cab687a09027e863e88798d8934ddec28792bf7862ae6efbe7a32d4509cea2156d34
SSDEEP 24576:z3vd9CHKy7GZksqjnhMgeiCl7G0nehbGZpbD:Tvd9CHKya+Dmg27RnWGj
TLSH
T19975CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9f5349c545a52fe40d0e8830beaca24203bdf3a5e59779a2cdeefe22fc80a473
MD5 d14a8ee4aa832e38ab8ac5f0fde259a6
SHA1 04a33339c1839afbc00ef40e339968e3b7ab6617
SHA512 46c268f96eb87fdd746508479a12e70db1b548be9160bad6e2e26a7b2a1e4db3e7b2ac4f8011545f889cb5f8fa3e796024459f767747258c5ea09f4339823ae3
SSDEEP 12288:SwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1724523BE955C41CBE52648B5C3E9F14DAC073E5BE9200493BA977CBDEBF14984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 dd59c014358caafa60e72c7f00c539fcb55a53e3acdfefe9536463eeddb3763c
MD5 7f677bbcb5de24e0dc40225e941d883c
SHA1 360b9811338f04b0549b6e7216ef9e22b373e093
SHA512 de5be0dbc4f264ff6e9da141c45b74e7ec5591731387fa5c0abb3a3580d1fa560db878e28bbb152f85e951f990b9c0757ac785367c8a500844e3f867331adfa3
SSDEEP 12288:MSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D4523BE965C41DBE52648F5C3E9E10DAC073E5BE92004837A977CBAEBF54584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7e0cecf59c99d70aca9bb042accaa688c6b251576eb42994f11d354c05aec38a
MD5 034d45a578dbf62053221604eff53311
SHA1 fcbe50c4c6ab9edfed19420025f5cc7e4963b741
SHA512 715b967b7bc8a478f16d5e039821455c21138ea007f3f4a61383998e17cf5f002155d37a732f25313d68a6af18b29d28c824876783e4e7026cc6e44e8bc10bdd
SSDEEP 12288:zNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BF955C41CAE52608B5C3E5F14DAC073E5BE9200483BA977CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d30b4dc94f6626cd202f2e86d5598bfe5384f939e8a54fcf10a590ab20f959d8
MD5 0837652245af9f5a6f738849b26d4864
SHA1 886c898fc71a02a13859cdb146d7a55c9c760c2c
SHA512 75f76dbd79e90560e399f47298dda3736ba38c2d5f184f53d7d78c375e8bc152b33399213beee5279ee62e031a10fff12536eb503f80136f8ba5f401ca17155d
SSDEEP 12288:4DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F4523BF955C41CAE62608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a986c1507d047f8b9beed138caf2da49567ffe2c45de5d20444592c637aee3b2
MD5 e510b0cf42da5ce35b04bf5d449601e9
SHA1 eb9254932b0c1b13c3d89c2e67e25d7a3c584629
SHA512 351a5653cf3c9d96ac593798549301209ed26cac331253066a79d0d2c32c73aa396369cd16955a06f0102b9f0d973e96bd859fafa9a31e6af70eebbdd3fba32d
SSDEEP 12288:mwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BF955C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDEBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 00fff9ffdeebfbc03ea05c70fccf51409b4710f970ac2c7ad00b924e19e8366d
MD5 8f7eef3591e26b6fbdf881b059cbc3c9
SHA1 6d6eeea148a736173680d1697465c08822c1750d
SHA512 8e46d63aa58770649737de46109906b766f92e422e649510ec4236b627cefacd415035709f6e3b919171c8dec1639ce78c58e03122eacb3c0c446b191dede6a1
SSDEEP 12288:zbsfzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 914a3fc23dca4f151fb9f2c1324a213876f6eecd65d30b8b795b45f17d9f851e
MD5 4f0f541ba4576463677aba1bc51c5923
SHA1 567c6f1b5ae0307eca4bae8437d6c77abf2442e1
SHA512 d4622db2766fbbf6c8da807b8c598422c00ccf5e24ccffd638438fd898acec4beabc71f9c78ebee164911e3c4af327c13ba4abd59051c6b0936dbf255d92509a
SSDEEP 12288:OjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB45237FD34C518BE57659B082E9E02D781B3E669E204483BA477CFDB6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 57d72c6d2a99fa4130e9432b9ed17650e9f3d2fb82088a4685ae8371e182dd0b
MD5 4a6380ac61ad4a4df1d0429e1cc46e08
SHA1 45e14f5ce9285030e1ae3abe2e358bff75313d70
SHA512 8edb65063749c2018ad8c2be3df2f65371673704999adc80e0ac58fbf2ca42d134b569b0d39cd0f66f91caf9dd5a2c8498141dc66c812ec8c7d91cbf0537d450
SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQRDmg27RnWGj:qa0hNYG4JwmD527BWG
TLSH
T10485AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 3554111d96189b834fa6e2528b24601b8329ebf8666c8d197504b407b58ed4f1
MD5 bd878a5a276ad7e68af1ea39b2ede5fb
SHA1 db12f35e677e52b7962e93c801e237df8ad7d8cb
SHA512 1f08e4ccffb7e37669cb9dcba3ff150c2e776a72b73ff0aee5d885682fe9d5efb8bab2804665035c6fb36bb4a6332a075cc5aa108e49ee89ec1c170a72f3bc45
SSDEEP 12288:HhbHjfX+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HhbHjP+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A655127E12AC20D9E572A1BD8296D10AD632BC26172053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 79c8aaebeab2a28cad400ded09080d59f2a88743495ee488c5388ea7c260b7c6
MD5 1f5aaaa3c3ce4e41014638ccdb64e96f
SHA1 9a558a17f3607d3d12a8cfa45628f773426f8c9a
SHA512 dbf9e627a5f807db774d2801f8c6a1f3aa96f63c12c479b822d96728b78b60675af67ac21a2740c60abadc4821aceab99751383e44d6eee3e80a20f85120ea33
SSDEEP 24576:d3YgnJcRTk4yti+R5dpR/2sqjnhMgeiCl7G0nehbGZpbD:dIgnaTk46ppR/6Dmg27RnWGj
TLSH
T15445BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 946a258144f4133544b6747e7814a0d5a9773db024e5ffeb0f016242e5d7fe42
MD5 44a77c451c389c7371ef9336b3909ee7
SHA1 2932c2db5d461830ad6b46545b28e2df6d7b17bd
SHA512 6f3773a324b524b8608edf2f54401f2a2f2d46ba0a00a331a218c03ee4340cd61829033c3b25c1d3c484aae4a96373ed4189ab8b56eff3299809625ee0a95cb4
SSDEEP 12288:sfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1104523BE924C51CAD93649F5C3E6E11DA8073E56AB2004D379A77CBDE7B18E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 4a1de68d039c46f330ea0ebebc8c9c4e67a3dd1ac5cc903810ed87b9b10f262d
MD5 19fcb2424d4e7a4105750494209f038f
SHA1 b2182eae5781aee3f25f4709c27e288a76034e16
SHA512 df7404e72e55ff20595e336859088cec9ed74a8a04f539c630b24db23155cf93e310ece18ebf87ed9eba7cca28a1b249c6cf777c6f6d73ac757fc0524d6fe820
SSDEEP 12288:fObfA4LWOsvAYFTYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:gbL3UTYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T149750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 caa0049e6dfc03c7be35ed730a0be1c9917ec60ac5bf6bec642200e9f6cb050d
MD5 e2b5f3737352a6605311307a1fe3f350
SHA1 5ea122a9b37d723b46fc7eeff770efafe1379db2
SHA512 8ad0c337d1df7c2b00c85260ff0e4dc52dd2967f27c5b5a65b0614db8dfbb8ba7ecb14ae39ffc55afde526d696eff2d467659771dbd9f886234e96208e205ab8
SSDEEP 12288:npFtIOUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qOUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D055022E33EC10E9E536A17C8692D20DD6327C66072117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c87d76d2f4b3d06c69b79e23eb9eec0921fdaa38b69e17d59bdedb6995a0b9aa
MD5 bde930d4cea32bc1429bb0f7937fa923
SHA1 2d4fa66f5d466b0a78f2a38915bbde486e8137b6
SHA512 308b91eb4a85da75ec8f5600373254473cf2da3339991611464e4fbc0c2732c9d0bba46b3f4abedad3a2095bb405aee2275ef5af9ced60ce31aba524b4f44c4c
SSDEEP 24576:47NM9YmZqmWMUkPjZM48Mv6bEhsTsqjnhMgeiCl7G0nehbGZpbD:47cBWMpPjN8DbEhyDmg27RnWGj
TLSH
T1C3659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 412bd6cdbf0d8baa74043da1c9964bb5a3cfb366b527a29895567d2b6859ea62
MD5 6c30c312f54064948512268ca4544fc9
SHA1 ce63f920a41227adc8667e5ac73a8638f36621a2
SHA512 5a7639f880888afa776859af19b8f128cf07ac188463c6f042706b17ebd022ef85371f4ba5339d021e8019b42dd94ccb081301db4ec37cae5ecbc9763c4784d1
SSDEEP 24576:wW6BApg2YuyuNDYTabvcRvNYf8km1hsqjnhMgeiCl7G0nehbGZpbD:wF2YuHNETovcvNYf8km3Dmg27RnWGj
TLSH
T11D857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 986fb22a3ae146cb6f1d805bb5d61c5ce33c952634bb10534ca9b92b7c3796a8
MD5 f43e0e2e99ea9e070ebc9a2925736b6b
SHA1 0f7f8f32e888e6faafd16a39e4d9b543534b51fd
SHA512 5a8dd1afa50a629abae214a91ac2b952b9593a51bf9de3e8d19bcd9b10c7e106f1e144fcfbbac78588d25a6397f8c7e4c9104d80fe86b952e22c67a16af923bb
SSDEEP 24576:ZAFs06+OmlfkNXEbTogsqjnhMgeiCl7G0nehbGZpbD:eFs060lwXuxDmg27RnWGj
TLSH
T12D65AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 a593f96fa57e378c7517a17931d78739c5ed10e1d2cb8d6c6788ad7e34d06706
MD5 1aa5b884aacbda88775b21c2de493f6b
SHA1 ea3159d70fe3ede21d9ac8fb797e43c28d86e8f8
SHA512 8458ceae2da1d6f9ed6debeb7a81189133d86c53f3ba3d19b9b340330613c86af366b41cdaf2318e7146675a5f2b11a78605a1672639e13ee1672cce167e3b44
SSDEEP 24576:0JnJ5D3WtNsqjnhMgeiCl7G0nehbGZpbD:0JnJ5DGtxDmg27RnWGj
TLSH
T1D275E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2f52c98ca8d799365c23d9dd681e386f92b03c24eeab841ef2fd71c33548b0e6
MD5 c2ea41a802afc3594893cfabe5ab79fa
SHA1 68bf58a4287e30c9bce507659664d2a90689d45f
SHA512 d901dcd330e05fe0c6dfc9368700261114adddafc8e3aa9610efa323d51e53d3c9b16b56e03764b4f970ce2336991cb7caf012e7c3f111f777b3281504a2c186
SSDEEP 24576:dEPohm6/7IIXdwcXrif7qQncjlP65i3Vu2sqjnhMgeiCl7G0nehbGZpbD:qo06DIKdwc+eQnSt65aVbDmg27RnWGj
TLSH
T188955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5aa609d65e38b6d21105c312b3b7f1b8d481f851ed05bbf6b5519cbef1f73c24
MD5 d942b7b57d74d0bd031fa920d2c74744
SHA1 f0e62152e429648655c6ce22ee787d1ea059bb06
SHA512 093489b204291aee61b7847f056709c5c3dc1025202c55ea3c2bc77a7b79b4b31653c2080d5303ae12610ca3b5945de05b22be495d0a0c78e58bf11829a69180
SSDEEP 12288:gEP3Rr1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7r1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18055126E679C60DAD136907D8291C209D733F4716B2127EF26A2C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 4bdc6d625af5c79d01a246d8fa3dac16a6079062ac6bb6f8ba5f58d6990925ec
MD5 4da8359c1fe36a60405e2913f0109749
SHA1 acd02c43c7bf21fbf2d5ce28597ef09bef80baf8
SHA512 338309eeb9abe8dbaba6c0aa586d605083dec5fdd131ff9a2e48cf025ba31680648f2286da5a70aa5ef69aedd8b09c3d6665dabc0376cf3cab9e69fcdfcf4f50
SSDEEP 12288:0jkyOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0IyOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C551219639C60C9EA760578C6B3D1589C36BC319F2042DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 45d68cf7300d45a62b870abf47a4d49370e87d66bcfdbe958f71649c6568e8b7
MD5 2335350e2391f5a229a0e72bef46831f
SHA1 6426164ad376432ac95f6770d50b6591f520153c
SHA512 9cbeba6be4c8ecba6063b5bbf04ec5f8d796c31f1578ad087c427152988d015aded23f428e64da8ccffe88fdfeebcabbf1016c322125de1a78c304a137e700fe
SSDEEP 12288:KFkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IksqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D45237E525C60CAE93245B8C3A5E51DA8133D766B2014E739E3FCBDEBB24D44739812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 afcf5cba0b051e36208ee896f9d7a569671613cef8cc60002d54fbcbbb49a66c
MD5 50d770430dae3bb6540becf753c07f99
SHA1 33e1bda9aba4ad2cff059299538dba0542885961
SHA512 915ea87eb96352291c3659293724df2ccfeba71ce39270d07d45d7a5eb044296e8d69ca74b7626b5db0b42a0344c75dc573341d44116850515c600dfafc145bd
SSDEEP 24576:RQ9MxZKdcz97w3bsqjnhMgeiCl7G0nehbGZpbD:RVKXPDmg27RnWGj
TLSH
T175558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 53e701d3f9168e43bddd86cea5849b7aefde4864c4bcf96a4a5d931851b3d54c
MD5 09ab38d7e549ccd89687342cd938e805
SHA1 c162463e0ee6ebb3eb27e6e8d11933db681adffc
SHA512 00b037ad786be70fa082b6207bbdb8acd638fcbdbfd8bd7a88b3ec06520f698eea86b23b0f9dcd84d6be82e403b8aed654032169a4135dff30dcc22b4879bf4e
SSDEEP 12288:1yoKo2HRple9pqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:1yocxApqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E965E01FB76D40E2E176813C8985C249E673B4305B6157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 da07950068bde955a832689d4a48cd457957ac170aed12c1ff8fd939493bc80a
MD5 72d5c0740530072a383d7a6f1dc1ca73
SHA1 95391a0ab604f4e90cebd3a8d7723ad9bcdf96b2
SHA512 8ade5bdd3a519378c7863284e9be0c78473679254a470f5e0c5a0744483cc5e8b09308047e23abffdbe1dfc1440606999e83dbdf67b5e15d714df1e728d7bbdb
SSDEEP 49152:oWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK+Dmg27RnWGj:K0zuNIKD527BWG
TLSH
T189A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1440-392-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1440-385-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1440-597-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1628-343-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1628-335-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1628-511-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1628-341-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2572-422-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2572-606-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2572-429-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2572-487-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/2572-503-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/2572-471-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/2572-428-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2572-509-0x000000000D130000-0x000000000D138000-memory.dmp

Download

memory/2588-384-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2588-282-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2588-275-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2588-276-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2624-312-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2624-320-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2624-318-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2624-505-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2776-256-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2776-246-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2776-245-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2776-258-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2776-252-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2800-380-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2800-577-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2800-373-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2800-379-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2872-226-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2872-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2872-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2872-40-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3036-227-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3036-69-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3036-73-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3036-63-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3056-235-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3056-241-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3056-234-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3056-354-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3320-409-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3320-410-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3320-416-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3320-605-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3584-408-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3584-289-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3584-290-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3584-296-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4168-358-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4168-366-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4168-364-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4168-370-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4168-367-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4356-287-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4356-396-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4460-330-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4460-323-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4460-508-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4460-329-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4536-580-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4536-300-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4536-301-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4536-307-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4536-421-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4776-9-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/4776-1-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/4776-0-0x0000000140000000-0x000000014023D000-memory.dmp

Download

memory/4776-12-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/4776-14-0x0000000140000000-0x000000014023D000-memory.dmp

Download

memory/5132-372-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/5132-260-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/5132-267-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5132-261-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5144-37-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5144-225-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5144-28-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5144-36-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5204-71-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5204-57-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5204-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5204-51-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5204-74-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5312-544-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5312-352-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5312-355-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5720-523-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-519-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-527-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-526-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-512-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-525-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-524-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-513-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-522-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-521-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-520-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-517-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-518-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-516-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-515-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5720-514-0x00000255DE7F0000-0x00000255DE800000-memory.dmp

Download

memory/5872-22-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5872-16-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5872-24-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5872-210-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6028-404-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/6028-397-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/6028-398-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/6028-600-0x0000000140000000-0x0000000140216000-memory.dmp

Download