7e0eaee7ecd06bfe9094d968acc6142981dd2168a1482cf37de2956169ae1fac

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260415-pd98eaf14x
SHA256 7e0eaee7ecd06bfe9094d968acc6142981dd2168a1482cf37de2956169ae1fac
MD5 02e924868def38e67122fc976450823c
SHA1 80faac96a1bbe3a3785019f387741b4be7bd744c
SHA512 9a91cb17ca5937da71715b1df2fbe0e6136aa21e0458ae4c53e3ea69eb1dca342c774a9be4688c6a04a09fa67b5f88a1aee7f4b5e49d7356f7a8ee9426b1061b
SSDEEP 49152:r+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755Wf:6/PvOBjcXvvOOc5Uix8EVy
TLSH
T1E0165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5060	alg.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
2752	fxssvc.exe
668	elevation_service.exe
2692	elevation_service.exe
552	maintenanceservice.exe
2520	OSE.EXE
4264	msdtc.exe
4744	PerceptionSimulationService.exe
2576	perfhost.exe
4904	locator.exe
176	SensorDataService.exe
4016	snmptrap.exe
2900	spectrum.exe
4716	ssh-agent.exe
5012	TieringEngineService.exe
2064	AgentService.exe
4128	vds.exe
2352	vssvc.exe
4300	wbengine.exe
4736	WmiApSrv.exe
1432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d4d391ffe7d1e4d4.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3a8e89ad1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d312c9a0d1ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c9c3a9ad1ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2c07f9ad1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096f7b89ad1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe7fe19ad1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024fed79ad1ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
4936	DiagnosticsHub.StandardCollector.Service.exe
668	elevation_service.exe
668	elevation_service.exe
668	elevation_service.exe
668	elevation_service.exe
668	elevation_service.exe
668	elevation_service.exe
668	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1824	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	2752	fxssvc.exe
Token: SeDebugPrivilege	4936	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	668	elevation_service.exe
Token: SeRestorePrivilege	5012	TieringEngineService.exe
Token: SeManageVolumePrivilege	5012	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2064	AgentService.exe
Token: SeBackupPrivilege	2352	vssvc.exe
Token: SeRestorePrivilege	2352	vssvc.exe
Token: SeAuditPrivilege	2352	vssvc.exe
Token: SeBackupPrivilege	4300	wbengine.exe
Token: SeRestorePrivilege	4300	wbengine.exe
Token: SeSecurityPrivilege	4300	wbengine.exe
Token: 33	1432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeDebugPrivilege	668	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 3840	1432	SearchIndexer.exe	122
PID 1432 wrote to memory of 4100	1432	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:560

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2692

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:552

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2576

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:176

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4016

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2900

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4328

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3840
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 02d46a08fc0f8a12727e070bb859dda95d9bf6f1db47df81760949f31097ad4a
MD5 d7e904985cf6ab769c6103fcf6195635
SHA1 2bd3c26c7f1f55b3746ef5388a32480832c54516
SHA512 1b3e5d92b81d77774ea82c5a637ab83c9cab1b63779327e8bae62372afe52a644b1238ba97f0e8b1a2d5ae4be2d2a6af5449fa04ba93f30da6492c79356186c4
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDx4x8EVep:33q6HjBoix8EVy
TLSH
T1A1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 e0efe611321815c4cc11b5d38682580e3ce64f4280130ef2feab8de853055f53
MD5 89f2783d7a04201adaddc443c3ac7083
SHA1 335fea83017af2ed8565e2f77b19a1cc55457354
SHA512 1c1e6328b2df49d035743483ae9c6e9247ceba44b71fca161f383547c560f21e18d607f9e7141f690f015b7dbfe79d0b95836e215c4d9c1211e0e63e63f83940
SSDEEP 12288:p1XLsswWkxy2lRq2czAM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:nXYfDtczAMyxknw4FYnshx8OfVe247
TLSH
T1E075F12877D508F9EC6B8139CDB28512E633B8914770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1b95ac93f422f96666ca3090e567bc8fbf4cb66860f50dc9a657d6a17f349c13
MD5 77223457f0efbbae9462fb2461e3449a
SHA1 14090b3b87923f2db2431678f2a0cfd1d9b9a6b7
SHA512 5c518257bd09ec32c71cdf8aac1235001682f70df0bb9575e12b7b808af13aa624dfae2d316d33db70644016ee49983e07b26c11e1dde77c904292d99eb62cb3
SSDEEP 24576:D0Le5ji0hmx1rM9yxknw4FYnshx8OfVe247:DPji0A7xx4x8EVep
TLSH
T1E295AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7083080e5c3aecbd5f94cb4fc75cc6080c9cf07d9d005f0d9fb6f6ac82201d67
MD5 874e91d1dc11d5cb82354c6bea1a6a29
SHA1 ad339b9c6465691b70be8dd09e62ccd67256902a
SHA512 595f7eed46561d7234a41698505eeb00380456d8a7e1a3da2fe69477f9b19d45d758b19b07b5c8c3577acf29ca40f66ac57c820dd035e3a42c063924c944948f
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWE6q8wyujyxknw4FYnshx8OfVe247:u/ezSC6vUzPvxHjy9x4x8EVep
TLSH
T19D756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 880d2ebcede3b8001aaff7b3dc8ccedc8b67eeddaec0d204e1de739e384d3b2c
MD5 b1593e1ff525b2124cb16b860b120b57
SHA1 f20c5e2d5a82c174bee1e0a144d7df2b3dab4f30
SHA512 e5f434068758c28c2445e9be514c7c85d17c900c2d69d2247b0f3af1f02863104a590a3390a84794728f6321f8ee58bee8e55d0218bac2e78cadf49ed769c46e
SSDEEP 24576:IVbqPb88hv/l+6Yyxknw4FYnshx8OfVe247:IVO88hXl+kx4x8EVep
TLSH
T1B6559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1ea1baf333e0bcbacb9914e4e7d75a1b555262fffe8bed6694b244095cf469ea
MD5 abe187c5ef2669bc5eafe04bb60170a2
SHA1 87ec28ecf2d49d33df961b0b7eacccab05d55981
SHA512 08964c29307511a91177d4c63e6e465d48305aac930b8a877bc5d9a6c3c53bf98dbf7666b761c1b80644c42f4870b05aa9ca442b3792c2be5626fb7a98387633
SSDEEP 12288:CN5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CN5yxknw4FYnshx8OfVe247
TLSH
T10465237CA7DDA4E1FA5E14331B7572622616F9A0DA74C11BC779B14EE0F0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 144b1c37ae116bc4a94c8f8605d1d90c1fe2c36aa4a0ba54f70a5cc1ae085f8d
MD5 3bf8ad862e9f0121ce0b2986abca2e99
SHA1 a8b561a92e18631b983f44a1b28ba17e5fbdf80c
SHA512 0f11d21f5a28dcb5dfa6dcea4fca82441d212a8d40cb8e1c7356d488118535672054f955a641f7d9ade8101c513fa27ce622e55e5a8c920e3f875358bc096dfb
SSDEEP 12288:ceBNUbTVO86UA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cJIUAyxknw4FYnshx8OfVe247
TLSH
T19E75CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9dde50a312002b26587be050e29642185cbde14ab20fb015904fbc76f927380e
MD5 5cc7f96913c4767fd54940a098b9f04f
SHA1 1eb12008dfac8d7a7ff65602bd27a9cf3fbc5c59
SHA512 b7824bbcacb3b6b53c33f58f3f5eee919f06323d8c4c1edc9d51bf6f5734d82d9915eb43a3cc4db1fd19e1004e984c5bc32d92f65d51307deeb193e8cbce9822
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:bQvGAdlCEL8c/yRNw5CWix8EVy
TLSH
T118267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 d3bf475f8fd090b8a5118aca7643180141281b03d9f34651e3700508c7b9b412
MD5 573e1cedb06f77b8016cc8be6cd59800
SHA1 b3b50f7ee8466978de0f49dfd0632d7c6604cd81
SHA512 da95c73ce5cc7c51b20699c75f369c4e66c8a73add9dc9e9abc75d8f4cac061a33060d4f5bd6b1b18a4cc0b1c09d23f428167f518ff87c420175e4e97f56a024
SSDEEP 12288:FAwSfxL/2Dc3LDLLmt0LDQewsAju+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:m6ewsAjuyxknw4FYnshx8OfVe247
TLSH
T1D585E030FF74E032C6BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c394f50cd9eda57e33801192c28ae9f267724b5880174201b3cfaaa4c2427cd9
MD5 7a3003ac23ac76bfc1ced841755fd82c
SHA1 0be4aa57ef8e74acfa8d704063caccfcfc39bf7e
SHA512 65de37f7a46ded7978ed1c7268640ef458954cdf54f4da9a6aed241904fdbce39b4802a8a5c9307a420fdc4647dcdbb3adab6ec9a1bd2e970b170e14f233af3d
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHE:IUEtQevvqc2W1cpV2EI32
TLSH
T134474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 475e5a0bf3790ddd923f7368b91c9048f92cce0d304566f1407d003cdfceec25
MD5 a022054add4acb717ef031cc53c2a8e5
SHA1 e20ea855398a6c8b9fc88e2f12cb3831cc2a60ff
SHA512 73342f32b2373d77f0f41e479ff4627ffc6e623ca00806da9a0566c15d593cdc5276ce6cc1cc891e9d48f0574a50f29f5586ca94afad97b52bcc0363d0d2523a
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zBx4x8EVep:LoqtVjnmSix8EVy
TLSH
T136D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a44d8d3956b186b7b750df85f85677b12201647237592199eaeaffe78d52c5db
MD5 fb07f2ccc1c75413a536d236560c51ae
SHA1 323369575ca4ecb0b1d9dc2ccb2cee910f1fa990
SHA512 840eb2777776bb684377a62e102d77da863ebceba4714b039542db6508345cc720ce10fbf3161dedbc63c2a8874bd1893649a5847955156cfa54bf0350cd679d
SSDEEP 24576:eAhGLJIFoiwtA5l7S53nyxknw4FYnshx8OfVe247:eAMyFoiq5Cx4x8EVep
TLSH
T16035AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 b5e57f4ad8cf680cf6c49fa4b192e429c252e29df3db47bc7f5b22ffd30c1a9d
MD5 83e77df2be534d5474191e2dc123bd62
SHA1 2335117c48e4e0e0e9d3077c44f260a0c14fbdb6
SHA512 47b033c463ddc7216e1ecbd983223ea4bb0d83c0a2ac04768eac390a7c668fdffaf83e33f52d30ef66b7b7abc56719047e149b066655ddef884c2754dcd1bd50
SSDEEP 12288:omw5HEjsChN4BFgl0WDm+CD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:FwuVOWiyxknw4FYnshx8OfVe247
TLSH
T14475F14977E81CF9E96741398697D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 dbde3a8b8a61bf97706e83163e70be9f519975b2f6ee43d9073d174eafba2eed
MD5 40d3fbbcbafc9fcef1eea102356b4672
SHA1 327d1f9b052302f2bc6d9e687fef6c64dc523599
SHA512 a533d4b7e5bcdbb1a4d7676334b28144d816638be8a55aab2121a137d14e9ee3935a2d8a2193f3f8733db5062ca86a5162ccf736add3a769a250e1b449cff3fd
SSDEEP 12288:TFZ1Iye+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JZuFyxknw4FYnshx8OfVe247
TLSH
T1536512AC33E860F1E1A7113A89F15205E77274A2677183CF4764A25EAF72DD09D3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 68ba071cf94fdab2e7d0e701c77874dadc4f627cdaa86057a3e9f900cb0b104f
MD5 396653bc865b2bb60dc9f7f346854ac5
SHA1 fe78b483032fbe5dab552998b815023ae3bd1805
SHA512 c25a751b66645cdbdc052071efe871510e3a1a1a6a43f13a18b1f77e1e3d2d770632354346d16acc95f1fed3f411d1916d70a921005a25c5393898f9b34e0ebf
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:XQRQyi36YOcPQLvw2gAf+PN3vix8EVy
TLSH
T119667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8c0f1e4f129b7e215f07300a004f555fd95ce400a484b8a7a84dbe810af0d538
MD5 5d009c91be7a9677abc5f8fded0929fb
SHA1 9c1e4d649fbc4a739fe67463c35f405fe50574cb
SHA512 c7de9767edf9ea9438fc544406efb70142a0fcf08f961af9d6d780aa19805f85f37968db528df6d500eea0b36c926acf166a059affb80eabb0f7d2ea3dc73730
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:jQRQyi36YOcPQLvw2gAf+PN3vix8EVy
TLSH
T1D7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9dc959ce15894b31ee3bbf01ef754ac507cf3adebad7312982c24b31b963025d
MD5 7a9fb13993f901bb431f23f332ed99bb
SHA1 3837b90fcd9bd622fc62f83444d352841346cab6
SHA512 ae2fca88bd492109d07e637633e00872df8137c6b8d9812f659b5e62a5df2ae333ead02d0d465da49517cd55fb8090a394e36c909ab1f8d29f3a64f0b2ae7914
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Vyxknw4FYnshx8Z:x68Qg55nhheWu7PNU3/xx4x8EVep
TLSH
T111B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7806ec0069888b1ea09aa48fc4695c3786c4a9d74d18b56b01c0bf120448513
MD5 b34d2787a7118fc6f80a27bf09fc2fc5
SHA1 2b32746d2b0b8d8b8d3147cd3b337cc0e3f37a07
SHA512 7061f2b2b46dcfce44b165fa4582decb0c2458347e6f72c06b566c0e7e97ba65ed3006e242ed32e236f9e1af3684d6db274f6df6210c39a6adc26f7f2c8c8386
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99R:Uy5112gYy5azzVvL69nLKnhZ8ix8EVy
TLSH
T1E9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 79ab1214d15a7833aa9d96c82f8e73c5360e8a9358fb1818c640ae3e19f84124
MD5 026a3811115da10faa0062f73983ac27
SHA1 8a1f15fd50a93377f756ec37a526a8d6c3aec1ec
SHA512 dddd63b2ed44b552e8d13683ce25d0fa4f29f8e38ecfa96f816be55a5cf6f5898da8a1db767b2ce14c3d40256dd1e8fb78fcae02cc2937f2530e85013ad6cd87
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glMx4x8EVep:9u6JmVxd2dMix8EVy
TLSH
T160D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cc95db901feddcc3a088284c04a68fc99a26359ff58e208f8b20a292d7b3417e
MD5 9d8e1ec663c7f9d39c0e19dbaf07e381
SHA1 83afcb0aa011414480bdde75c303802bb125cf85
SHA512 9a4aab1acecec633a5ad5f801d6761e592e40cd5afbcfdb875f4d1f3b4dee1e2242536150450b02f8a680150238fff3befa2209ef7b7ec949095ee75f44c44b0
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xjx4x8EVep:nmifPbRSix8EVy
TLSH
T154B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cd7e7a36fec269213e453fd3e7766e22b656a748e4e9070d32fe799ddab0e44b
MD5 a232589ca784e1fb1ccab090294060fd
SHA1 7ea741821b2b666542abdb2cf90bb50556ecdbbf
SHA512 5846357c6c2bbbff7577def854dbce4287f1f1e0e1329a18c80d854c13ee3df7bac04df077ca021ccd26501fd26aea7d117b546a611948eac26bbc0cacccdd12
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqQx4x8EVep:/5dKTi61Qix8EVy
TLSH
T149C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c1a35f4109400022b704b3dc486eba149390bf7117f9787121b64754f7e4814c
MD5 4f1d743a3c6c5d70c73fc210f4b1f39d
SHA1 019ecea7078ef8b4bca97e0984eeca3745adfa05
SHA512 22f5615875961a7a9b531f6470aa6b952fbec66c140f36d5dcc69399a0c39415dd37aa7e638c7adaff1c1744fc1fff9848fff1ffd44e7bddf50a4843f1daeeaf
SSDEEP 49152:uhtSn8EApI0figngiDn0AP5wnx4x8EVep:vX2iyphuix8EVy
TLSH
T1FB95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 7fa5956838b20cb59a202831e32924043607408986ffc3395ee5208e4f2f35be
MD5 76ea0952665def7bc71ba90b3df00883
SHA1 72531cbe32f79694f6995d8186b61f50dd41310e
SHA512 06be15f302db3d413b97e81c7dac635a5913627732df3af52a94d750f4d08b95a95e43c0e032b1f346e9fafa0780d4579720be571edcfd9af4c3ab4a9a4fe31d
SSDEEP 12288:5h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5hyxknw4FYnshx8OfVe247
TLSH
T17265237CBBDAA5E2F50D11734B7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 abb4f0d787dc65a591504b01992a0b53fd4e2496ec69780f1f1bea0f11a7f72f
MD5 b38476e08c552249454055c3638108ee
SHA1 ad2f0e42c3aec5676a23b60c4e3aab36ad7679fb
SHA512 eb0fedbbcc690013853112da60f573d0eea34da0eec292cf6db36cc7e9598645627cc7b06438701b80327434290cd1b8cc262bdb3fdb0f04c0e1df9088d3fdec
SSDEEP 12288:Ya+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Yayxknw4FYnshx8OfVe247
TLSH
T11965237CBBDA95E2F50D11734B7172626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f1fc52c8e11ac657d45460e2c7f0d75b433b0f3488a28fc283fefb17daa9a9ef
MD5 810990a1add6ead3f1a09839639e6e46
SHA1 94fe01981bb47b8dde450be0bd4614a9408976ec
SHA512 4649c4b895cfbaa7ae44b7a2fc99bf00bbb72da795cd9507c0e91ad2e5df9d7e6651601b89a3e5dbeee60219c720eabb5516508cc9b8c47847b0d105a1b39092
SSDEEP 12288:Ro+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Royxknw4FYnshx8OfVe247
TLSH
T10265237CBBDEA4D2E54D11734B7263626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 3bd89e7e186a2456ca5013d0e22f82914aab54989eb130c3537e9c48c23b9910
MD5 87ef9fa8c661647911c13cd0c97d343a
SHA1 32337cff7ae2688dcc77b555877ed002f9ac5a77
SHA512 1b14521854ef7b6d1be532098be8a7fe09091d8a412e94a5721fd04d2d41a299bae5e7ee7111d42a44f4721eb1c353573f7ac0425325284802c1a32f43f3275d
SSDEEP 12288:uVH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uyxknw4FYnshx8OfVe247
TLSH
T17265237C77EE50D1E85A51738A726222B365B8E5E731835FCB24710EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 f12f24c9f4aa7eb1ee28aff3123324419dc46b40e6efeed67e80d55dd1b45769
MD5 8270c887102a4035a02188e293aee782
SHA1 0ef6558623d71d467d531db11251ce08c520c9af
SHA512 0eb004a63515a672519ca8ab236ffe799c297c4fa2f097f5efcbaca7d166ed67aa3170c980fa02d8701688119509e69af704e1de8ba2907bc07a18a8b06a072a
SSDEEP 12288:L/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:L/yxknw4FYnshx8OfVe247
TLSH
T15B65237CBBDEA5D2F50D11734B7263626509B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1861f2b5bfcf5369ae214e7f2618dadb54b37e2c50c47c61e6e33de621d0cd68
MD5 dabd0cf8ba96fa3308c9af8d75dfc7d4
SHA1 8e76bf7d1caf533ef3ca2e01da30c99ab1fa915a
SHA512 42945cfbdcd9da9127716acacbb78a0a6a04df02156a6b7ec23dbbf98f6e99728da546bd60077f063be589616c09f45cc957e607624c5e6f6b2fdeb086dc2108
SSDEEP 12288:R2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:R2yxknw4FYnshx8OfVe247
TLSH
T1B76523BCBBDE95E2E50D11734B7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d7967104012482fd79f36b4c6cddb55751eb5703bec48c981fb6a91618089719
MD5 fb50e98a3ecc2a2c2b5a77eae17a77d7
SHA1 3d8cf5e32c3bb9fbb530e8acbdb093b28d9824e3
SHA512 ff7fcdba8d11d2180f17182eb68c2372602c3e30585413fad30128723c54b654f48ed38cf5dae3d42809cc7d6ae720708cd29ed373439ecf53298ecee0b039f7
SSDEEP 12288:Ky+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Kyyxknw4FYnshx8OfVe247
TLSH
T18265237CBBDA95E2F50D11734B7173626609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 f5ba875002b789cd5c10272721241e20acb9d0b63e31a458fa0d3f2c7f7a8a7a
MD5 63de10a07c23c244dba93d517c4c035d
SHA1 9e97f2bec699d5065a66d58beea0e2b13d5907ab
SHA512 93aa3c35159f615cb35e97a3827cd79c4ac143f959d2705ff9d6c722d1dd0588b1b0c8382b58030b89e7d7f16a263f3d50bea7be0d48e1c7f26ae9cbadc1f4ac
SSDEEP 12288:AiZwbZzzFEoS2cPvy6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DZMdzFVSO6yxknw4FYnshx8OfVe247
TLSH
T1C77502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 7329402b5587e7baf418d688a8377cb9163c1f092a9024553b90311553f4b096
MD5 a685fc7fb3ed592d07b0a9b5ba2f34b5
SHA1 ad8dcd387405b72b8adfd28c313cb11fc38bddce
SHA512 a37c0af3642322344343fd1374c5001b2b4e834090d97aad2405bcb1a1ab8a03f544a0cdad88dc4aa95d4ff12215f6104ca4887c2f412df07d64e2ba52fcaef1
SSDEEP 12288:41+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:41yxknw4FYnshx8OfVe247
TLSH
T1606523BCBBDAA4D2F50D11734B7163666609B5E5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 05da55b9e6e07256e47f796e14fa195ec4ad091a3344aba791d20ce151921222
MD5 96646a2cf0aad6c76e7af62a2f7236f7
SHA1 5fe513ac446a8a61bd4693910181048638297f38
SHA512 65ae2a3d8f51c1d32d0734340efb72d5aabe19cdc29e7bcf8091efb64c24effe0a81810c7b1f5f97bd74209e86e79fcfd16ea799677699e1cb326baac80574c2
SSDEEP 12288:qp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qpyxknw4FYnshx8OfVe247
TLSH
T1A96523BCBBDA95E2F50D10734B7173666609B6A5EA71811BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 012fbb40c2d05b4881a6cb6a80ba5e11591634fc4497a684ce05fe544b690f03
MD5 9f4e4a98f2bbc9e071292c9e5fd833b1
SHA1 4c7a4b2da13c5ad2f609db02c6986725454b7e6c
SHA512 c8ee31eacce9b7763a5724ad20a354fbe46836f28b939139ec98b5d2053a1800b68dc78ea2dd891181888f0b8b9eeaf5a823cc56811b7f9a0fe3d3eb2fc0d151
SSDEEP 12288:syPz5L8e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1zyeyxknw4FYnshx8OfVe247
TLSH
T1EE75125B73E530F5E12A423689621612F372B872473086AF87A4537E6E725E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 ddd0ad31335eec6b2bdf9b31a413da0e6f492205d048770f4969aafced30cdaf
MD5 2888f4e11a47365cf7bb8591be36ef42
SHA1 00ae6f1c513862bafcb91a3e406c81ded7d9324b
SHA512 1e44d4cebae6999ba58189a8c2c7ca6d1a2fca28427f69d897dc8a0e65e50587e9dcfe70d285149aec3043cc25257f29b86eb176f15c03812f084dd661e1704c
SSDEEP 12288:O1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:O1yxknw4FYnshx8OfVe247
TLSH
T15E6523BCBBDAA4D2F50D11734B7163626609B5E5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 5c9b6b18a3467b9cd8bcebde9444806302a306f6cf00b2668a64323f59588077
MD5 05f873aac8c1725961a18b00c83121b3
SHA1 4f8d9a9b50bf098507954f3606ff2b4c71a74921
SHA512 ce3e91e58730c545ca9c9434c142815a89eb9dcadade37127394c201d3bfe22d48e311af0bdd001ab87a4394242e7821a608e21c8231ce58820413869c10dceb
SSDEEP 12288:K1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K1yxknw4FYnshx8OfVe247
TLSH
T12D6523BCB7DAA4E2F50D11734B7163626609B5E5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 6437ecca25673e437eff09629d6cc5300576fb7a71d0196f78f44c8a6f8582d5
MD5 e4009aab093df1bd19082acd15e71f11
SHA1 4419ffc36cb9c63b01810083a364e118f1e7275f
SHA512 86c6fa8f5ef1d64a08cbca16fb51b73f88545c63fdf1ebed75129c4e5fd99264d35c4c69c257a5f5f09496891a4e23e7985f631ce9469d74af63cbcbd0c13660
SSDEEP 12288:eyPz5L8e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Dzyeyxknw4FYnshx8OfVe247
TLSH
T17275125B73E530F5E12A423689621612F372B872473086AF87A4537E6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 aba80a2a1648caacc9bfbb62bae055af62940f1dc81a9847ebab0fc8d7c196d3
MD5 f674a74ce510f963632d9554b11a5b70
SHA1 a026d3fa57ffd49b70c520eb8b79fe513cc89ae5
SHA512 f99afec47f25980c10e4d562373954f117fd980fdaab59dc1ed32774d0542713747254a52299db1a0892a56c3cb8a17d0f6496a260ddfde37330de4a97788d41
SSDEEP 24576:JTGaLl3z0zD4yxknw4FYnshx8OfVe247:JTFLljmx4x8EVep
TLSH
T16E7502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b3b0fafed5aa56180c0492f926e6721368c003433d47dfb6e8a0824be7ea7856
MD5 af20887fa7d38428ab04b871b7ba64dd
SHA1 47344b154e4afa882e785cb2b878f6f0b0e0cced
SHA512 b8ec43978bf7ece4e4500caccec11265bf002be3abf17f1afbe11f5ecd6d2aa5bf2855d3539361ea3d3166266f6ff7cd68525225b9dd048315b3894169990a67
SSDEEP 24576:63Xd9CHKy7GZ0yxknw4FYnshx8OfVe247:cXd9CHKyaZx4x8EVep
TLSH
T16295DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 ab7266d80361e64385e494c390773d2dee6abfbcf41e1f8c99533a82cac356b8
MD5 d6c0f8808ab61bc3bcd7ab2ef4da735a
SHA1 8bbeacc4aa967d89089cf8b17d6109c43debdd9a
SHA512 e8d3f0177cb678539dcab32e17d61cdc64fc70a443cb82c01dac3ba511c656e729672e5b0e9d1e13a02cb451520ff85c711e2faf4908a98004a0ac847f4800fc
SSDEEP 12288:LI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LIyxknw4FYnshx8OfVe247
TLSH
T12165237CBBDEA5D2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f1b903afdbaebb55441b9d4d9d22dc89cf0dd7a3010526cc8d4588eb8db48b20
MD5 bf000af0629cfebcd9be90f640eca07a
SHA1 feef2ba047bda712b774b41864d40b1b295e2bff
SHA512 b25e207b62205f29aaa53e627e305ebfce6694b3f39dd760d07053942ab1da2c82f9531e86337fa379f0125e56e47815c7a729fb7828ea703d1df7a8f2136c9b
SSDEEP 12288:K++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K+yxknw4FYnshx8OfVe247
TLSH
T14665237CBBDA95E2F50D11734B7163627609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 6c4d17a998658a0a56c6db4cf0a95da51641f988c11ce426d5edb2676eade1f8
MD5 372091772357cae1956f6d931f7c0c9d
SHA1 4173cab6cff8910449494576d9a96ccb53501fb5
SHA512 5119789872cdc3bfb89ff259b38ddb73d28283e6a3bd6a74a3ba8e837ff30a9545b9f298ab8cb5c545e01abee63bd8c9e39d7bdae902d3ff2183ada191a086d2
SSDEEP 12288:V+sfF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DFyxknw4FYnshx8OfVe247
TLSH
T18975F028E29802E4D06E2276CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 af3cebd1bc81d10142f278ab8741522c7bc28f165fc94dca8b4dc1956fff361b
MD5 3c4d66246e161eede7461dca4bb6505b
SHA1 dfd5a79a57087867bb9f968e1d0301ef252cfbff
SHA512 3bfab388fe061170f05c4a6e2201b8f4280e28cb26dfa0431da57925620cf32267432a90ee9d28b69a0e92b6c3d6916b0d723584c6ef0c59a2d0922efc144211
SSDEEP 12288:7G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Gyxknw4FYnshx8OfVe247
TLSH
T1BF65237CA7DDA992F56D15731A31A231361AB2B4DF70C14BD768B11EE0B0CA0E83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fd35f73c5aa6d716e1ad66f68468ad54439af71d2490b842a21eea64bfc75aa8
MD5 abf20933eb3369ec9c081be6bc941ccb
SHA1 1004b28ac6fdc51a9eaffdbe5be24f1a3a468ae0
SHA512 eb39500d1ca28522a19b8cc35fef0ff7535cd14a238c297361880096eaf8b77b191d04a1d6cabb65f138acd0a32bf3e4401e5192e6db615d47b603aec38d098a
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQvx4x8EVep:5a0hNYG4JwMix8EVy
TLSH
T14B85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1190853D7F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 78028839c8f573595f3d80ca217b99e5dc5c900cd199dc1d106dfc7fa73f4cda
MD5 8a3cc29df022b675981de9652add4491
SHA1 956876c0d92e65d2cd2c44ba7297ef241ca4e59e
SHA512 b02729ae61f7dfaac2b91a346c7e41cbf44032b0afa427577ea8157e2a7ca524f8cb504d0a0b78d5ece1783bbf70810e6d8c7d559185570aab4bc4f9c7dad78e
SSDEEP 12288:ohbHjfXf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ohbHjPfyxknw4FYnshx8OfVe247
TLSH
T1F865117C27EC20D1F175A17A86A28206D331B8651B3193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 87bc095ddf0419b63c4cecb689eb3a45584f9ef4e43ce00d192c8db52216bef9
MD5 fbbb9015212185e9c2d5a5eba75bee96
SHA1 9e50a3f669c2f3a921b755ba16184694b458f953
SHA512 857c1e922fbda55aba4eb19cbf3c176b618196c11b1e2187c7c4b07291823dd7c6ba8bd909204efa83922537835f16f7fcf080665edb8198c2da0e13cd551457
SSDEEP 24576:w3YgnJcRTk4yti+R5dBR/nyxknw4FYnshx8OfVe247:wIgnaTk46pBR/yx4x8EVep
TLSH
T10745BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 eb65956fb27505ba61977373ec84c6afac89f6840386da422e1b6132cd19969e
MD5 f745e4844d3ec74920287c30be583552
SHA1 6aadb0c9c4272037b32d286fc82e2ade35decf7c
SHA512 fe9967be10345192eab98ddb8a96514726c82ed5342104eb3c740111befee29fab0f6e66d8700d79664bf0e82c9bdb900a114d6a9414b5f20163689e904fdab6
SSDEEP 12288:Xa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xayxknw4FYnshx8OfVe247
TLSH
T11765237CA7DAA5D2E55D15730A7262263605B2A0AB7182DBC77DB10EF1F0CE0A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c8ba3e8263ed6182cd129dbaa958d7e28664f2cab67a14e02eef0b365c6fdd7b
MD5 54793d2c1d31c394821edd32d1dfd799
SHA1 b6629e4fd9ad35c16c11664a3d67135189e6f3dc
SHA512 5dc6b7dcd56a82b289d730df0acc5e8fbfe68f29dcf0b5d08aa1dca039147979c5a3741a1fbad13684e124058a795589827935b841bb47617647a9250bead74f
SSDEEP 12288:OOb6A4LWOsvAYFTD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3CL3UTDyxknw4FYnshx8OfVe247
TLSH
T124850158F7D400F5E86B813DC9729612E272B49D0774E3DF43A88A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b615fc8249c933a04723862bdafbe522a6069bc49232cfeba7b4a1206dbde81b
MD5 5c008156e907daf710449ad9df3c6501
SHA1 f73deacb08e77221ef508f285624ac1e1a1009e0
SHA512 0a1f5ee08620da06fda89136c298c72aed040f55852f8c57ac553e41ce4d61a2969d864999c533022d16585e02e7191f7cb8a4eb6c1b57f2586648b58f9e34ba
SSDEEP 12288:OpFtkOH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pOHyxknw4FYnshx8OfVe247
TLSH
T1C765022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f1beb8b69d64e7fc80b755f89e05d157501a9ab31733fc5a41e57422dbcf1859
MD5 361c4ec49742043ca8e8dff546bc7e0f
SHA1 7f4cf4b206af5b23bbab098db4bfd2a1913e8b2d
SHA512 524958f5e3cb07c5a0e34ae5f00273723996ecf4b75c8c87bdc2493a53acab0f8360567ac48c6cd705b456d21288431c845e9afcf68e11280903ab919e38f0d1
SSDEEP 24576:H7NM9YqZqmWMUkPjZM48Mv6bEhs2yxknw4FYnshx8OfVe247:H7cBWMpPjN8DbEhIx4x8EVep
TLSH
T1C3659E2D6BEC81D5D476D13DC9A28205F6B2B4611B318ACF5262833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ae1ed72ecf1131f42bbc19fbb0b46e99e2cdf02e3fb9f49f1f35d7b1b641961e
MD5 7dbf93d9ba876a07078790b554f5d55c
SHA1 15aac61ce059ab5e5322bbba462eb24938ea75d6
SHA512 52b49e18c6458616a13971b3eb9ca4190da283c8cabd30a45a8b406552405e24feb64b15cdf2cb597fea8623e670e542981c7ef6b9b94b211368f95623baf51b
SSDEEP 24576:MW6BApg2YuyuNDYTabvcdvNYf8km1Ayxknw4FYnshx8OfVe247:MF2YuHNETovAvNYf8kmJx4x8EVep
TLSH
T1F8858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b3a2a1eb3ba87d8c252ab308984fe9a209332458da84a94e7b349a64a2bf2fcd
MD5 a46f7bdac5bf458dda96c442ce4a1d2f
SHA1 34f40ed3b6cb1c021b060b6957be60ba89457ef4
SHA512 6fa3892dae84721516b9ad1e80251386e6a92485e199dab953a0c454946d41cd20db28b71d6a80803b958f44a4603feb0cf8eb85fa407f908f11ff07570d5cf6
SSDEEP 24576:VAFs06+Omlf3NXEbToryxknw4FYnshx8OfVe247:aFs060lVXuPx4x8EVep
TLSH
T1A765AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 8fb2d69c9b7a151d7ce9d21a714e1e86093d375662d7e9bac1386789b4eb0b0c
MD5 f773d3226dbf168420a3cf2acdce849d
SHA1 c41a5d8aa752fb896ff0a98695fef552be88ab1e
SHA512 03223dc644fb04f419996119e573cacdbc5799e6b84e3b3af7217194b4136f923c98d81991e2f98603e3ac17f88924bacee52665d39311405541d26642fa3c4f
SSDEEP 12288:zCJnJ5D3Vkr8zxW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OJnJ5D3Wo0yxknw4FYnshx8OfVe247
TLSH
T10C85D03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 17be22106e0fc62fc6c43d5dfc355f83e3df87b7136b36ba4e4e97fa46b882b4
MD5 df4ce645edaf7122bfd1bfe2f5f65099
SHA1 efcd92eaf33d057d69c9c0af7d50f036abd34944
SHA512 66ce01ff4270e9275177c5fe43c2f54e3c54001b1f6673a85f7536ef3803c8ebe7bb9942a3d64856bfec42a60bdd81fc3cc641a9448eb79b3e3699f895a8d43b
SSDEEP 24576:sEPghm6/7IIXdwcXrif7qQncjlP65i3VuVyxknw4FYnshx8OfVe247:zg06DIKdwc+eQnSt65aVdx4x8EVep
TLSH
T108955C15B7EA5294E8B3CAB1CA62A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 4d123ab227ab93630f5428435b4faa4a68eea05839b0ca6074afa1162dd9a34d
MD5 4db8527947b321f23f989613eecd1d30
SHA1 e8c062736341061c8e684c429a31c162f0f61339
SHA512 ad18e6bad4a0d396f8b11011a78d69d78d2a2e9f4c6d3bd3962e4dedc332dcec2606a0f1ebbed69cabd1edad46529f2b49d11a461908e8594151d42644cd2262
SSDEEP 12288:xEP3RM2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iM2yxknw4FYnshx8OfVe247
TLSH
T12065126C37DD70E5E12A503A86A18205E372F0706B6253EF87A5D23E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 0b37d28ca776ee6c707b265d7eaed8c309d029ab6a557682664670407a247fb3
MD5 133595cbf3c9ae54c7bece605c8b23c0
SHA1 62993e84d5c9f30c7ec0bdb9a2866e28d559a587
SHA512 fc8b67003209f8a90306b991fc09900d084e0a0bb9a8172abe9dca2d4b067d576fd35f71b211dc916482308bf6a05e8c071d1907060e4d08552ed324d76d6b2f
SSDEEP 12288:QjkyN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QIyNyxknw4FYnshx8OfVe247
TLSH
T14675121C63D8A0D1E57905369A7392A15A35BC709F3193DFD290F23EAE71ED0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 e4ab189392e08b0b2144726ed8bcacfb5abb57637edbc52587d7462a65a3bba5
MD5 a220daf3733788f3e273be9eada3337e
SHA1 d951cef5668f5bcefa2d0df8a55ee609f13382a3
SHA512 985e153f0cb4822af003e9b15677c6b71dbbcf8a216fdb0e5de9fe2b894f4eff849a26d493a92a8b6a883591cf568383090a03a3407ff4ce37eed0b51b3290fc
SSDEEP 12288:3GX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2Xyxknw4FYnshx8OfVe247
TLSH
T11765236C67EAB4D1E9190173463163626225B1B4AB7191EFC7F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 de6b5244fca0c4e70b28c1535f64e20acf41403897a2d1f9963bfdf44d27aede
MD5 02f2983177238d8095cf6732b551259f
SHA1 ce4349a2d6a768b614d7385d3d72bc8ab6859aa0
SHA512 fdddf66c6454b583b804b2adee576dc7f8f1b5e5ac52f263763e94c2f5ce42b6df56f41809f40a48630a7e3a1418cb3033421312eb3479b48ca8975c5762d421
SSDEEP 24576:3Q9MxZKdcz9dw3eyxknw4FYnshx8OfVe247:3VKZRx4x8EVep
TLSH
T133558C2DABE905DAE177D27595B250C3A633B4301B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 780955ea9e6e12b0a7b29fc8dfbac52deb61c5acaebfecf2a1c815dac7e6a06a
MD5 f9cc9f901992f5f1cb37353b020f4522
SHA1 b172227e5c5e45252325dfa5b5a4e6643288146d
SHA512 a72bb677b94433d68a8f0409da9c158a4985ce71106faf3fb7444a1d35934f416be863e1051484c0399b58ef71af84f788b1fb2c6772a857aac674c56301d465
SSDEEP 12288:4yoKo2SRple9pR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4yocgApRyxknw4FYnshx8OfVe247
TLSH
T10F75E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 21fa6bbd031de6096e930fe3aef346dad7ef23d072f1567ea2d2487559e5583a
MD5 8765dfcd4abaa680394a0af3cff6853a
SHA1 5e51e1b99227d203eea874e6118037e51d9ee9d1
SHA512 75c40a37d1c3513323e0a67992f7ec6c0d6ac333a0d6d0f9c4572a866d5f861604771ab45598fd21567bf4841fe21fe6795c281a8347c45139281ad139e40103
SSDEEP 49152:tWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKUx4x8EVep:N0zuNIGix8EVy
TLSH
T188A57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 309c87ea6d0a1655327ead06c0722379681ddc7ef27bd1ca9b41964585e47c89
MD5 6598efb03ad6b1ef586514ce62838161
SHA1 06b2ad9bd5e5db5fa68d50ceea060405ef814bff
SHA512 7bd9bfac297a1f5bd9789299502fa3fca3c6504ba31b81ab0d7a13be2c13f1b2972c94b17e9608dd37a3908f4032debd6fa48b6b8c763a85a0b90d257d8c50db
SSDEEP 24576:e1QT7EcpfxR+N5AWAz3ooiYtjMqb2yxknw4FYnshx8OfVe247:zTDxR+N5YzTfjMQx4x8EVep
TLSH
T14655B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/176-409-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/176-341-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/176-280-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/552-75-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/552-63-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/552-73-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/552-62-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/552-69-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/668-237-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/668-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/668-39-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/668-33-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1432-410-0x000000000C9C0000-0x000000000C9C8000-memory.dmp

Download

memory/1432-382-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1432-342-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1432-436-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1432-366-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1432-350-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1824-58-0x00000000004D0000-0x0000000000500000-memory.dmp

Download

memory/1824-0-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1824-60-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1824-8-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1824-9-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2064-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2064-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2352-320-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2352-431-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2520-239-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2520-77-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2520-83-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2520-85-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2576-262-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2576-323-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2576-271-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/2576-267-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/2692-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2692-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2692-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2692-238-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2752-42-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2752-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2900-408-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2900-286-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2900-285-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2900-292-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4016-282-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4016-384-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4100-438-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-449-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-455-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-456-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-457-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-458-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-454-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-453-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-439-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-440-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-441-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-442-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-443-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-444-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-445-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-446-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-447-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-448-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-451-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-450-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-452-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-414-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-415-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-416-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-417-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-429-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-428-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-427-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-426-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-425-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-424-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-423-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-422-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-421-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-420-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-419-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-418-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-437-0x0000025FDF960000-0x0000025FDF970000-memory.dmp

Download

memory/4100-434-0x0000025FDF970000-0x0000025FDF97C000-memory.dmp

Download

memory/4100-433-0x0000025FDEFA0000-0x0000025FDEFD0000-memory.dmp

Download

memory/4128-430-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4128-316-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4264-247-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4264-315-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4300-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4300-432-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4716-297-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4716-412-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4716-304-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4716-298-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4736-328-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4736-435-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4744-259-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4744-319-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4744-257-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4744-251-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4904-327-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/4904-275-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/4936-213-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4936-25-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4936-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4936-17-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5012-308-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/5012-413-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/5060-211-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5060-13-0x0000000140000000-0x0000000140176000-memory.dmp

Download