7e0eaee7ecd06bfe9094d968acc6142981dd2168a1482cf37de2956169ae1fac

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260415-pd98eaf14x
SHA256 7e0eaee7ecd06bfe9094d968acc6142981dd2168a1482cf37de2956169ae1fac
MD5 02e924868def38e67122fc976450823c
SHA1 80faac96a1bbe3a3785019f387741b4be7bd744c
SHA512 9a91cb17ca5937da71715b1df2fbe0e6136aa21e0458ae4c53e3ea69eb1dca342c774a9be4688c6a04a09fa67b5f88a1aee7f4b5e49d7356f7a8ee9426b1061b
SSDEEP 49152:r+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755Wf:6/PvOBjcXvvOOc5Uix8EVy
TLSH
T1E0165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3572	alg.exe
3824	DiagnosticsHub.StandardCollector.Service.exe
2516	fxssvc.exe
2436	elevation_service.exe
1688	elevation_service.exe
4716	maintenanceservice.exe
1004	OSE.EXE
4612	msdtc.exe
4432	PerceptionSimulationService.exe
4396	perfhost.exe
4912	locator.exe
3192	SensorDataService.exe
3152	snmptrap.exe
868	spectrum.exe
2136	ssh-agent.exe
4760	TieringEngineService.exe
2744	AgentService.exe
8	vds.exe
2204	vssvc.exe
236	wbengine.exe
1660	WmiApSrv.exe
5044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\813cfd21cd1bad80.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db0d269bd1ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe0a459bd1ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000641c779bd1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e054cf9bd1ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d889a39cd1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004965e29bd1ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3824	DiagnosticsHub.StandardCollector.Service.exe
3824	DiagnosticsHub.StandardCollector.Service.exe
3824	DiagnosticsHub.StandardCollector.Service.exe
3824	DiagnosticsHub.StandardCollector.Service.exe
3824	DiagnosticsHub.StandardCollector.Service.exe
3824	DiagnosticsHub.StandardCollector.Service.exe
2436	elevation_service.exe
2436	elevation_service.exe
2436	elevation_service.exe
2436	elevation_service.exe
2436	elevation_service.exe
2436	elevation_service.exe
2436	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2192	2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	2516	fxssvc.exe
Token: SeDebugPrivilege	3824	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2436	elevation_service.exe
Token: SeRestorePrivilege	4760	TieringEngineService.exe
Token: SeManageVolumePrivilege	4760	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2744	AgentService.exe
Token: SeBackupPrivilege	2204	vssvc.exe
Token: SeRestorePrivilege	2204	vssvc.exe
Token: SeAuditPrivilege	2204	vssvc.exe
Token: SeBackupPrivilege	236	wbengine.exe
Token: SeRestorePrivilege	236	wbengine.exe
Token: SeSecurityPrivilege	236	wbengine.exe
Token: 33	5044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeDebugPrivilege	2436	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1612	5044	SearchIndexer.exe	108
PID 5044 wrote to memory of 4336	5044	SearchIndexer.exe	109
PID 5044 wrote to memory of 2924	5044	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_02e924868def38e67122fc976450823c_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3572

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2220

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4716

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1004

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4612

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4396

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3192

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5056

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:8

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1660

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1612
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2840 2728 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4336
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2880 2876 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 92f72a659bb2bea4340ff80c48a22d9ace98104741cacc4207a54efeb4661e45
MD5 b75d9e856938517f83a36ee6bfcaaa8e
SHA1 32a25a5feeea6affc30c7fe204d305ed5f1d8e32
SHA512 4f0bbd826a231316418a2296b0469664d78e6155967d5e4dfcb9da98afedd51a0f57398b264cfa9063d530f64dc29b6493d238474e84b6755db7399761508211
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnlx4x8EVep:33q6HjB+ix8EVy
TLSH
T1EED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 7e512a68ea260dd0aaf353bbb6be476db9228ae8808acfd2194d9e1eaa4c4414
MD5 267991a6b5e1202377c74582532caa33
SHA1 095832f8a8b3d9365be559913f990cc53b13a4bd
SHA512 a44625a6f5a315c2cb1236790c8b0bb430af53089d412b5f76b046c19e764e75b28fb6b4c36c5b5f63717273ee7a8e157e41fb6a9cbc9fef69b1b790ee18ddb7
SSDEEP 12288:I1XLsswWkxy2lRq2czA3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:uXYfDtczA3yxknw4FYnshx8OfVe247
TLSH
T1A875F12877D508F9ED6B8139CDB28512E633B8514770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 096b3aa78432ffdbe036c4f159d7a22f2935c5f82bcaa115d8a05d4229d889cb
MD5 f41399ef17973a91ff0de56f125373ce
SHA1 fa02f6e41c27aa2ee482c9831b5eb65ba83dfea1
SHA512 1a6232e7fac410ad7e27177ed24040a76e59cd8505c39b0a90bce33c63a17cad3f15078127e43562837bd51ef31c1384b93b159536626522430c32d94f85707b
SSDEEP 24576:u0Le5ji0hmx1rMyyxknw4FYnshx8OfVe247:uPji0A7Ux4x8EVep
TLSH
T17495AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fefb397a63e497b14111c5aaa21718aab36d1a5e8ad659932274b7978919b08f
MD5 0e2141851615d0223b9bfc576ffa9e71
SHA1 2c9d9321c12186a12b515b344ca47379a4a27e40
SHA512 6c661766e52ebfcc9e111773a0e6779af6cb02a3e4d663d543015f2b1592b4ae17acd0277e34dc2b26fa1d59598a111e7806fc59311971fc914758f5a7fc479c
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuwyxknw4FYnshx8OfVe247:D/ezSC6vUzPvxHjyYx4x8EVep
TLSH
T149756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e256d3ff099619cadea7022985103198146cff9ec51442fcc3ed4b67341c13fa
MD5 4ec730e458841b01130ca6bd06677de9
SHA1 7604b4924b9958f4ed1e0f4f661c71fd97622f1d
SHA512 a4acbd0a0c84b75430051d26e8bbf0fa0691c25fd60a771fc6bc11ac0347e8a9333324da7bd259e652405329fabdf0db81ccc76a3cfa58c6734bb2007c58ba84
SSDEEP 24576:1VbqPb88hv/l+6ryxknw4FYnshx8OfVe247:1VO88hXl+hx4x8EVep
TLSH
T1AB559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 3bb4edd76194ad9cc23c87c0923cac7f7feb5f6b2539252a66bce7f073277ed7
MD5 94727fada0786236f7c29581acfff249
SHA1 efd6f3cc2c39b6220a539b4727e75f51ff36b4a3
SHA512 4bc8ace30ad078fe229d3f0734a415f4ff4bf86857190423229ead5ee13a897f557196ebdac2d67227d507c7467ee673be5243e9082c9bfc254018553fa89e27
SSDEEP 12288:qNG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qNGyxknw4FYnshx8OfVe247
TLSH
T15665237CA7DDA4E1FA5E15331B7572622616F9A0DA74C11BC778B14EE0F0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 5f4925df0f29016e5d31fdc5129b97bf3e02cb3d2b4bdeae1799ddc61b0aa212
MD5 1feacb9e402e617b9aec84ad97bf05fc
SHA1 a013d22444e8599643461d08bd0489932facd7b9
SHA512 9f9f18d27be91e804653a5c8a20592a5cea2b8c223525f5964047f42f7f3e21861ddaf501986c8d852066c7922d32cf341f7aa25c53da0364a97e22a8e330d58
SSDEEP 12288:TeBNUbTVO86Uz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TJIUzyxknw4FYnshx8OfVe247
TLSH
T1CB75CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5edb9acecc148c8e330752d1f473afe58c722f285c9efe858308acc8bbd527d5
MD5 56c04de83ddb753aaa87bef740e455cb
SHA1 afbf34af4c1e1e90117b9b54486e6aaeef1a9b1e
SHA512 f4d09885c6c2e2605c6f063f564a79f8123842da0bd2ed41ba0b8e21e9a3a8b5f862e5f014cd252f0b557929d62155ffeb16f32121b82328158645d297d78b53
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:QQvGAdlCEL8c/yRNw5CDix8EVy
TLSH
T1EE267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 ff4a5375debd06f5f06b3ae885aa19aeaeb39feb64220fa244eeb06f7e19f4b5
MD5 cff23834927a93b2e8d49fa00290cf9d
SHA1 a251cf5448d1e125f9123b754086dded9f3929e6
SHA512 6fd597358464744f6a03a75c8b369177a840d5d6979c094272c50e80253893f79fa9139b5348c14d3d7344c27638eb26694c71cb4a1596586ece78b49621a8d0
SSDEEP 12288:rAwSfxL/2Dc3LDLLmt0LDQewsAjh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:U6ewsAjhyxknw4FYnshx8OfVe247
TLSH
T1DC85E030FE74E032C6BF0DB21B36D716142DB9604F611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3b01fc49df45aa08beedb0632c8c4bb169629d88ccdbac805c7c885bc17296f5
MD5 300bdaa7b854421edc7870f7198ddf7c
SHA1 4970a2ecf85203bd72c0e65c303db50ea3dc89e4
SHA512 ab57fbd42ed91c3c60fe15f1733a3fde32d559549594857f7c0345496762d41612b4a00c64bc74d7bfa499ab18efdae95b38e8729b0e25b2bb69073e5fcf2df6
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHR:uUEtQevvqc2W1cpV2EI32
TLSH
T1AE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5317315a43109d0b12b57d2ee155631df3f7c6f33f75f8bdc3670537dc69c01d
MD5 7a346b5f709be9d28a827d84842f5ead
SHA1 6da5ff6b8f38f491f13c1cafddf3ffd5bad077e6
SHA512 7e4a10b12abd58b81c668ee613b5b24aa1869772c6f80af5f3fd1933e2d21a87460c53b3801d884ff11ab2fc6d10320a07a3238ba60cce595e6bfe9f86108ca8
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/zEx4x8EVep:DoqtVjnm3ix8EVy
TLSH
T1B2D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9f99d0d36a787305f57acc7d7941a857fc9d2877fb6d2d6fc9e2f2b45291a120
MD5 f3a7b2adfdc72395320c3c469c17f4b0
SHA1 96a9a5ed9c152c877a752376b1a229976c7397bb
SHA512 fb29c59b67bb79eb0ba0b34bffe18f57dc1291fb6d978b0a88725f116cfaabe2f690edfba29d4a9321abd2b3ebe04465815c47ba0f1fab6a9f5f5825d0674f62
SSDEEP 24576:6AhGLJIFoiwtA5l7S538yxknw4FYnshx8OfVe247:6AMyFoiq5Hx4x8EVep
TLSH
T18F35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 f9175b0e9949233280e149b07bd7ce032f6f12397321dbe92658442d3e961d34
MD5 a93bf2f0db9798dce8d0372441eb2675
SHA1 5ef7759cb9a6de9aa04badf382b1f55e732537bf
SHA512 864822dd73105c8f781f8d16f1acd20c41790504832ef265916d306a8c76a9ae9b5485c44a59697d16218a72e7bf41e83f8a15646d767278d60c5b6823269b91
SSDEEP 12288:2mw5HEjsChN4BFgl0WDm+CQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:vwuVOWNyxknw4FYnshx8OfVe247
TLSH
T1EC75F14977E91CF9E9A741398657C136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 890d37fdc0c2e4bcd24a4f5bf5f55a685953d07d601104afae7376d428be954f
MD5 1e764b8dea9b46ebc5c6ff779555454c
SHA1 75b3967b284942d01a7e26fbe00f362465f42d4a
SHA512 17cb95f6dbf630017d2dec58ed1f2612a782ba23432786717cec561a6afad976c379e03274630f8c4206dbb85bcc2f7f61f08eb39612d13c72bc51501afc855b
SSDEEP 12288:ZFZ1Iyx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DZuayxknw4FYnshx8OfVe247
TLSH
T1CD6512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7bc888d86723f6a20bfd0c62c8fb0660994041cbc20689ae1c410ac3e2719224
MD5 38f77b9dc6b8f4bd72801179f12400f7
SHA1 e67d1022fc74aa6bec7140f6889314330340041d
SHA512 1b8aea7198d5fd2edcb8a03eeb36548ca4130f3a386d90f55ef473790cbd19eb4e7a5572e2b62970d586e93fa0f8429a7ed42e2dd9f925fdc03230cd1c1d7d06
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:nQRQyi36YOcPQLvw2gAf+PN3Kix8EVy
TLSH
T145667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 63fd6a563550fa98e8f2a954d91ff14af255b0a7fcee14a4c8e59df22ed084ec
MD5 6ccb72fe2ea96573f6f36601890232f9
SHA1 130a6f6a1a8a5f239c347bae93d3e1880ca4a8dd
SHA512 c98468b71622322e8d417fc3073f142c0802b410f57a2de5bdf8e8eea35f353c67b266b1e1b687ce2093a2f92dfd9e8134a24d11021016cbdc32d82503f5ee7b
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:RQRQyi36YOcPQLvw2gAf+PN3Kix8EVy
TLSH
T132667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2bbf6fae893b7919379e3ba97c1b389a33daa91240680d5b13e409f1ccd76e55
MD5 68514a682de0d797e794a97aa7aad931
SHA1 9b2de8733542fe4d6dfe73cc0e10b83446ad0eb0
SHA512 5bd5bc0ade621a910b54bcf17e8de5faf1eed1e320196aa9812e5c017751e37bea386200f8f9ad1e8da9485371d92249c1ab8a004b8e743de864c2e050ee3323
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Kyxknw4FYnshx8Z:868Qg55nhheWu7PNU3/Ux4x8EVep
TLSH
T1FBB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f159fc4dad2eb3bef5e7a8f1919ec9d1ca2e1839415c99b31e8c31d1841ab579
MD5 cbea0c95e033c220652cfea6968d5e90
SHA1 051842db849c545eab370d63c953a4c439a13591
SHA512 7fff195f6c52d6bff92706d78e8300cf4254ddcc04fe6c357ed0917b874fb6731df4321f46eea0bd2a1477e511798908f45497560e20528d12299fd98342b6ce
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99K:Gy5112gYy5azzVvL69nLKnhZ5ix8EVy
TLSH
T1EE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ef5ef456d4a621e26e56c59f71e2f390c875f57f92a3f1361b291e515227d4fd
MD5 b566f31714ee86e8f96bcf9ae92c06c2
SHA1 369804a8b7af4180a892db1803b6b6be7aa832bc
SHA512 383ec3b6343a140703ab3274aeced7689c2cbdbcc1ff590a0adb6cdb6ad6787d8be23d73375f8f86ac145f5ffbffaad130abb2ec2e75dcd1f3959997913b508b
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glMx4x8EVep:Ru6JmVxd2dMix8EVy
TLSH
T107D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 933779807b64a093b2a4129dbb7562354b020e55d6d5ba7052b0f234a8c0633d
MD5 0c9435110fac06cc55f902a8f980e51a
SHA1 df7801e95cb8ec2bd583a59aa0f7a66318598900
SHA512 9595e451d54c39f3db4747eaa3d27a75ed608b6f35d11d8de1aecde64d17eaa286ae9f7f1d32de765e4f4d3495f61a9ac912a943d0446f35947487639cf082d0
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xWx4x8EVep:cmifPbR3ix8EVy
TLSH
T1E5B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8779cc607ef3066cc089b2c3697fc61767e1c9cf8a9897a0a0b50fdf44b326dc
MD5 c18186644694bbf186d9935ff02d9064
SHA1 b8d0d4ec0266f4dea823d8aebb68a8735c59fa4d
SHA512 f72cda581bec91faf485cdbfeb85f78e6bdbefe78eccb847d0f9d26ce76bd7d026704745867f8cb796afc200be4ca5255f716ae1979a81c244fdeec923859475
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHq1x4x8EVep:X5dKTi611ix8EVy
TLSH
T1EBC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f59d9df1837d0cddd25046f4abb0f10fcb5c45044954ac3236784654fa057cce
MD5 bd9faf4bfccbb55b33b59d126f26331f
SHA1 66405a547fbe28fd3f5b810e858cad2e179f378f
SHA512 50056f695bfb71019f44b48cbae2040782cf9aaab6bf34251f9a33e466591c774bfdbfde86d2ed07268e0ddb81820a346bdd5545ae27ff72f26f670c07d45114
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wCx4x8EVep:MX2iyph7ix8EVy
TLSH
T16E95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 b9f483368bdc3e272b1e4b153fdaab7e1d06c57cc9ad13d58b87f4741747a23a
MD5 590a26b438986d1cf08a747b142222f6
SHA1 8acb366efcf4876376cce99387c6e9b6510e6b0c
SHA512 a20bfe0a6001fbc4ac590fec342b3da543a5aa380f29a3ec159f67efd98e0c704bfd699066266ff47ba10a1c16fe6eeb3cd885de26d03f64332685d6387cb0c4
SSDEEP 12288:8u+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8uyxknw4FYnshx8OfVe247
TLSH
T1CF65237CBBDEA5E2F50D11734B7163626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 55c791ba6803d9571a15626479bb2db9f5a70234679156529718da94c54658c9
MD5 40ad8e8b96bae257f894a5679d96d3fc
SHA1 7da45692507287dbb545a06df1c2a5d3399b954e
SHA512 dc51c94fc2b128002d397dbb3a630ea5640ab4c8c6e49a855bab6eb03438745a509a355443ce57c96313af9bcae2476d45c24af9d441398a3d280a2c2f8d01e4
SSDEEP 12288:YF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YFyxknw4FYnshx8OfVe247
TLSH
T17B65237CBBDE95E2F50D11734B7162626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 2c3e05a4b1d9003dd62e1700e60ac802cbed990765ecf14914ee91f50ec41611
MD5 16153aaacbfe7b1ac83023d3b83b14c1
SHA1 301fa70d305e7361aecffa474252f3ec6173386b
SHA512 39df8f03d4db6aae433f6b6f2b27a8f34c44b4152b8d0d6798bc626284933be8a1a263e1804fb4f66987948a33f15877c1d56125b5796ed06d117618c90cc26a
SSDEEP 12288:Ub+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ubyxknw4FYnshx8OfVe247
TLSH
T12B6523BCBBDEA4D2F54D15734B7163626609B1A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 163bc715e680cee0ca96d760f6ae19739c8885518c886e4637750597c021c228
MD5 6b46ba7f8cf662383dd613f134aeaaf2
SHA1 685300b839f6b09fa88051b3de90749e14e00bc4
SHA512 19e5463cc38c979fbf7e51221caf881ed6a0e441a195ef10c720eb2aa023edafd127d6ab1c4650ffc8001a2c8416bbdb6f7db58646c9f08ada8a31d0a45e91b4
SSDEEP 12288:TVc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iyxknw4FYnshx8OfVe247
TLSH
T18C65236C77DE50D1E85A51738A726222B365B8E5EB31C35FCB24710EE9F0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 50502c24891ace2d82e027f50ab0cf88a6f5b7b0d86ccff789ac9d3e141cfbc2
MD5 1950b599f523cacade1d9dd922f3df07
SHA1 e838c1985f3ea16ae79e783e326ce03f17a24bb8
SHA512 6424f0f57774a7b31819aadb852b3780313ea2b305242b1c0b11ff029fe9e883fcd4f8ea8f7971a8ba55f2f92f6946f2f968893d1e24824873bd8d28c6218eca
SSDEEP 12288:Q0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Q0yxknw4FYnshx8OfVe247
TLSH
T1DC65237CBBDEA5D2F50D11734B7163626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 11ad6be5f5d6da31039f6440a9af86bcdc68910a5eb312c1fc3438347d46c838
MD5 c44b0bddd87ad76f65ef0fb87a44b9cb
SHA1 bc5fb0a9b8b3c1c6543262c39613a6adbe11ee1f
SHA512 647028982b45290eafe1d874af8a8b838f8980da98cc0c459f6166d22c17564621a5e730fa047523938e00d944629def62d30ef3cd91767dcd5b2bfb1cbd2011
SSDEEP 12288:UJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UJyxknw4FYnshx8OfVe247
TLSH
T1B36523BCBBDE95E2F50D11734B7163626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 eba87de1deeb21b80ffecc7b6b09479c566038dffeddad6c8a3dc7813175489c
MD5 9c2f6ef433b3e2fe0c2b46fa87b27a8f
SHA1 a6712797e7f355d30eb13887d460c34a4a56468d
SHA512 eac3c3e88d751bf71a09542fb4efd67c43ffcc9bca28c701ba834c2820967da10188ac9ec137028308923d13956a7fa5e2cdcc7a856f6fb481f524bcc6eafaa4
SSDEEP 12288:z9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:z9yxknw4FYnshx8OfVe247
TLSH
T15065237CBBDE95E2F50D01734B7162626609B5A5EA75821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 8c2d528aab469b58f925cdafb0b197c5b8d29b975aee2dea9d071ca5ed17af39
MD5 5171545d5278a8ac55f555d694bd637b
SHA1 b0afd20fa2087da7c6cf5ecfb5f0d529f9733a6e
SHA512 0446bdf1dcba083ed4338fd033c1fa4288de5fe96a9b798de4753f7847120d32b22b57e1345d6fc569440dabd27892e64551cceff5861d3364c114e6aeb44e14
SSDEEP 12288:9iZwbZzzFEoS2cPvyl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AZMdzFVSOlyxknw4FYnshx8OfVe247
TLSH
T12C7502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 97985557644e36c46e547c3db63850f0bc6b8e0698b3be03d54321c3036722c1
MD5 f4d5ad3895587dd66bb68435bb5594f7
SHA1 01cded8a9924daaf266dcce5e43c0d33af7969c9
SHA512 7eaf6aee60a1c2d92265f4d33d457360e21963877f2357b264e7506062ad7bf07b9850e0ee1b2ff781eda0cdc402c769df148f772a7109e5ab4cf973d4a46302
SSDEEP 12288:8q+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8qyxknw4FYnshx8OfVe247
TLSH
T1B56523BCB7DEA4D2F54D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 fd577d0c1ebf4dca94f9bd33d126a6fe8edc400996ac88246de6721c5b4faae8
MD5 490d933944fc89c12fc22ff9d9c0230a
SHA1 10534ee05fc3fc05ffaef6147a175aebd38b3916
SHA512 05bcacd3509403b2fe5e006fca52a582c3dbb1e5788877f4b0f8e5159dd443e9b139260bcd21ebb28e34fb81132dd71dd30ad1bd01cb820ef190af654016b003
SSDEEP 12288:HW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HWyxknw4FYnshx8OfVe247
TLSH
T1F565237CBBDE95E2F50D11734B7163626609B6A5EA71821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 01bc93b1112db7de3e76cc528c8dd0c58ab3990da314ce6b402061b6bb51c16b
MD5 ea9e02bddc442c0d668aa184704068be
SHA1 0bccb24e8202f4f6ee80d798eaa5b5f8c4ff5f64
SHA512 e0beaffcce3d9792897103b12b26982860cb60fcc4440186eae2730fd5d47f2fd72e86526b0a867971e602c372b4fb36a7809faa74c43632bf8ebe0625fab482
SSDEEP 12288:oyPz5L8x+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pzyxyxknw4FYnshx8OfVe247
TLSH
T1EB75125B73E530F5D12A4236C9621612F372B8724B3086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 e7fa39b2c749aefecaebb671ec5dcf34d54c3e56be3c0ad02b376762ff901c9a
MD5 7f30472a11e7d31bcb10662c68da84f7
SHA1 4f6698dc28bf323d4011d873b58630bba032bdfc
SHA512 fb6020aa63c5e6dc4e04c6816c5a9902bbdac48896f83cd8165f74cb5346bdaa20e8ad31149ec6ce48b2cef48b376d757b296e16a9b11284bae7096ea58d5dc1
SSDEEP 12288:Hq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Hqyxknw4FYnshx8OfVe247
TLSH
T11165237CB7DEA4E2F54D11734B7163626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 6096c30b8df7d727f98c98db53d945ccb83266290c463ddf90675a336ef199c6
MD5 ca4854fd7c0b4b70cac70c26c8608398
SHA1 5c5a7a541de27fddb3cb30d2a8954f91dd3b12ca
SHA512 92fed9d68558b580cad51f2c433bcb24be42fa597d72d93eecbd5c346556881eb5fc77345be07bde2f73990b23de525c411670db3b4d10a81f055df2dbad8f51
SSDEEP 12288:Hq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Hqyxknw4FYnshx8OfVe247
TLSH
T1F265237CB7DEA4E2F54D11734B7163626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 ab3d79ca727964a6ad41cd21eebbb9e74ab48a298847987201390f37c0ed29cb
MD5 7d33f6be45987f9f7f9adb002720162f
SHA1 c383b17eb7619fcdcee71cc0482b122a35ab3b0d
SHA512 3b377489fe17d2ec14589e34bed8042b955b5562ae3634ccd20d4ebd96dcc3a1ca5c2d9eaa56d5b740203915154d4f0c56a44510b3b5e6664b09ebefe2fe7caa
SSDEEP 12288:gyPz5L8x+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Rzyxyxknw4FYnshx8OfVe247
TLSH
T19975125B73E530F5D12A4236C9621612F372B8724B3086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 84529592ddc88929999cd32c3c627e78a88b94e9563777051c4d42af413b0323
MD5 024298eebe88db9d4fab072ce642d955
SHA1 d0d5f532dfbf721b556ad62d3ae9333eb4dc967c
SHA512 10fb011381b4828a00c57aa149762c8aa0b2b37f53bd684372d5fbac516d7b29215f39f7965ffd723e0d00fa583eace675ebc557b62285e3dd45df832a234d66
SSDEEP 24576:FTGaLl3z0zDLyxknw4FYnshx8OfVe247:FTFLljzx4x8EVep
TLSH
T1747501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 30aabaf8c013aa6de05f8721add12ecd5322605577cd004706a449049aa1059f
MD5 e79566c843978ad8ad7079b591cb0408
SHA1 3e3e8c802eb52b9330189d3e99f18db16407162b
SHA512 6aaad1691d12642bfb4955f625e328ea1100d948a49cd694047b8138b9986537af45a4bcfe616be420b047d911bd848ec0c5e132597e8e458694fcb121f49c8d
SSDEEP 24576:c3Xd9CHKy7GZ/yxknw4FYnshx8OfVe247:GXd9CHKyacx4x8EVep
TLSH
T16695DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1e54af62101cc8c8f07fcc00c5ad0b97dd7bbdc99aac1d59e4e632b2c0ea709d
MD5 380aa79ee4fd8d80369e4e79e21907be
SHA1 4d17bc3e25c881f1f78f7c541235a8efbcbcc07d
SHA512 c25273f46fffddca785c470a270c26f983594fab5585189017758cf19e748666cc78e8ff90f5c5975cda5374abf091e0d8a74b0c46b44c39e7be4f249d0d12a1
SSDEEP 12288:y7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:y7yxknw4FYnshx8OfVe247
TLSH
T1E165237CBBDFA5D2F50D11734B7163626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 2920872bf63fb8b9431297f55d4955483a653e691b3beb2791c0930f5e1f7d5a
MD5 6f7729d9814c9713198f82ed9802002f
SHA1 7a2530d41d94934c722aee88c8741a123d533ca1
SHA512 e3524df7435b281d1b910c97fbf34f5a4dd9a3bc15d4f51127f077ab5a0e121b28e7d3875fabebc11b34c112f42f729bafa0dbf0c0ae61a58bea6fc22fd662a7
SSDEEP 12288:d+sfa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7ayxknw4FYnshx8OfVe247
TLSH
T1F175F028E29812E4D06E2176CB625641B3237C6597F1D3CB97D0F13E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c12c47948d116334f8a6b7ffedd1216cd7c3163d3f103c1298b28c3daa44acb2
MD5 b2166131c9c26a58220540a9e1717619
SHA1 e71bad4ea80ece8bc748e8d5ac0e9ef6a44aa334
SHA512 f2deaf7f7200210cf0486e53ca878cf5485128295faf75e279600fe23c9550a83e74834a94be8dc338b79b0a7841cff771893bf15391159f4ce7f169813c3b71
SSDEEP 12288:Wy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wyyxknw4FYnshx8OfVe247
TLSH
T1A365237CA7DDA992F46D15730A76A231221AB1B4DF71C18BDB69B14EE0B0CD0E83D613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8b699f49e455727897912de6d47ea0f231e7e5069a866b39c59c29e1be47b997
MD5 8ca1e2763f2128a75600eeaa707c7c02
SHA1 d1f06a076bf8f1552fc32fa8011a327f96f8dd6c
SHA512 4e600118b6db97de4bd714ceced45b84c164c35a91983b9d353cc8daa0afe37da5c7540e646618e9072948d99468b5457b0e01b3e11c295c03943fabaa1f2765
SSDEEP 24576:e8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCEyxknw4FYnshx8OfVe247:HRZwQCyiHiQEaaPnMyx4x8EVep
TLSH
T16385AF1D63DC46A5E0BAD2B8CDA74407E6B27816573193CF0291C27D2F27DE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 0ac58eefe5e40bc68c38fd3c3d945faf97f1e2f18d5bd349cd24423ef0cef248
MD5 2f9928006d9cb98b3a7729806df7460d
SHA1 810751872743d5606df542158918b711f940565a
SHA512 7469b869f6b5bb28dabdf6b7a39029e8164358b742a392bc51abe02d1f531da19c48f3fa16b9b1937cbd715dac7fd90ad183ea99fc6b7cd84fa7064cef92cf49
SSDEEP 12288:4bxA1U7K1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4bxA1UG1yxknw4FYnshx8OfVe247
TLSH
T1C465123C66EC24E1F179913A89A18206D332B866673193DF52D4D23E5F32DE49C3AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7c6cd59b6bb93e190dca2cc6069d7c2b21c1078322644eb2918bb7e7d4a57238
MD5 0617838a3681b1f5e9895766a0042a68
SHA1 042cba231e173a83721fe0b21da4809467ab572f
SHA512 e51ed0cdf109a0cf5a74715fa7687d680cf521f9a09618ac11083cd067fd56edbdd331afdf41d4943f6adb6c85b1127aa1a1ad898801b0f6390063d0aa1c01a1
SSDEEP 24576:5jsmP0yHaqrVqHra44KDzMsrnKyxknw4FYnshx8OfVe247:5jRP0yHfVqzlAsrnlx4x8EVep
TLSH
T16045AF2DF2B910F9D4AAD136454107B5BB71B42D1F209ACB4170C239AF06EE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 cfe25c1bc5830439f0bec21db6b2de58a8bb65fe6711da79ddead1429fdb4ee7
MD5 aaaabcea3c5ad85b7590313051c2b317
SHA1 86f23530221451a0926591d1f2bd72a060fb2e00
SHA512 b15b5e397b5224f31ef37ebb86b607c52fd1025f920680e657830ec426476dd3fe56c32f5e66732911a8cbd76b5a6666110331494f4340d6431e46029a55d557
SSDEEP 12288:Sc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Scyxknw4FYnshx8OfVe247
TLSH
T1266523BCB7DEA4D1E55D15730B7162223205B2A4AB71829BCB6DB11EE1F0CE4903E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 500fcbf777b4c0924f2200d4e44033c6965465ad3e550d4eb2f641aaa5fd6e26
MD5 9006fed9fd92662598774329a670b47d
SHA1 de3c6f70677e9e28dc105d25bbe2b94b5f9ee79b
SHA512 7ab738d76c3c05151415a3e37aaac49fb83e62119d6654e9897fb49062ed8d55e377aa3de937c4e5eff9e06da96fc19e4bc94fac9f3fb2525a16427bb28634b9
SSDEEP 12288:ROb6A4LWO+vAYFTO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:GCLBUTOyxknw4FYnshx8OfVe247
TLSH
T1C9850158F7E400F5E86B813DC9729612E272B49D0774E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 2de283d0bb72001902279ea926b88dead386753138938cb361f2fb7875485110
MD5 0171d754eb5058d9b7ae1e31ca7c39bd
SHA1 36d714e8eefb333183267eae0a5aeb6b095386f8
SHA512 2ac466769cab1ce8307915f52718211cbbb14dbb0fafdd2afa755e5fd3e809cd91a7d7e6904bbbc1f7f1c71a65364fe1929a3aa9e0f9112c0642ae3e22e80fa7
SSDEEP 12288:X70VmwIYNvUyBpT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ggYNHxyxknw4FYnshx8OfVe247
TLSH
T10175F22E62AD1CE5E57B517A8AD38205F2737466172192CF05B0C27E5E23DE8BC3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 16673c872dda89963889188b337b5fa7fa1177f27eb5aad6d3e1c39220b0979f
MD5 63606856ccdc7784072415e57d6547f9
SHA1 f2aeb46ee850fedd0799cfa130db5864dd793096
SHA512 6ff146a7f7cf279c750cba8e766e400372a3f4f02796854a09d4c5a744c70ce1d3d54fbde1bd31553d969bdc8d937ea105088bd37f1692e915fb071370c976ec
SSDEEP 24576:pnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKb:pnXoJJYH84VVS6AmEcJas+cHBjSSKHPr
TLSH
T10765BFADA2BC04E8D5BBD17DC5C24506F5B178621331C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cf3d0a16ff36d22cd53517337e5fb8abc0f0d258f62c1d633f049de919e87613
MD5 f54f78854a22ddac613fe6535f3d6f1c
SHA1 4bb4f45966848484bfe632a3ab28583cb431fbd5
SHA512 92cd0ffedb0dd936bd9796dd2595e18b73a4e0f73fd15c6aff2dc2d59e94051507bf1db0c49816217bd2eaa76f1731b25b4df2a6f9a7374426f11e59bd8df30f
SSDEEP 24576:mv7Xbxd9Tuycf8M/TYlSuxwr2PCLyxknw4FYnshx8OfVe247:mDLL9TuJ0M/TYW2PXx4x8EVep
TLSH
T1B5858D5EA3EC42D4E07BD6BD85B79146FAB2B855273081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 b576aa2bf3f77d6ded342bb72ac02fb19b7966b7efba8b0baedb3c9e1c6731fb
MD5 bc2d765cff3bf32790fb21a7bafbb957
SHA1 113f375ee49e0b38b0914688e5268a5066fb7c4d
SHA512 174edc3a7f27f6b2621f04d554ba9770cf4a5c008472cb2a086817567a7afa37d368d980733611f373c0744b2653a7d4900acda270099145c3d486e4352cdbda
SSDEEP 24576:wegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wOyxknw4FYnshx8OfVe247:wngOJOmPOHhBx4x8EVep
TLSH
T10555CF3EA7BC15D5E03EC17E8A928916F6B1782603355ACF0160827E5F1BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 57d9afcc70889b9b4da5477a50e302770a8db8985d199f8d9caf52694f0a0f97
MD5 99d0251046ef7722fa0267a888be44d8
SHA1 b54f974bc57abd1910cad36bc1f7d637e0bc6176
SHA512 32a4ae395578c7507aa0a25878ec06e335a1d96257f6dba2f536f3ca9638492556dce2ea2abe4a4e169e223cb25e3907ce6de2af6a375e009750113406d85ace
SSDEEP 24576:eLJnJiTk3R3waE4JrO8yxknw4FYnshx8OfVe247:eLJnJK8R304lQx4x8EVep
TLSH
T1EC85D03CD2A810E8D4B7C2B5825A2756FF31347C2B2169CB59B4D4353F12EE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8b1d3aaf6f60dd0b02d658f1529a2de044f3d420447f5a0ba0dbd0f1ca82471f
MD5 966aa807bb62af00abbefd2d6f89cce3
SHA1 344cc3ed04233bf1ddf926c1d1696a6f63d714ed
SHA512 c7fe89124c09d59f145c955ad5c1784cf2e86c0067cda9907676d950876acdd4325edf2c2cd49824d832a6335fdd70f07b7499026f15d9b7315850671b888de9
SSDEEP 24576:xA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pmyxknw4FYnshx8OfVe247:29GqCzDScAZmlvTcFg8Ph6zx4x8EVep
TLSH
T115955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 6a9f587e8f393f98134a88f8cbac6699efeee5e0214012f82de83fed5106c2ce
MD5 c1145580fcc5c6ccd183098bb8adbc12
SHA1 8b9fed0e80b1fba3df2f96f0ce77c43097885f45
SHA512 0bce46217d88d0331b36712ab5b2f2fcdbc9fb0c8f05ce4c99838d54ab21db03378b10809d52da97e1a348b7cc93f7e77682c851c18d96ceee2284f6e9fbb090
SSDEEP 24576:AlYJeXm5jUuEpyxknw4FYnshx8OfVe247:AlYJeXmRUuEsx4x8EVep
TLSH
T17D65126C769D70E1E12E507A8AA24615E372F0B1672153EF82E4E17ECEB1CE06D3DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 5f314bcededa25402800ba9b26136274c52222dce9b6bac2ff7b816119b31351
MD5 c21500a53af332ffa9dadb99949909d5
SHA1 1e7fd4592a32f081da2511c3b5997c3924e0f4ad
SHA512 2f09f40b1406fa0637ce601a1804467f3a63f48016971dab8bc2c192b266fce9e8939ade6080d6985a22fbaff4517620965eeceff2a4df01091ac16e58b23f32
SSDEEP 12288:VTu6ky1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VKty1yxknw4FYnshx8OfVe247
TLSH
T14675121873D965E0E57905369A734261AB35BC709F3183DF86E0F23FAE719D0A839B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 4bb31ce7a0b87ddd39e111927c170590a14a91e6e0f1f1fa8c3737342ee5c8bd
MD5 2e0e2088b89d590971a47bc2ab8df24e
SHA1 49c0bc574ccb11db932ffc2d3395ef15f6ab22c2
SHA512 4cd8de0fa33319ed175000cd70a70f77954a672e3fcd3c73cd570554d20b0805c13c1f483c3ca0cf3421b402f762a962c4f9750ca96deb715c790631bed83e48
SSDEEP 12288:TPO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rOyxknw4FYnshx8OfVe247
TLSH
T18965237C67DAB4E1E9191573063262626215B1B0AB7191AFC7F8F13EE5F0CD0A03EA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 be312424e5e621ea3e2dba7bc9f5f6b6aabfdedadde144d0e23bd0e15465443e
MD5 7bfb5ab7cbde71230f510e75ca5a9a18
SHA1 ee482f41132c1786e2c67e9d6b5abffd2ffbb09b
SHA512 27c30584bc100b650117eace325b38c6b41519f1ba3ecc1ce2d78257d93ebbc73d4fac33a97cddb769079996995f05ac45b075ce83d2b8d667df800fd1e55992
SSDEEP 24576:rC+TyQIu93VAumZr7jmfyxknw4FYnshx8OfVe247:r/TfIq+YKx4x8EVep
TLSH
T1B8558D2DA7E91DCAE276C675C9A34493E633B472137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 07dad7432e49b68c9129c616499deaee22570a0526ee5b11dc3f1e6b8865cb32
MD5 48ee29e075c3f83127148ef14be0dc71
SHA1 79d4e7ec77327285777a22b62fe673124b32ff73
SHA512 8baa10dbdbb2718755ad05e42a3de52f9a25087eede6d0787f7b5672be272fffc44c05719250f327dba1d4f4280e336ebff1e0230cfe952ba2f96266fdd2d79a
SSDEEP 12288:icyrWOstaa3kcsq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TLQikZqyxknw4FYnshx8OfVe247
TLSH
T1D675F11EB3AF10E1E0AB813989554212F673B074572263DF42A0C77D5BB78E9BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0c03061b7db45930a2d185a57e6e126442405b3b4cc06096077db80effad887a
MD5 1819aca77a19766732745e009af01585
SHA1 994446075c1f45bd2f92ab4fd666f5a9359cc586
SHA512 c6d71a2db8722b66eb337944edaa6a5671fa4c402504921da4dcd43335537fb77b03c007b131957cde073b419dd043bbd4edddc649eb4d04dea7b991004f9220
SSDEEP 49152:+pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPAx4x8EVep:rpC7b4+80GTkbix8EVy
TLSH
T16FA57C3DE2F810ADD8AA8376C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ca29ed2098539eb4eec725242d479ed22b616f6604a71dee119607a813cf1325
MD5 e4786fc08030a32dc4bf9fb90f7417b7
SHA1 9af6ffe27ec59aae714c038ba5fd322d7f916d58
SHA512 732037033416a67382538711091a7f0ce78d68e75c6161bd6dfc6355f1e644c159da3269812bba72748b504491b803b42af989c6eaf5be12c89145c5e559f2fe
SSDEEP 24576:pSAwJPE1IDAo+4Kt+l44135UQiyxknw4FYnshx8OfVe247:pqPCIo4Kol4/Qdx4x8EVep
TLSH
T10F55B029A7F956E4E17AC7B4D663C611FB737822133163CF8290913E0E169E89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-419-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/8-315-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/236-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/236-421-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/868-282-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/868-412-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/868-290-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/868-288-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1004-79-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1004-83-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1004-236-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1004-73-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1660-422-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/1660-327-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/1688-54-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1688-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1688-57-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1688-235-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2136-415-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/2136-295-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2136-303-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/2136-301-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2192-10-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/2192-0-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/2192-6-0x0000000002010000-0x0000000002070000-memory.dmp

Download

memory/2192-82-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/2204-319-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2204-420-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2436-234-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2436-33-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2436-45-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2436-39-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2516-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2516-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2744-312-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2744-310-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3152-279-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3152-411-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3192-339-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3192-275-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3192-418-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3572-219-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3572-13-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3824-24-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3824-25-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3824-16-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4336-451-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-434-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-461-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-445-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-438-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-448-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-441-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-443-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-450-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-442-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-454-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-455-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-463-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-465-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-462-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-440-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-449-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-432-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-433-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-444-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-436-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-464-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-446-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-447-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-452-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-453-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-437-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-424-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-425-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-426-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-428-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-429-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-427-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-430-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-431-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-435-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4336-439-0x000002178C8C0000-0x000002178C8D0000-memory.dmp

Download

memory/4396-269-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4396-323-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4396-416-0x0000000001470000-0x00000000014D4000-memory.dmp

Download

memory/4396-262-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4396-267-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4432-256-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4432-254-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4432-248-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4432-318-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4612-314-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/4612-244-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/4716-70-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4716-81-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4716-67-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4716-65-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4716-59-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4760-417-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4760-306-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4912-326-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4912-272-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/5044-423-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5044-409-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5044-456-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/5044-393-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5044-377-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5044-340-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5044-337-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5044-331-0x0000000000910000-0x0000000000970000-memory.dmp

Download