c0267d19ddca5e49411382f7408a413192369fb365c1fc55b64750620c3e648c

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260504-n6fc3aev7p
SHA256 c0267d19ddca5e49411382f7408a413192369fb365c1fc55b64750620c3e648c
MD5 10391e64acbef5a2bbcdf00bba9fd20b
SHA1 58ce728fd58a5fe090d4edb13139277f932168d7
SHA512 c4b16eb6d969bad7553953d65bdee91dcd9fbb1c2f0935b92e44401a7dc11d9a2ce5a69ab508d5af1a3b08af054ffa82fe32d1c2d476efff77429b61959b24cc
SSDEEP 49152:n+/PivcpfQvdaKYXf3Cleyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN755TG:+/PvOBjcXvvOOc5lYPKES
TLSH
T147165A1E735885E9D5A6D1BD8A428506F271F801C73266CF26A4875E2FFB7E34E3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2376	alg.exe
5736	DiagnosticsHub.StandardCollector.Service.exe
3076	fxssvc.exe
2620	elevation_service.exe
5292	elevation_service.exe
4000	maintenanceservice.exe
5916	OSE.EXE
2000	msdtc.exe
4796	PerceptionSimulationService.exe
1960	perfhost.exe
3792	locator.exe
5372	SensorDataService.exe
4764	snmptrap.exe
5232	spectrum.exe
5428	ssh-agent.exe
3128	TieringEngineService.exe
1452	AgentService.exe
2804	vds.exe
1848	vssvc.exe
2372	wbengine.exe
1980	WmiApSrv.exe
2140	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6f626bc7b955e89e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_165671\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5e26cd4bddbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d4307d3bddbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082f136d3bddbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000080bafd2bddbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2db61d3bddbdc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5736	DiagnosticsHub.StandardCollector.Service.exe
5736	DiagnosticsHub.StandardCollector.Service.exe
5736	DiagnosticsHub.StandardCollector.Service.exe
5736	DiagnosticsHub.StandardCollector.Service.exe
5736	DiagnosticsHub.StandardCollector.Service.exe
5736	DiagnosticsHub.StandardCollector.Service.exe
2620	elevation_service.exe
2620	elevation_service.exe
2620	elevation_service.exe
2620	elevation_service.exe
2620	elevation_service.exe
2620	elevation_service.exe
2620	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1328	2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	3076	fxssvc.exe
Token: SeDebugPrivilege	5736	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2620	elevation_service.exe
Token: SeRestorePrivilege	3128	TieringEngineService.exe
Token: SeManageVolumePrivilege	3128	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1452	AgentService.exe
Token: SeBackupPrivilege	1848	vssvc.exe
Token: SeRestorePrivilege	1848	vssvc.exe
Token: SeAuditPrivilege	1848	vssvc.exe
Token: SeBackupPrivilege	2372	wbengine.exe
Token: SeRestorePrivilege	2372	wbengine.exe
Token: SeSecurityPrivilege	2372	wbengine.exe
Token: 33	2140	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2140	SearchIndexer.exe
Token: SeDebugPrivilege	2620	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1700	2140	SearchIndexer.exe	107
PID 2140 wrote to memory of 5180	2140	SearchIndexer.exe	108
PID 2140 wrote to memory of 3684	2140	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_10391e64acbef5a2bbcdf00bba9fd20b_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1156

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5292

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4000

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5916

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2000

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5372

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5232

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5428

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:240

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1700
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2788 2796 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5180
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2840 2832 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cc4b86f48331ae32f7881cd8e1e08da16e253739e492f79d7089e9724b05ebc1
MD5 f2ce8957b5b413714a14425ade8be3eb
SHA1 b25e04950305184565e3b89ee9c91e356d4d514f
SHA512 bde09cef22549245af6b1a80941a2bb33847b6d76a92806bba0496fd8b9b48971e8ef6ce5dd1650a20df2dd0f5fc4034da0d76d1e8b6b6cc725317422c6635d1
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrYPKEnSG:g3q6HjByYPKES
TLSH
T119D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a89e723fd31f6119045c8aff49e5a21fc497e32233dceca11cf28e1306c909ac
MD5 1cd437e38642a408957cfbe218ac0bbe
SHA1 3a9075bb0638283e3e26e9858553845f87521dc0
SHA512 705825de85a1cc22344b2643eb596b3b309e714417a59ac0ec0785c9c0748dc28c731cbb709862f16491d917c7aab120c6a57e29594810aa4e673c709aecef8d
SSDEEP 12288:v1XLsswWkxy2lRq2czAE45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk8:NXYfDtczAHYz7KEMdX6keYnAcerh
TLSH
T10F85012867E508F5EC67823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 51fd27afe69aa0b3dc2846693954bde7934620e0a5578c65edb4c553dca5dd0d
MD5 b59997ffba3d986969e46d176af1a715
SHA1 dca31f9a8eb8b825fea5c247c8375312bbe919b8
SHA512 9b13e30e43d693bf8e7cab731ae510aa775fcf880a1441604ed1121ad78df19637092ca7c479c3c62e1a893239cb968a5f0b884239b5285d144c9757c86811e2
SSDEEP 24576:F0Le5ji0hmx3rMWYz7KEMdX6keYnAcer7:FPji0AZpYPKEnSG
TLSH
T159A59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ede40dded300df53eeae403170857bc81fe8b3895ea773512a1c7037b2b93820
MD5 d4363863cc108d057aff9b01fe318cd1
SHA1 77fd33c9a2c5cb72106fcc8b345cf36446efae84
SHA512 362e69b28457fae04f6edd44ba89b4d389954333eab4b732a5eeea28034941c1036c5444c0e8385234d39f05b65b5b35fab6e36327994f1089acfcc624d2575b
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuMYz7KEMdX6keYnAcerp:G/ezSC6vUzPvxHjyNYPKEnSG
TLSH
T1DC756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fa7f079bbd85c4777f0cea18a89d19e5c76c0b5a492c1f3559fbd865581ff46c
MD5 77e84fc71ec6daf6cbe0998a04771c80
SHA1 4e6437b3576c152cd15e706c965917eded9beb06
SHA512 d26f94533c6c528c39a66f3d1ea999142af54efafc92072100403080d9fcd330e06e99c66e727cd9851d7a42f2a080f9627a523fb3f218976056b86285fdcf09
SSDEEP 24576:TVbqPb88hv/l+6TYz7KEMdX6keYnAcerh:TVO88hXl+aYPKEnSG
TLSH
T15A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 56848c6b733203a57a42dce99140cf41d10ac535ee8042882238b27c052023f3
MD5 d8ee9da6b4005b8fd9f2a1d1f58d069d
SHA1 0cbff3e401485996995acc91721dd01d37430cb9
SHA512 bd2282e608e0f3822e970507aa3ff1aa73a3b6f598e2ca90c60ddb80bc9459e483c387bece2d8357fa0f646d12f13b87f66be578acb3b58715f9c25bd1be2b1a
SSDEEP 12288:EX945Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkf:EXCYz7KEMdX6keYnAceru
TLSH
T1166523048B1A89D2F85F0677FFF5894085375DC62E8C9761C94CFA8293BE222C50679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 08246fbcc64b953967a00532d508862d97242008028fb8e0103383a08e6f187f
MD5 0c0c5fb61c42f13f84f3804c96eb0f9d
SHA1 8cf1ad76cc772fe3ccf97373969ccb434e279e28
SHA512 154ce8c899297064da54109595f276f1621cded0a6ef3e42415683dc5c79f15d123922075f11a54cae6a97173f979cf671827eee65c750dbf44fef79e2185ef1
SSDEEP 12288:keBNUbTVO86Uw45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkV:kJIUrYz7KEMdX6keYnAcerE
TLSH
T18D85CF3BEE28FCD2C27A8DB96B918600D77278704B51A3CBD164C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 92ee80967f7cecf168ef9bf2c6b4854435399359dcff77a0dfa7a1b65feb5104
MD5 521d937b400e5b07d949a5d61162f6be
SHA1 abf1d24ba736bbbab4a3d5beb54ecdbc0ceae4b6
SHA512 7890db5fe146677324b995346edec6e1d5e8a933934ed6dd2654e58b4f1ba022a0e15b8c5c89f54f192c889590c57c8d3b1a8a5f27d1bb2f718cdebc84b4a3b8
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:MQvGAdlCEL8c/yRNw5CcYPKES
TLSH
T1A0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 f98e55b6f65e7142691c0050329ab954c445e4b9a1ddcca2088e38f7e5f75705
MD5 6502a1b83a70243117618a8e062656ad
SHA1 e0d3268e489b3b1d45225bc7c51647eef0b872ec
SHA512 11853ec1567de333c11c492d3ab83927c80ec683d2ec6ed1142db9c635d687520d50110a5b29b3098f57ecfe0b91808dfbba9d3231211c638d23f60254c8383e
SSDEEP 12288:LAwSfxL/2Dc3BDLLmt0LDQewsAjy45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkN:0kewsAj5Yz7KEMdX6keYnAcerI
TLSH
T18D95E031FE75E432C67F0DB62B36C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0f30a6b6bcfc49791815aba7d23aa738ce73b8fcced87be216bb07abb3f1e792
MD5 2e34ed1fec91182ef1add45f5d263346
SHA1 fbb4721ed715cda84dbf61d3c744c309da57c783
SHA512 8ab93111cd066f751cbd8c52fbab872d804364582545334059d0bf0c565f178373f0e0362bf5fb4e46724b740e64ab3da37e6f125131e9c18305d9f5c668b647
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHhcKZ:oUEtQevvqc2W1cpV2EI32hn
TLSH
T171474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 65ed807520194ababa3ec271538a5270231bdd4e0b45d55a5c04650fbed9112a
MD5 5dcec10e5413cabbd37a4631f98d9324
SHA1 7698cc490cfb960673d4caecffca78dfb9951127
SHA512 0c8ba9c4c7006c171c3fdbe9e8d35d6297560dba318897a745689e09551b2f5e9a1f0c24c96624ab3401ff47d792a2384c2aeb0d7bb691ff71d6df941aa9c543
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zZYPKEnSG:+oqtVjnmgYPKES
TLSH
T10ED58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a3607c0b63fb0020dbef8bf2ee1d4b2afed4debfe6f6d4f2eb9a08c6d4b78ebd
MD5 a30bdf7b91839e2f40750008d3ee535c
SHA1 3d3072bfbece573ae066bc66d91af585d760bdc8
SHA512 f746bc614382732b2c7a04a04d0dccad6b7288d341ad9f0b17c90bf50e08048c7ecdb6bfcbd8a497fcae1e1f14e6c97462c3e385d4d8a9aa5b5172da4f36ba2b
SSDEEP 24576:QAhGLJIFoiwtA5l7S53AYz7KEMdX6keYnAcerQ:QAMyFoiq5wYPKEnSG
TLSH
T19735AE80EBF955D4F5B3AA78A9B68570EA76BCA65E31C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b6d96a6d842a1ba1351d4bc887fb645956c8f56585a30518229e552c4cd44eaf
MD5 578d8d4980551e6762c40ac11f1e7236
SHA1 dc2155079a5bec3ef753102527ec82755ac33b79
SHA512 a5076a4040fe22aecf82cd21d03fab2b236590a84591645591f6b6d094295e9bc353430e37c6468075ac332c96a5c0a5db64bd74e6312c7decec15a9a0ed9cf3
SSDEEP 12288:imw5HEjsChNzBFgl0WDm+CD45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkw:7wuSOWtYz7KEMdX6keYnAcerx
TLSH
T1C985F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6575F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 6f017fca8514f6c230073bee7208e7b6c8d53d5a13abf09bdc635a03954782bc
MD5 73c3a70207e3b60657032224084568fb
SHA1 f5503bd6fe6725bbb5874344d098e3f689225184
SHA512 e31097df4822c490b9fc247929dbcac21c12d84c105275a0ad8183376c51df06f46f97192aab30c3c44dfb355ecf59bb25fa681a91dacf80a28033edf0e520f5
SSDEEP 12288:cjZ1IyC45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkP:oZuOYz7KEMdX6keYnAceru
TLSH
T1A975124923A861F2F0A7423EEEF14601D7727893277983CF465892925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 68c4857ba1f8a9002824a00e5fd3e78e1888f56508b3f908546f83571df6d4ee
MD5 e61917bb2787b95277770515152b8c5a
SHA1 0a4166f435b157d1ce82e27b0ba05b7d2cfb77cc
SHA512 b6bab623c652e411d978b466a18552c842786b94bf7160315bf2eada2448669c8413e4ccd5f3a82017a717ed235699a8c7fcbb9e36e2975db81fd91306bb2370
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:nQRQyi36YOcPQLvw2gAf+PN3/YPKES
TLSH
T14A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 09725bc97c6941e1396f86674c78c1ec5488d0d0a436580e83b421843181e3d5
MD5 a111ed1ab405d95fe342103b06e047de
SHA1 16776618016b4bb54ede3c41d6eba805a95925a7
SHA512 9b8a2256f7f99c1d1a364c55b38e6380e6f45535106a5147da273e3154477f01c3a1a9ad7d5ab7717e03b5d08ac9318f0752eff3e01fcf116e194573f73ee83c
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:KQRQyi36YOcPQLvw2gAf+PN3/YPKES
TLSH
T1E1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c5660b4d0eee71a7d0788c9004a131ed86c4bc8343715102db03b2a49e0b0acd
MD5 b2b8145dd283d9f29256baa7fcb2cbc8
SHA1 049ea4440ffcb8b5a0fee76d12455954a72f1eda
SHA512 ecda80d393ec31a6db9a21575a76046813c1577629ed3018f99769a45f18a8bc748832bb71ecf6d99e235c651a3a93eded67d186cdd7d96bf86a2c9ee4d4cc6a
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+Yz7KEMdX6keYnf:w68Qg55nhheWu7PNU3/pYPKEnSG
TLSH
T19AB55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f3a2d96f122f89b2fe47ddc4b9bbfe46eee22a4e5b3f79240335c688f35fbc81
MD5 2f394a9323ef656d7109a5451d680153
SHA1 75f42e147e21befa90032f19edcaad2b7b2ccdb5
SHA512 936088a337ae92e1a559f28a10b715fb9346b9305160b2cb9b7d713c6f51710adca1447dc5907fcde7770d16f52047875f0c464a71d5cc5484a510ff424b917b
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:uy5112gYy5azzVvL69nLKnhZCYPKES
TLSH
T175167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7f86101138c74adaa1d08451ca711e990cfbadc3ccaa62a4ffbde71a76a483c2
MD5 c686de66dc6c75dfb52f6ccab6adc118
SHA1 963d6f245038e30c8c25b5267c43e109a33a4112
SHA512 4f105c8cd010893d79aa5bd311d76ed407b73f69bdc0c6a2a854275dd706070e19e3a9246fd3d612ac3317644a0a00a2a2c8d1daae81087fd523fc669887ea3a
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmYPKEnSG:Nu6JmVxd2dmYPKES
TLSH
T116D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 30a37d6301327b94dd9bec86b6c1c7212f252ddd3aba53ff91faf9acf932d8e3
MD5 af75da8ef9ad497ae30851eb7426230a
SHA1 42c9d74b28cb5487b9ec8192a236ab4b3c913e72
SHA512 1ab173c466a4023a3208ebd158325c55c3dd140dd63e95bd529d725323bcd6a318da88733073d071374f1322aa913ff175b3fabd36f3706da3e2ccc8969a7a81
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xLYPKEnSG:LmifPbRgYPKES
TLSH
T11BB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3f6cbf665deec6da35bd1ce1d7b890ba305ea5ce727207a5561205641d07b79c
MD5 27fac1139090222be17c385e21c4009e
SHA1 b4b3bd169ba80de91d15e35ec07d7637bd7dd831
SHA512 cd40037eb8b99eb5096f72c1fefe5867c99d145fa7f9fd048785234a2eb7f5bec8289c4f2830e860cab5da6cc4176de4037cb181a880e2ead0c7533f9f232c0d
SSDEEP 49152:bSuZQIY0Be2KRRVtOnks6NMHqOYPKEnSG:J5dKTi61OYPKES
TLSH
T113C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 47f236d9fdf141f7eec44d249d30559f6dc4a1dfc403464a3fe2dfc51bc44ec8
MD5 336b0d2bcede7d83d1995b75fa2ea68f
SHA1 b9034657ae0c1642f324ddd3a7c2990363785b24
SHA512 453fdde9702a5a7501415f329dd9a61dd651d76ae8eba9d04cc39bf0a5d3eb6433b93c18be08b7dc40518051a0828610b4ac449b1955246ec5956aa16073e471
SSDEEP 49152:VhtSn8EApI0figngiDn0AP5wHYPKEnSG:kX2iyphkYPKES
TLSH
T15D95BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 7dca67476b84d1382916c8a5fb6fbbd453f12b640a1846780312f0bca9e41180
MD5 9ef33a5954360387f7da5ac3c15280c0
SHA1 7cc9db726ef7154262603650e6a3a091ad12465d
SHA512 8f04714e1fe1b1b3c3afb38e149e0bb611e980cb1087768a1fcd30191f64f006579237ee487d29f101184859acf56727e99b58ede1be746611436d87ae553e52
SSDEEP 12288:A145Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkU:AaYz7KEMdX6keYnAcerF
TLSH
T13C6523088A5B8AD2F84A467BFBF14540C93A6ECB3B8C43A5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 ed10df2ba669ecb2335a3952613b28e3395a1f011c493383211b01f45ddc4726
MD5 1c231f1d35a8afd3a10bd0c83fb8e30b
SHA1 640c7ee1897e3bd111ec477d71e56c9ade76bf03
SHA512 ff2d2531f7b3426815ae0bfe699b84ae1419eb080dac06d9b460ab4cfa476e5b844f7e7f17c0773ea7b45c3a8865e2069a4a243b5be0ee1edf0978b197181b7e
SSDEEP 12288:em45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkU:e1Yz7KEMdX6keYnAcerF
TLSH
T1B7652304891B8AD2F80A467BFBB14540C93A6ECB3B8C93A5DD4DF54293FE7324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 848901951db272ace1a0943579847585f759747694bcb5ac2be93539a8670315
MD5 7a3dd56c35020aabc09e48a7a099b81f
SHA1 8c8d511b4377a7079120a732906b58a17b6bb428
SHA512 70987ed345e76c1fad8ab5ad4f5374ff655e31b675be41d23c05ab29008eac7836d9bb3184e17e722a384a2b4380c24ccea5cace57fe013d01974c784882fd4e
SSDEEP 12288:1o45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:1DYz7KEMdX6keYnAceri
TLSH
T16C6523048E1B8AC2F84A467BFBB54540C93A6ECB3B8C93A5DD4DF50293FE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 00e3a11980825e399802e20550fe0b8003800b21eff6868c5f106c9b3031f6ff
MD5 07f67fe5f9323f75f3921d973d5705fa
SHA1 457a50c5f48b2ccc88269e08b1d84963badf247a
SHA512 ec7bb9f06cc0eb7003c9caafa51929d93c72080258dad0ebe50894ea00fbf6e5978ba402593815211da623843e8e11b5ef21e16a5948ed769427395625dc52d0
SSDEEP 12288:tVP45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkO:IYz7KEMdX6keYnAcerP
TLSH
T1CB7523044B5B45C2F85BC27BFEB18500D6767DC63B2893EFCE08A5424BBE3615924B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 dd354ec969f0290d500e40175d4d86f95a363f3cd0833714030c860ba9a1b276
MD5 36d35d3e551d3571ed3c430b0bf9fd04
SHA1 2db58de59522c4be6e4226290db323a8fa58e0a0
SHA512 152744fd3ff051a9cb8783497969635509dce7bad7b168cddc852f46fba13fd66e672f2bdd9ec736ecf2b074fdcc406db0a8d9c6d7a5069bb86881e984aa1084
SSDEEP 12288:DX45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:DoYz7KEMdX6keYnAceri
TLSH
T1716523048A1B8AC2F84A467BFBA54540C93A6ECB3B8C93A5DD4DF50293FE73245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 fa379919dfbae49f619a9f2524a51e614ad23b098aa04704062f678c8e5dde6e
MD5 9662a0866417f1bfd7b4385939aa07a4
SHA1 95f22987be030f6ec805befeb857fd9874adc2e6
SHA512 fb610f207cfee89962a9f62533e5e56e3bbdcc3acf2f8bdb933ad40ba6ccdc441cb22bcdd40a4a92bda26ba96967c5a09d339439c6ea57a02de25cfd8642e058
SSDEEP 12288:3q45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:3xYz7KEMdX6keYnAceri
TLSH
T1146523048A1B8AD2F84A467BFFB14540C53A6ECB3B8C93A5DD4DF50293BE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 6e31fb3c37d4fe65c03d5dbc85954915af0562007d70098bed12e7975da4c03a
MD5 548125014e4f4c027adef8f8b5d60f52
SHA1 cb9fcb30d92dd9c546272e9fbd21f7c25a40635c
SHA512 3d42c91c984fe72d8ae8c469907efd95628aded7bd8c88dbbed013c59379efb00ec595931828d93fb2ab3a6c2e2b0cdc9e47aecbae30eb2b7d5613e9e0ad24c5
SSDEEP 12288:cO45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkf:cdYz7KEMdX6keYnAcerW
TLSH
T184652304891B8AD2F84A427BFBA44540C53A6ECB3B8C93A5DD4DF54293FE6324505BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 8184d836e6e58ad38cca96ebe4c1ec80a0ff48d25d0f2d49c117542f29d2c287
MD5 2913e4e22169e1128778a2c358f1ced8
SHA1 bf56bf36cd289e82df512c6530a34ef512b7c149
SHA512 53a944f5992a8b7332f94d3d5d48e693f1016e963a0f7b5b6f617209f570b6e004b27d539691a0da0617e014514ec62fcbcae329e3229a7813fc85778655eff3
SSDEEP 12288:UiZwbHzzFEoS2cPvyG45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkH:3ZMTzFVSOVYz7KEMdX6keYnAceru
TLSH
T1CE850194B3500CF0EC67823ECD658906D6B27C5A1B60C65F07A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 fc4af7038114b1ba262964cff7741301843fa8d4465d8a1734ed66bd65b229a9
MD5 d9215d2c1b5119d5017fb4bdc3cc8318
SHA1 9850c49412b9b9f5e9ad1f2dd2f2cd70ffc7e913
SHA512 7d2ea3e27a094db9b681b46e73de1016e84ebcbff695f9dd39f262279973ff1ffa497670f778ee0b6ddf3944fba41f85d0432a4d2fe32d65365c5cc2f1535658
SSDEEP 12288:kR45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkL:keYz7KEMdX6keYnAcerS
TLSH
T159652308891B8AC2F84A467BFBB54540C93A6ECB3B8C93E5DD4DF50293BF62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 54438952a582fca78e0d1a0dd232dcc975a083fc527e07f95a65a5efda12148e
MD5 008a5f6956c812b4dceb753719f41da5
SHA1 7f7e73f633260242bdaba1ccfec2ef0661f8d4a7
SHA512 84041e9edc95393af32842fec78e8cfda55e9e2c46731c3c86bde3135a0b16a616221554c7186ffa5d39bcdf8f78e473bd73a6959c135ac8f97906571179c2d2
SSDEEP 12288:bN45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkb:bSYz7KEMdX6keYnAcerW
TLSH
T1A06523048A5B8AD2F80A427BFBE14540C93A6ECB3B8C93E5DD4DF54293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 1d5d0c8c9b2ca620e4d178a2a0a0de3f4afde6515d2c3202aec632c848efa711
MD5 7d14940d33a105c97063e301c3ab5cad
SHA1 28704fc1bc90105dd3fb75d13d38efdb9487ef1e
SHA512 0cf79a5b54b183f78880a830f063c97d8517bdbb3d273db4b1e4136a16215a55e431c8587f7933ca110ef974205fb819002097fc238ea1ae3bc77ddf3bbdcdf5
SSDEEP 12288:ZyPz5L8C45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkr:YzyJYz7KEMdX6keYnAcerW
TLSH
T14275120767A630F5E0278239DDA10A01F77278761B248BAF579447732F7B3A19D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 98e8460fc5c1ddf287e1aee0eee0f9a3e310fd6d1b8e34e21ed8fb4b5565fa63
MD5 1944185402bf2ce65cce2784635c99cb
SHA1 f0971c32d4a248ea02b5f55233f484651b632e7c
SHA512 7be136511ca30bc6b2375a030725df6a1593de964f0707c7b64cefe8d2f691b3bb628ed8bd37645e93d20611a969f7a6e4f735f88b016ab3322cfbbd3f7c03a0
SSDEEP 12288:ER45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkb:EeYz7KEMdX6keYnAcerW
TLSH
T1A7652308891B8AC2F84A467BFBA14540C93A6ECB3B8C93E1DD4DF54293BF63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 c292d256adebaa08d9123e210c87080c1d00940c035833db48280a5108f2c52f
MD5 024a43116ae956728d6702b83230a443
SHA1 28d55a6c9765772dafae38712b08c0111fb267da
SHA512 5abbf8d6f466e600bcbc4d4a202f6956aab20354495b815dfb516baf2e5e1bc1fd4d511450a2e4a13236bd6d65b1c763d97d6d04ec5ee4a16039e7bae518fc51
SSDEEP 12288:OR45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkF:OeYz7KEMdX6keYnAcerg
TLSH
T12F652308891B8AC2F84A467BFBA54540C93A6ECB3B8C93E1DD4DF50293BE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 a5a2819617f87c6334702d28d7d83243226607845d97c050dff82e3b447c5d95
MD5 98ec6355267f9c06a53cd0f84022d0ae
SHA1 8cb036519b4861faf86806aeb5eaaf7892acbf51
SHA512 dae5a9d99ae67c55bbebf242ca0e6f9402937f78953f77402130fbc0d44acd5aece39b84b199dabcbef1733369d559171851aab55ad4c4e7198a40045fa03b8f
SSDEEP 12288:IyPz5L8C45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkF:JzyJYz7KEMdX6keYnAcerw
TLSH
T18C75120767A630F5E0278239DDA10A01F77278761B248BAF579447732F7B3A19D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 1344452a540f95cfda15bbba1f9e0b0e137c962bff9b8ccfa0836fd65dab6edf
MD5 edab1ed1341eb30065e883ac701ad01e
SHA1 258e903bdba1940fd2131333072224251f4f9da4
SHA512 560d25b34a10e6382b40f841df608b743ec38cd3e46a7fac9cae1638190a8166f40377899b1b2df1fac40f85003c705a4203a059b6ee763d27efc4c3baa22e72
SSDEEP 12288:fCd9ZWYoaLHF3z0z04PDvhY45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkZ:KTIaLl3z0zDzYz7KEMdX6keYnAcer8
TLSH
T165850194B3501CF4EC67823ECD658906D6B27C5A0B70C65F07A836675F373A11C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 a42194d3dc78fb4a8461a0c7af31a77ae5a076a8640aab08b61c809d6d46f0ca
MD5 6fc7c49f1c96b873abc1565059b6ac9d
SHA1 3706ddd82c71caf73a3b033f41194bc1e3c1a906
SHA512 87a60abe84851981f57b3a797b719881a86260a2b887c021fc8583d18e7bbdfdd4a3e2d44647c99e96de37dc5503986f5da88da47f26a6603a09ca7904a0721d
SSDEEP 12288:ui4e7wRdTfgwCHKy7GLbbdIvL45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkT:u35d9CHKy7GZfYz7KEMdX6keYnAcer6
TLSH
T1F895CF90F3E414E4F0B78A35DD764511DAB67C9A1B21DA8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 7358e07d592cf9b1bc245d597550e1d8640d09afccabcc5a6dd58ef0c76c15a1
MD5 e3e712e276524547817e6df380af4f12
SHA1 7eb1f96aaa1460522f1c4154922f936c2da62d05
SHA512 7c86890e6c119fcd08e54341214e0b82260340f413f29dcf29813ea700f7d0f9ecd5ca9c37ecd0cb44690307c7b7f8ea3e3f0a168e69b240fc3a59fe267d5f40
SSDEEP 12288:rI45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkY:rjYz7KEMdX6keYnAcer5
TLSH
T1516523048A1B8AC2F84A467BFBB54540C93A6ECB3B8C93A5DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 73c80b16e7acb9d8c1b16edb5219f06f7e6e6027874297b51a90a5283b6471a8
MD5 ae7cf2c47c558c0639c11cfb0812b5d4
SHA1 b088fc6065001cfdcdf28fa645aa273ac2fc0374
SHA512 b27e8f21edef55a467d696f4effefc18f5488d6be2e0a3cb87f458ff85d523ea0e7e0413c6277ff2f0dd85beb78e58855f9911503734b355f1638d512b08cda3
SSDEEP 12288:4zsfB45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk3:XOYz7KEMdX6keYnAcery
TLSH
T10C750109C29802E4D06E527ADB964A40F3337C6657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 b6301d633abd968fd948118eac403ce9c6d03222af84f14b784393cacf3f4c3d
MD5 7805926fdece512ccdeff7b255746212
SHA1 606ea6a190e7d097ddd7e2b74a5b314323cb5fcb
SHA512 cc510546800e126d8d22a532ee35331f4892ec9f2bc59b9f29798830335830cb172a1d054e595d1273c446e0e312954f2fd8ca775650ab2cc0708c0ae27620a1
SSDEEP 12288:1y45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkG:15Yz7KEMdX6keYnAcer/
TLSH
T110752304875E89C2F86E4677BAB58520953F7DCA2F4882D3E80CB642937E6E14D3574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c114cd0e1104d6e015c2fb8315c946b16f9bd87023e696c3db60088ddfe36713
MD5 afcc28b61e06b8029e360aac414bdf6c
SHA1 207c7eed592bdef62ddc6713bb6cf1e87b71a9aa
SHA512 6038d071f26e288a61fa18c4529e22a75633ec5ca6ae9c305f52923c48815558cf2a4d3409c982da886307f1d81e3e56ddd51b1c9e01e1b81ad9cfebd386feac
SSDEEP 24576:p8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCfYz7KEMdX6keYnAcerU:2RZwQCyiHiQEaaPnMoYPKEnSG
TLSH
T1AB85AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27D1F2BEF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 9f8b3ea915c3bccb9d5ef3286ba21f7f38bb746bb63f1c8504a1f77ee5bdcff8
MD5 e04350d609408f377d753878205f17d8
SHA1 d494363f034f7130eb6f37184acf3aa6f1976432
SHA512 e8aa718a0226b9862bbc879350c155899f13ce99c4c2b5929607a5b107d8b0cf57939cd17d6a8ae60bbaf62d495e087f4ddcfad6524c716469cc87e2bee3d9e3
SSDEEP 12288:5bxA1U7K945Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:5bxA1UGCYz7KEMdX6keYnAcer7
TLSH
T1EF75122E56AD18E1F47A923EEAE18101C3327C56272493EF5484C27A4F3BEE55C35F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cdd67ad882c41ddeeb0d142ee11121c8c6a49d1f222e8b42b286aa9211986e2d
MD5 33a19afcdb853f65c4914c89ce2f0a40
SHA1 f35856f39db9b23cd09767b4d34b00373965a41c
SHA512 3c85dd1a873c175efb6290c4ad6456f35409f5a81ec854736ada56aad632cfcaf7aabb5bb24ce7251a0c759f0bf75c789faf28403a98cabd90d6851188182ab3
SSDEEP 24576:MjsmP0yHaqrVqHra44KDzMsrnhYz7KEMdX6keYnAcerG:MjRP0yHfVqzlAsrnhYPKEnSG
TLSH
T12A45AF2EF2B910F9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 782507a3bbb69cd6f4b7b36280ea4a52922e600c97f02a76bc64669f496d4558
MD5 212012aecbb26532fac264e988353181
SHA1 b48d8f479fc8472c42cbf00e6985560f1d10069b
SHA512 bdb386f8291e1a5a77a779bf681b2b1183e7bb93e4663abddd9725179f7a8513e06d1c87ff91f2d2626706d4335bf168cf86504b38f60143ce6062c50fa8a801
SSDEEP 12288:yU45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkc:yXYz7KEMdX6keYnAcerR
TLSH
T1DC7523088A0B8AC2F85A467BFBA44500853A7EC63B5C53E3DC4DF54293BE6B3453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3a2e6008c372a75efb1b2b01456ce6580446541d7c8eb0bb75b8b39e0de912d7
MD5 6014dcb69f1f9354719696cef8d73fb5
SHA1 07b63d2aa8e01971bfe45a8952b94c8a89149cbc
SHA512 b91da3dd82e23e9563b6839891949a2c429e62796a6c778de766f9ba4ed5c7b80dcf2e770b0b5f1539d4f57fb50046d3da4c6ce2046d35589d31d98d7c99e06f
SSDEEP 12288:7ObMA4LWO+vAYFTW45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkj:EMLBUTlYz7KEMdX6keYnAcerS
TLSH
T19E950114E79500F5E86B813DC9B28A12D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 8ddb50c96fa1046b032019d146237eb68e322d0a061f926e3b14bd495ba73246
MD5 a71a8c39e07a03117f77674d0c9cc549
SHA1 0281c43d12015881d9bf317e7178ad9f1abe0307
SHA512 b6385f09ea3aa0f869490a707f2aa75731a79f54871cca7278e794b118ae7b2a6393d8228376c710b99db274c630f940d1ef75d1562b1967a26acba0ee67f7f3
SSDEEP 12288:y70VmKIYNvUyBpL45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkk:DGYNH2Yz7KEMdX6keYnAcerp
TLSH
T11D85F11E52AD0CE1E57B917ECAC28205F2737896171593DF05A0C27A1F27EE9BC3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e2c7fac378d61633ea35b201dc4fa14f1304e35d473109f57f5711097080be78
MD5 b2d9c9996a01d46903bd7ba4ec8e0fd5
SHA1 af54fa1b88c4a9d3a51793fda555177f44c40bba
SHA512 3a661be4c2a8cff783541c1fd0ea64a8e0f1b2ca326429810936d7e13610be22b9ee9b0d29fe83602e9b89fb1ad08ee46908a79ef854e86c34ec74599d6f2b46
SSDEEP 24576:WnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKa:WnXoJJYH84VVS6AmEcJas+cHBjSSKHPK
TLSH
T10E65BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 866844c5393ac31eaa94291d7c9fab5313612ca33c1bf7be513786ab62063c77
MD5 09e60c86870afef7805daf73e6944019
SHA1 9356cb90c55e66afd743c35c611a2a47c6155a98
SHA512 3e5094b5e45b02a89237a19338f8381980af13ca349c29d21c1afe16a6d3f97ebba3994cae24f1537f2a95894cb43cb28d84cb5913a80f8f9008d59ec4400ca9
SSDEEP 24576:uv7Xbxd9Tuycf8M/TYlSuxwr2PCsYz7KEMdX6keYnAcerR:uDLL9TuJ0M/TYW2P3YPKEnSG
TLSH
T115858D5EA2EC42D4E47BD6BD85B79046FAB2B855273081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c699b3991e5a6f2c731976f204efbfa85c3eab17693a113ad9d782b250e10717
MD5 9fc4c3b378e44753584b85fe7eebbc77
SHA1 7916c0254ed2021a1f25c053921db7edf50bdc06
SHA512 5be8bb8336f9f4c8aafa0bf6060ca8acfa6e1c89fe73219f6ad0c63a4a95c7e7d9bc0e694e5e4d79589f4722aea23d687f68bb73ace40e9bb09c5bd904507503
SSDEEP 24576:degJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wlYz7KEMdX6keYnAcerv:dngOJOmPOHhlYPKEnSG
TLSH
T18355CF3FA7BC15D5E03EC17ECA928916F6B1782613255ACF0560827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 7857a77c37a132714ad3dd8eed3040b1aa7b2fbee2c1da92224dc56a234729c5
MD5 4d5f98a6c9dd963befc31d147645558e
SHA1 68fb6a258a56f450809f0b49fff023448d476cc3
SHA512 55c3e8c050653aa2ce92fc30e011987dbbc4637c84a92e2e8b4feb85c9f2a7bc606c16a90f5be04bd4377696ea55c3c5f5ea868d117662c19b55c8915e2cae4a
SSDEEP 24576:VLJnJiTk3R3waE4JrO3Yz7KEMdX6keYnAcerM:VLJnJK8R304lqYPKEnSG
TLSH
T1B885D02CD2A910E4E4B7C2B4825A1756FF32346D3B2569CB59B4D5313F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 65eeade5aaa6a7a5450920afc7eef240a80760ec10750bedac2ae0031f1e3f53
MD5 fb6af911410be61e242689c366f73a1d
SHA1 8b7141fd936965cc239c859ddeed68e6cdbe50e1
SHA512 bf11e19be03d1726d6d7f9802f6ace4cd3d0712fd29cddee8a9bed15fbb233d0faeaed5c8bfae006c1a7b0faf468a02fa4705c691e1c81248206e8c718fe474a
SSDEEP 24576:YA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6p9Yz7KEMdX6keYnAcert:39GqCzDScAZmlvTcFg8Ph6LYPKEnSG
TLSH
T112955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 bef052043994a398b010f5498a2634ed5f9d6323fe7aa8fabb7db1a5f0b69f3e
MD5 fa435e98a7bdc0dc4c97124bc419e30f
SHA1 ca41ab20e1aeef541ba3d1f7206fdda580157314
SHA512 0575139e21e779cc922885424861eea06b9fd19eb22b157d740facc383e9e2fccc2db93ddd35f9b827c7add02a4550cdb6da2eca466c6f7a96e7d23516fffc30
SSDEEP 12288:xlYJeXm5nkEUuE545Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkF:xlYJeXm5jUuEGYz7KEMdX6keYnAcer0
TLSH
T14775120C6A9D70E1F02E817EEAA14900D372B4A6274553FF85D4D1768F7BAE21E39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 357b670269340cd8b95def2936254e327a5eec01ef1d73aefffb9ea28f822a46
MD5 bab5452607080ebea6dacf0d82416eee
SHA1 40f1e7d907d724a66af92f441edf60ffbb9e736b
SHA512 b787ba9f5990fe55e2e4574b0a11070f3c0d8af097194d9225d6f86101d776e5bd043b53c681d27b515d1f1b7297a8814bda0b286215326b6446c5bc39f4fc61
SSDEEP 12288:2Cu6kyV45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkB:2Hty6Yz7KEMdX6keYnAcerk
TLSH
T123751204579555D1F8BA0639EEB28150CA36BC612F1483EF94C0F62F6F7A7E1A830B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 a0760b7f72937aee82a1daff3a25e5f89c1cea33d9faf6c214b97b257bd15e83
MD5 bb57bcb0559f4470b91af16648a92c35
SHA1 7034b9aedb316825552c70889465f19488cea8ff
SHA512 52ca20a73b2fc94c07defd3995b9fb75c37bab43689be1ee785b6dd9962620830086bb19e676f30432ba03ca4dff1b18abc0ee978b9acb77f85ce81c0b921710
SSDEEP 12288:SPW45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkN:elYz7KEMdX6keYnAcerk
TLSH
T15B75230C461B59D2F80A467BFAB14540C53A7ED63B5852FB98CCF562C7BE2A24431F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 77b8532e2645ebe3a341df6cd1cf2f730a1c93b1baad8f90421ca5ffdc85b247
MD5 f8511b3a1586212968360ab7305036b2
SHA1 251831ccf98af4f551f2702cbbdb5864aa597d96
SHA512 8b3b1e8152ab0bff6ad3a2c6f8b94ed18141d8290597c88f1ef0db8746836233041dbb78eb6d4d64e86b5d70f510111a93ae347495f2cea2da58c9a0138c655c
SSDEEP 24576:cC+TyQIu93VAumZr7jmAYz7KEMdX6keYnAcerQ:c/TfIq+YAYPKEnSG
TLSH
T1B4558D1DA7E91DCAE176C675C8A34493E633B872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 19b83248d9160bdf8b0d0e4474bfce1bbc4e6c9392428fd22dd2737016786219
MD5 5c23098066bfdbb83bcbfcee103a4531
SHA1 a023d6721abf66f6336aadcb5685ef2afb938a58
SHA512 b17ab7416a5dbd0a6cefd8c2513cbbdf7c1abdc516089285c0b3e6d446b95b6d908232b74133587612d9bf38c676df772886b240ef1784ef33f0f70d74f84be2
SSDEEP 12288:hcyrWOstaa3kcsK45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkV:ULQikZRYz7KEMdX6keYnAcerM
TLSH
T1F785F10EB7AF00A1E4ABC23DC9954101F6737475171263DF4690C77A4BAB6EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1abbb66e47b56ddf17a111b696f0dd05c631a4289762c3631c015288e1344f8f
MD5 bc5437ae30fc83ce4a16b59c70be1687
SHA1 9effa7826801ac9f69167f34a9ef3ff62986a081
SHA512 b964a82426a64e4359636beac97b6b00619f6054b326f1a2353266214485938c5d14821d4ac33cda93c2b172fe891d5556b267d3f37251358006fefc8347f4c7
SSDEEP 49152:/pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP6YPKEnSG:kpC7b4+80GTkzYPKES
TLSH
T115A57D3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 208071ece0d0714a481314f8dd3e7181d8493ab581aa2250aab5cd70c78eb8a9
MD5 fde89ad1aca12e838324c55f0b46b378
SHA1 044e9c4197a62bf053d58ca900e875e4eb275d50
SHA512 99064251407afcea0b9512c3606af8badfb63c1e787aa4ccbd0c4fd250c547d86d605a8a93ea4f63fc0c7d6c18b0214ce0b688a95c869bd76b86511ce40abf2e
SSDEEP 24576:ZSAwJPE1IDAo+4Kt+l44135UQZYz7KEMdX6keYnAcerw:ZqPCIo4Kol4/QZYPKEnSG
TLSH
T1DF55AF29A7F946E5E17AC7B5D663C601FB727822133163CF9290813E0F16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1328-0-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/1328-48-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1328-9-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/1328-8-0x0000000140000000-0x0000000140416000-memory.dmp

Download

memory/1452-310-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1452-312-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1848-320-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1848-419-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1960-260-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/1960-323-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/1960-263-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1960-268-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1980-328-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/1980-470-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/2000-245-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2000-314-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2140-507-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2140-378-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2140-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2140-410-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2140-332-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2140-338-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2140-394-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2372-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2372-420-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2376-13-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2376-232-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2620-40-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2620-34-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2620-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2620-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2804-315-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2804-418-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3076-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3076-31-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3128-417-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3128-307-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3792-273-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/3792-327-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4000-61-0x0000000001660000-0x00000000016C0000-memory.dmp

Download

memory/4000-67-0x0000000001660000-0x00000000016C0000-memory.dmp

Download

memory/4000-237-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4000-71-0x0000000001660000-0x00000000016C0000-memory.dmp

Download

memory/4000-82-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4764-280-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/4764-412-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/4796-249-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4796-319-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/4796-257-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/4796-255-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5180-445-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-440-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-438-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-461-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-446-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-459-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-447-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-458-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-457-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-455-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-450-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-451-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-453-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-452-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-454-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-448-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-449-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-444-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-441-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-456-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-422-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-423-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-424-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-425-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-427-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-426-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-428-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-429-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-431-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-433-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-432-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-434-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-435-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-437-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-436-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-430-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-439-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-460-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-443-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5180-442-0x0000014376080000-0x0000014376090000-memory.dmp

Download

memory/5232-291-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5232-415-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5232-283-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5232-289-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5292-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5292-51-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5292-57-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5292-59-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5372-278-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5372-421-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5372-340-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5428-301-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5428-416-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5428-295-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5428-303-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5736-26-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5736-18-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5736-17-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/5736-233-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/5916-80-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5916-83-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5916-74-0x0000000000830000-0x0000000000890000-memory.dmp

Download