089a63883a3186fa5a18d98a2013272fae580ec173e7fb59495d9d53fee5ba28

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_559fa80055286561b9d4dbe11d92c773_glassworm_icedid_njrat_ryuk.exe
Size 1.2MB
Sample260522-ryadmagv31
SHA256 089a63883a3186fa5a18d98a2013272fae580ec173e7fb59495d9d53fee5ba28
MD5 559fa80055286561b9d4dbe11d92c773
SHA1 0652d9479a2ba188572c13c723bb79f4459b0ba0
SHA512 da84f6c896c72a8fe84c20f2b8376e6bd62ed11841cb05830f6888bc549f36b7cc43072e5c6c1ce8ffaf6b0a608bc27a2aef42851c803fba3d32030be81380f4
SSDEEP 24576:XrObycn9MpkGJrWoXRDOVwZhAih9pf1HjnamWzRdaz/zdA+Pol:XrObh9MpkGJrNOV189pf1HWzRYz/zq+P
TLSH
T18745D117B39404F8D06EC27ACB269122FAB1F4454A74BA9F13A447612F37E585F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1580	alg.exe
2884	elevation_service.exe
2240	elevation_service.exe
1496	maintenanceservice.exe
3204	OSE.EXE
4220	DiagnosticsHub.StandardCollector.Service.exe
2588	fxssvc.exe
1776	msdtc.exe
4232	PerceptionSimulationService.exe
3936	perfhost.exe
3960	locator.exe
2868	SensorDataService.exe
3288	snmptrap.exe
4992	spectrum.exe
1496	ssh-agent.exe
492	TieringEngineService.exe
1312	AgentService.exe
2552	vds.exe
924	vssvc.exe
3520	wbengine.exe
5092	WmiApSrv.exe
432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_559fa80055286561b9d4dbe11d92c773_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ee94ea67f6d6c89d.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_169453\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fdd4f76f8e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f75c976f8e9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000743baf76f8e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3052	2026-05-22_559fa80055286561b9d4dbe11d92c773_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	1580	alg.exe
Token: SeDebugPrivilege	1580	alg.exe
Token: SeDebugPrivilege	1580	alg.exe
Token: SeTakeOwnershipPrivilege	2884	elevation_service.exe
Token: SeAuditPrivilege	2588	fxssvc.exe
Token: SeRestorePrivilege	492	TieringEngineService.exe
Token: SeManageVolumePrivilege	492	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1312	AgentService.exe
Token: SeBackupPrivilege	924	vssvc.exe
Token: SeRestorePrivilege	924	vssvc.exe
Token: SeAuditPrivilege	924	vssvc.exe
Token: SeBackupPrivilege	3520	wbengine.exe
Token: SeRestorePrivilege	3520	wbengine.exe
Token: SeSecurityPrivilege	3520	wbengine.exe
Token: 33	432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeDebugPrivilege	2884	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3260	432	SearchIndexer.exe	106
PID 432 wrote to memory of 3140	432	SearchIndexer.exe	107
PID 432 wrote to memory of 1096	432	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_559fa80055286561b9d4dbe11d92c773_glassworm_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_559fa80055286561b9d4dbe11d92c773_glassworm_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2240

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1496

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3204

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1000

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3936

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2868

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3288

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3672

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:492

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3260
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3028 3024 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3140
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3060 3056 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 96accbea162f6d670ccfb20c1bbeb4ed75d411bfccc6531deac91b9bf8257628
MD5 76e1d1dfbdd84cf1ca80ea2d68a9f696
SHA1 dfccf7d32779aa536cb046457995d02c8a2a27d5
SHA512 1530409870dbff7ee9af4caca5974140020f5dc0a1c94b6a9cf7ab873931ac29533b14f00d3d566c4b4082e2bea31bd917bbc9a5d4a27b67a9a0dca419895c5f
SSDEEP 49152:db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnR9pf1HWzRYz/zq+P:j3q6sjBk9ptHUkL5P
TLSH
T14FD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b9510af5ac50f2024933a81fbee8ff8112c5d9ba57ccbc41e94582abe507257c
MD5 5f16f316e846f5f922cc283c295c22ca
SHA1 e0c469a5db8cb2ddb73169ab4b17f41bbe6aa3f4
SHA512 b0c7f11242c705e8cf049f5a41592ca58aaa4ecbab92f057843e1397638ae64f92802758357cdc18744e01315060d605eac150d520da00310948fbbfe3253094
SSDEEP 24576:kXYfDtczAWh9pf1HjnamWzRdaz/zdA+Pol:Dtcj9pf1HWzRYz/zq+P
TLSH
T13D05F128B3D408F9ED6B827CC8A18515EA73B8454760F79B03E489751F336D85E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ff238726ba00f039364e8553bd861787bdab13ddf682741aa5723711d284ddbf
MD5 9b1577f8fce897f9e364770325d3b4d6
SHA1 4270311c942e476f313f540cd60a8f2de2c959e7
SHA512 1a8d37886630c8f693d759f27e25358bfdded96ec56e5cf70e017b5bd90cd5bf6b6946b532f00a0bb5b1d05eba71a8e03ca5489bf7eb32b194174341d97d6a26
SSDEEP 24576:N0Le5ji0hmxxrMfh9pf1HjnamWzRdaz/zdA+Pol:NPji0Aje9pf1HWzRYz/zq+P
TLSH
T1D1359E15F6788731D073C0B9C5D2A69EED7130865B308ACB4286C77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 908933f4f4a93f23422fd28d00da570cf9aa7be307cea6558f2df7a786946b15
MD5 e709e74759107dc72510dbc182df7994
SHA1 1cf65313ff665cb394803dc82ebb72f50463f4e7
SHA512 23397184ef3684a32feca461858cef2b4c64386aa8b6d5127c3340713264ca378b684ef98da54eaade79b1fbc7c5f9f0dfaa34b7fc0df533814da7158765a958
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyulh9pf1HjnamWzRdaz/zdA+Pol:J/ezSC6vUzPveHjyS9pf1HWzRYz/zq+P
TLSH
T10E755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 608b3604821c8a5716a051075fe025a36857e74c95b38cd1eb49b74bf0424f8e
MD5 3fcaaa7954d36662fa9d8329b9cd82a3
SHA1 7d1086b71a6896f4d846e85de8d01a2eb463dc62
SHA512 8afc33bffe8ee8803771696de39c73296d040dab027cc1f733c9281733c2e64412754a5eb20a3954b776dead8346ffa69744263047365f0018ed346c96030bce
SSDEEP 24576:3VbqPb88hv/l+Y6h9pf1HjnamWzRdaz/zdA+Pol:3VO88hXl+L9pf1HWzRYz/zq+P
TLSH
T199559F65F5B48331D073C0BAC5D2AA9EEE3234425B318ACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 0da383eca41c4975b30f718355d740acda70a617e707398cf41f384577bd6d1d
MD5 a60e88c70244f4e3c2f3ee9f4f579cb4
SHA1 3628a3f5c8aa1b608c30537955615d3d82930628
SHA512 9ab418cd3804934d2e233fbb0e8617ffa22823086bb5248ec1944ec16f4f684d2e764e52283302608097f033a281b1b5b45638c94775a38922930df4e2f0ae16
SSDEEP 12288:BLTEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:BLTh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1AFC42384F6CC28F2F7BF5779615C829AE9C2AC087C6072678966CAE94275C0DC91F533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c8900a27de548bb0195b4a783999e1db58f2deea186261c78593fc6cf065358a
MD5 1786bb3b0e165fd9b5ad6663b24bcdbf
SHA1 97572d7e90346a2d2b739a6118f454bde1eae8b9
SHA512 2bc6d2a58d68f194980771e6aae44fbba0296035a10966badbf26b2078056cef350bc28dd852c2b1b069beb989fabaa0e800a9c3b356974b6327beb50e8b2cac
SSDEEP 12288:yeBNUbTVO86UiEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:yJIUih9pf1HjnamWzRdaz/zdA+Pol
TLSH
T12F05CF6BEE28FCE2C27E4DB856518240E7A278304F61A3CBD175C20EDE235D55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cfb1304205d0db6fee0a4f4c4a1ebe1e09eea48cb1137b28974b0c0f1b6868ef
MD5 8ba5597cafa35df3762d6773e5cce857
SHA1 cd275a7c0bf8fe19136180dce5e98a62eea8ebd3
SHA512 6ef4eab7853309876cc318eb8ac2ec4b80e5049826025709845a4a77897b6558e83bb7c596297919a4c2671157f7660ae9492f1d55598c1fbc8ed5ff2fe516b2
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THc:1QvGAdlCEL8c/DRNw5CD9ptHUkL5P
TLSH
T13A267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 86958bc479a486c712da69367c94e55b4fa0383f68927d08f0f161ff2931cee6
MD5 7c4e55cd7917a2c16da99840c4f7d5ae
SHA1 4d299fa9eb83fe7cf2cb2e0112f649a1ebb984f1
SHA512 ef2462709bae087f2740f3d8967c5524ae6a6c46b8924d24170a44f5383f330a2e039c1bb6942c160e742d6b882533c4d2cf28502464a05b783cdb0be165a1a3
SSDEEP 24576:f0ewsAjAh9pf1HjnamWzRdaz/zdA+Pol:8ljO9pf1HWzRYz/zq+P
TLSH
T14215E031FE74E432D3BF0DB61B25C716546DB9204F612AC3E3A88E9D49306D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 49465aa5d1ded876d1cb6d00b6eda16daa60de266c1eb63cccaa37acb6dddea9
MD5 01f594857baafad0bc49bd61f07d5924
SHA1 76ba43091c328ea9c2fd77559aa035ecd3049fe4
SHA512 3f1dd6de93e2cb70d6541163c90894f8564c74e2484bee253e178d6aab24aa1fc22dd3b2d2493a889228c3ca241c560bf8d507a141bc0030653a6f345c1cd2c7
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHGTRL5P:rUEtQevvqc2W1cpV2tI32Q
TLSH
T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 27437a61deb0d78daee81125b31e1d77bdde7dd55f91523d85695c258607e304
MD5 79a318c766b07df73e30bec0bcca446f
SHA1 b5b91cb8630e626bce2dc62c9643b0cc06f356b6
SHA512 c2f2078c7ffdc13edea023be616473f1e9be64c6d422903b86a352ae17996664baae7e2f6f9916295de2ccbe4635596d9efe9bced8bdaa8d501f3e2d84b67692
SSDEEP 49152:HCbRquA/m2yL5zTfFiV+XenmE3/zu9pf1HWzRYz/zq+P:QoquVjnmX9ptHUkL5P
TLSH
T10DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f19ee20fd43ec60d482b8c8314b2f5a15aaafe56310139fec6b640fe5688230f
MD5 5202f57593c4161d25f7876c84471abe
SHA1 50a1b3df14a0d83ba7511e0f506d02557086fa2f
SHA512 9959935e9e156290a62d5071744c5b9e732046ced71b65c1f602a1c5c3baa8ed6dda85f5b900a20468859b0402ec6041ee68601b8ec40e8325b2415cb6a5d4eb
SSDEEP 24576:uAhGL3IFoiwtA5l7S53Bh9pf1HjnamWzRdaz/zdA+Pol:uAMUFoiq5H9pf1HWzRYz/zq+P
TLSH
T1C3359D81E7F955D4F5B3AA7899B68171EA76BCAA5E31D20F2160C11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1d4411c9ad09c9a2d7ffb5dbd305e40f4bfd092f1a9bd9693d979d68c105c71d
MD5 af0e252382f504e2e30e4203c3bf303b
SHA1 5bab69821c2e5bae4a73da959837139d6808c026
SHA512 0b8b679d4aefa5683de40f1308cca9fa4422bb535665b06979401e1b96476f27a8cdb700a862e7464ff7ef68e4251977725ba24f12b24d62362fed995a8f8251
SSDEEP 12288:Xmw5HEjsChNVBFgl0WDm+CFEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yx/:2wu4OWsh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T10D05F14976D81CF9E9A792398557C136F7F2BC022A21D71F0760C66B5F33621AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 62660f274b250710b5f5639ad30f1f40612f76cbef5c6ff2bbb121ee1a82fa71
MD5 dabe3f6aed0bf79bec730cd93adaa933
SHA1 e59a79562d12b32fb2bc9edd4e1660c9895e6d50
SHA512 04379130fb0fa422fc86af667e4acde54fdd83c60a673b637c69c19e4a600f73efdd8cee11c6919c8cb9e494d8f1633bdc4f9e2584ccf3353e1db3a7f71b40b7
SSDEEP 12288:OeZ1IywEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:TZuHh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1E9E4128973C820F6F2A7523CC5A44649E7A27856373153CF066586AA1F33EC95E3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ab4a2474a30d5f6e46097abf806b3563cbbda3424de08847c4360f8540b60544
MD5 2736aeeb74d16a032da65c6bd1f8f3f0
SHA1 0a141ad8b2c5b687950171520d318c99765be251
SHA512 1f57a516bec8be63a64da37bfffa00da28017d51e65852927dec404a9d4ceaa515f9b27991e2746db8639305b4196d70217587704f7f7a07cf8955cad6e91e06
SSDEEP 98304:HQRQyi36YOcPbLvw2gAf+PN3g9ptHUkL5P:WQyiKa/X+PNwTRL5P
TLSH
T166667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 427250b83b54d9eaa6637944d214b5c8c7f224accca95e8c673723e7aa7bc6c8
MD5 15106ce175c6cd0b0c88de92138595ef
SHA1 e42d6aff122c2015fe01866a8931fc651ce6f16b
SHA512 267e6241b14a0af1e24f05c9fe2ba693d7a2414f297df06e59cf4d34942ced9d563e44bcf469af4e80542ba3e49cfdd04aa5d41a2a8a0420582c4f2a1ddb35d4
SSDEEP 98304:kQRQyi36YOcPbLvw2gAf+PN3g9ptHUkL5P:rQyiKa/X+PNwTRL5P
TLSH
T14C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0132e16b7600129206233c328e09a36a44af2865ed769f738d8ce8fa9647d5eb
MD5 3fd1c55d1c16212c863ffb7893c5d315
SHA1 8b61a0410ba016878d57dc418932a12bee8fe37f
SHA512 f863762c994d2128ae105cc3c3118f394abb0b21ebd2891e1c6000fb7914c17a88c27bf51cff8c4558a1a17550c52c5be4e49c290699d65c80aadc35a770da40
SSDEEP 49152:768Qg55nhceWu7PNU3/e9pf1HWzRYz/zq+P:FthLRc/e9ptHUkL5P
TLSH
T13BB55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 293a37bd459008bc8099e2d7dc141e3751fd415cb406ef3bedf9bc5c881da1a8
MD5 bc0bf24627897c2a131879cb911c8911
SHA1 b2e82cbfaf4460c386d8d79e4eafc5280fe258c7
SHA512 3fdf807fcfbbdc58e09e5cb4613707a31109225615078be8c10a48b87d9991657672f6c52d47bab0cc6b11f553f2290bf0471dd278143608da23e333d9d03509
SSDEEP 98304:Cy5112gYy5azzVvt69nLKnhZV9ptHUkL5P:LLIHEWhPTRL5P
TLSH
T1C9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d8ffb912c524862cb20f62b21059a3b0bb001fac6084de27a54ce0c03077a7e6
MD5 bd056e3ac7890e655a2867b1c765daa6
SHA1 85a230cfe688663b90743f8e4f96a90771a179d9
SHA512 f39b40af2b6681d23cd22c2b3927740ca0f490478943f28a494cbe0187a5768ec65fa67e8ee20b9ed4ed528a3907f515d3998295d44f8508b7e853831ca436f5
SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glo9pf1HWzRYz/zq+P:Du6Jmdxd2do9ptHUkL5P
TLSH
T173D59D13F1D901E8D06ED578974A9233FA62BC490B34B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7db23916e1a228b2e936f21a6edd2d843322042f7840dc756739254e0a33384a
MD5 5d585df2bc9214f9659ed0e595f45fca
SHA1 6f6bb06726572ef41e23e90dd2187efe021ddfa7
SHA512 a54903bf477efeb6ddf3837aff48ae00b06289d1f9c33b97ed723e905ff2b31643b29a68d731bf7ee9addffa1b2aac62468fd8fdb5f584b9ae2cd065c8f390e7
SSDEEP 49152:R1hpsNoJpF1A63U44CwH7R4xc9pf1HWzRYz/zq+P:RmifPWRX9ptHUkL5P
TLSH
T131B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1f7e7b9167ff1f5af40e49b47bd918b5df6e73aefbf5acb4da4bb3550426af96
MD5 5829c86f68051379b20e41e338080ef1
SHA1 c0ca15f522c0adad9b222daca819eeac9c8e30a4
SHA512 80ed2c8be49a140dc6b77286ef2ebecc1cbcb6a287e0974d79461abecd35599e8237105f05d7bf1242712b49d743ea154880a00ac043087ad98d8d35f2aa5b32
SSDEEP 49152:nSuZQIY0Be2KcRVtOnks6NMHqB9pf1HWzRYz/zq+P:95dKii61B9ptHUkL5P
TLSH
T11AC5BF03F2E940E8E0BED67887659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a24ba4b5274114bfb19ccaf65d473f2262547a8b53bb88d7e57e94077f29ed32
MD5 8fc98e9395d0b5846969480844c9c9e3
SHA1 74b0588d2e0fcc77f00c1716264da2edb84f043a
SHA512 4bb42094c8d942be8bd26127844275d5d1d5f5bc10d5a67c77adde6acd05b486ed5f1447825ef4ea11d70334c43b3bf67744a2266adab7e8ff341cf1a1282266
SSDEEP 49152:lhtSn8EApI0fig3giDn0AP5wY9pf1HWzRYz/zq+P:UX2imph79ptHUkL5P
TLSH
T16495BE13F2D900E8D06ED178C7468632E962BC160B35B6EF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 8443d9cd858640ffce6fad6bc314287772034f882a12fd44620b1fd69e299190
MD5 692d8c678fa205cf12eaae12d26ebf66
SHA1 7f924f46579ce38c4294038fb2d57e508198f587
SHA512 748c854b91354eb1d3bad30e3563124b8a3993fa8a0aa53e998d29e68886fc1b7efe2a9cc3e39236cf163adeb9380e024b983015e723bd189493472d419667e4
SSDEEP 12288:tbEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:tbh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T161C42384F5CC18F3F2AB5779911883DDE8C6A80A7C6032A79A6BC9B54372D0D4D1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 71a4ccce67464d0264886d715567879e0793c90f8e6629813d844fc18e3c6870
MD5 92bf80aae6b5dc45848fd0a05a2daeae
SHA1 73b8b7d131e7f69fd85c3c05bb2383b7324f0af9
SHA512 333b5b4eced39e5ed51d16ef72239c667a5de47e03e967c0cac66b776d3824de8d3af750be54ad230292cb8cb2f1a7e49ab1b033c46f27bc7e9e78df514aa710
SSDEEP 12288:iEEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:iEh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T114C42384F5CC18F3F2AB5379921883DDE8C5A80A7C6032A79E6BC9A54371D0D5D1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0bfd52d5f5bd6e2ce80bd86d0e117748cc121fca0ef848aac017309cca767a95
MD5 17fdc1082268b34f9656befe5291f686
SHA1 4e5dc8667b4b4c26e263e9e2abe79b117e464a61
SHA512 ae53dc3d09c41d00b8eda49e8ac35edf10a61062c8361959c036f605700e3f5e004a112762d9b4522853fd8c7bdad945c05faa44df4a3fc0acde7eaac8bc23d4
SSDEEP 12288:wKEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:wKh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1F0C42384F5CC18F3F2AB5779511883D9E8C5A80A7C6032A79E6BC9A54372D0D4D1F9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9906eea5b7ebe16ff6ae9351a71b9812ecd8b942a1f7eab909893acc30322109
MD5 12103ad3396eedf531ce4eeebf81114a
SHA1 28ca6320cbe047fce537518d218130de83cdf4b1
SHA512 49ef4368c13215941e0ce223cb49e1845bbf03b7a257671bdaaa2f289f3ff824ea435e3e9354e5185110c3fad9700e87c9b40a83e9f64d66046cf3d9a1c7bcbb
SSDEEP 12288:rVhEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:3h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T101D42385F6CC04F2F5BB9379C1288299F5D2BC497930739F8A1289A50B71E4C9D3AE71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0503989bc415d17eb2f81aa3d5b0f556154a60d90ac4634278b7c88521a377b8
MD5 967495919d835200ef50f40d272fce05
SHA1 36420e0879b7c932d2312577128ce0e348cc5643
SHA512 3689dafedb66c5f2eadfae56b730ab53a33c0f48b86601e747ff926b214cf831927700a7949f901045e329853bd745c2bae5e2e339a3c61011816a602eb8fc5f
SSDEEP 12288:h5EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:h5h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T147C42384F5CC18F3F2AF5779511883D9E8C6A80A7C6032A79A6BC9B54371D0D4E1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 09c0fed6f1cd6cb015600acf6b605bcac41d92d223f460d5151c6b1e2b5a89e5
MD5 8f9664a20cc80a3118bf924a368803ef
SHA1 186a13342fe065460d90fd906b86c715b9853098
SHA512 156fb26c37eaa73481586fc08f80c3bd258abc5907e2e89696da9e6fd031f07442ecd825e00e97e5c67dd94c45b5f53f500dd8fe2359084cb952a9e64a21c9bd
SSDEEP 12288:EIEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:EIh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T154C42384F5CC18F3F2AF5779911883DDE8C6A80A7C6032A79A6BC9A54371D0D4E1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a49111b5d1fd1a167d0138d68781714afa8469eb623e2a4207215773838bf816
MD5 a8cd8f6fb19f47100ca530a2a1a85389
SHA1 69dce27c482f4d614c8e519f282d9e16114e833a
SHA512 829a6aa10f18db2090dd50246ecd30c5fb1ef27db0502235b52b1d3ee8938d5e0a0bd74f467d32a18267432d8a03f258f732d5ff7c0888b0dad083dd7ba1ff61
SSDEEP 12288:E8EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:E8h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T17EC42384F5CC18F3F2AB53B9521882D9E8C6A80A7C6032A79E6BC9A54371D0D5D1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 7a6f86311d79befa766f05906469332acc4871c039af97e53cab75cc53432ffe
MD5 b7b93c1b267a4a2feb4daea23e40ea01
SHA1 cd7eb5aa449c69e696c4e0f1d68056c23d14f787
SHA512 1d8332288017878a37b89e5261dd393546f1fbe078c10049f7f05346df270508e0fb05567bb834d8313f45076132a6447e0ad3fd1da79a47b12c982f6f89de31
SSDEEP 24576:bZMRzFVSOkh9pf1HjnamWzRdaz/zdA+Pol:bZMRzfm9pf1HWzRYz/zq+P
TLSH
T193050194B3841CF5EC67823EC9158906E6B2BC1A1A70C61F07B436665F337A11D3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 5f5d8a49a55d293eb5ac7b30fec1c928539f052c1127b06106a90b0f0c913866
MD5 edddc75adf2fe04bc342645db6fe915f
SHA1 a24bf26ce777ab9ac2783db2c685df9786572382
SHA512 d009ae46bf37afffa5664b892caa1ac212249e0181ed9dd1df0d16bc036331e88f06239185c82ba902bf8cb1a27d4aa4f6792ae023d47a2d9734bb060cfccfbb
SSDEEP 12288:03EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:03h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T19AC42388F5CC18F3F2AB5379521883D9E8C5A84E7C6032A79E6BC9A54372D0D4D1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 16dd4cd540c43a3c4083a8cfb7a7e3dac0d5eca0c3263e08b6acecf9aa730675
MD5 3ca3fda919f41e236cbc6e58279c8cea
SHA1 c022dce27d69f80ab05963ebb63a17879b715e99
SHA512 4abc1f511b66e6437eb46a05a5fa30320c0969e20e9f2ba05bb1154d3609531c18eceea8a989ceb0f50659865785e0ab8fec6767d51674bf4883670c1262ae37
SSDEEP 12288:pDEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:pDh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T181C42388F5CC18F3F26B5379921883D9E8C5A84E7C6032A79E6BC9A54371D0D4D1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6c91878e280485e877e544a0786549d368865e9cb6e246995aad8fd10dc0fa5d
MD5 44095947f7059b450c47b666df0683ca
SHA1 15424947a7a09130c3b930f4dbdc80db8c2678f0
SHA512 b676e6e46dfea3fa315fd0b19acaac0b606f8890862fce6fd88b092abf96c3261f80c67967fa3e29c7bacb0582efc925a9d591684eb5d9313907104b08b96d5b
SSDEEP 12288:/3EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:/3h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T129C42388F5CC18F3F2AB5379911883D9E8C5A84E7C6032A79E6BC9A54372D0D4D1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 41138365a0daf0d60cfa8ea793c6bedda2eb62af69129d4fb3781f9ad1164d3d
MD5 7ae6b6fdc7e4c381cfca81d3724bf7f8
SHA1 eea67f843262bd0a801a99b0fd6626ef22f59261
SHA512 b874c183c3ea96dd2b4779dd6515400b2ce224d1f43ff39168eb86b18ee16cc3ea7de0372dad6a2f493612a456699f86491a57ec1dae1afbb45fb39ec6bfadc3
SSDEEP 12288:U3EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:U3h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T163C42388F5CC18F3F2AB5379511883DDE8C5A84E7C6032A79E6BC9A54372D0D491F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 ba17ba778c0cae5cf409c80141044f1fe15edb0437026aa6a435b351439d170b
MD5 d432b390e8a856f7f558a88c97ac1342
SHA1 177a1857812ebdf5a6c32ee9277eef31a2da0a06
SHA512 8e91dead10e47fc96ba33e19e331f76f0d4e61e65df20a246adc29c294fba7547b5420e9ecc2a5d9633a0aeafa60f48bb5015ff59f093ef79d97b8f247acbf6e
SSDEEP 12288:TyPz5L8wEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:ezywh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T119F40247B3D430F9E177923884550A46F7B2B8361B309AAF176446B61F33A949E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 55cf47d5b609ba18b53951719d6812a140f2634414aa2d9738e6cb1758be5c89
MD5 276212aeb64d677b5a94987ce6af4655
SHA1 a8d472b01631ea9e5d4f33e3c36e0a2928a1c8e8
SHA512 080def5202e60a429c43343156a8f4ea202a027d89653e9bdfdf3c92185cc8334ed6ccf562c0bec5cdb3c502d07f6f9196fa8e936fce5857e41cb550c85619ed
SSDEEP 24576:NTDaLl3z0zDah9pf1HjnamWzRdaz/zdA+Pol:NTuLljT9pf1HWzRYz/zq+P
TLSH
T16F050194B3841CF9EC67823EC9158906D6F27C1A1B70C61F07B836665F337A11D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1627f65932f45586be68885b17424b5abf4e3d8972fcea1a0a20f86fa8e70885
MD5 b246ed7c8640c0d9fbfc846dbef262e4
SHA1 1814f1b64f3aaf49d96431c2d1fc32a2ef103582
SHA512 78917e80d25a58b827337b5c1e88cb7c334e5aa08c55ec67ad187fc3b825212a9e3b795bd0a366f813117fb9471a30d8081a619e061dad2b013cb4e5a584d261
SSDEEP 24576:f3vd9CHKy7GZeh9pf1HjnamWzRdaz/zdA+Pol:vvd9CHKyam9pf1HWzRYz/zq+P
TLSH
T13425CF90F3D814E8F0B79A3589764511DAB67C5A1B30DA8F03A8665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e7a425c598e2335dbe3c78ea70c7a48e0411002054d9a5c52af51abdfae77360
MD5 2b87e5e4abd56bb85f0f839f3f08e0cb
SHA1 d549f644348a4dc3a53c7ade1307696993c0892a
SHA512 fa53615cfde2da2beaa9b6368aa62aa9efd2c37598bc38a94482a51dc68f378fc0176e7f7641cb00581dc3075052d3b9e1682f64b30ef47f0647b4c02ef6fede
SSDEEP 12288:4qEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:4qh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1D9C42384F5CC18F3F2AB5779911883D9E8C6A80A7C6032A79E6BC9B54372D0D4D1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 5ae8365b6ceeb2d5e8a2b5c7a6563a5dcdba3c67445d98886f6049308cdd0323
MD5 9ae7c88e71f6fd8f08fd1e499c4eab1b
SHA1 22fa0e454f4ac2b813d1b56aa6eb9d6a135f4983
SHA512 91f1fcf6e41130ad882ec012b2079c872af973f13bc12b071c482dfd75abbd1d27f519683f6312659e6f780cad76c540b66e0d43967a42517f9066bff1bc6f29
SSDEEP 12288:gQEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52P:gQh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1F5C42384F5CC18F3F2AF53B9511883D9E8C5A80A7C7032A79A6BC8A54376D0D8D1F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 938ba1355fce656033bb37e309a2928b4d78e3504e94195babc9c518bba1a5f0
MD5 144c611438dd2fc91524b454374b95a2
SHA1 312110a9682035f613d8e40b344ac6ac3cee4147
SHA512 d96badc2fc1b36d10e2953f0f52862f24a3869585c3b09f2fd275e4a4b36acf1aa5143f3697c2ca7647a81776de27cde2f0d5f8336b660417b10d80ad8a07e38
SSDEEP 12288:S9EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:S9h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1BBC423C4F5CC18F3F2AB5379921883D9E8C5A84E7C6032A79E6BC9A54372D0D491F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 bb9b02de58d5b99aa62b3bc4577245cce86ff37cf9c791f4356e744dc16293f1
MD5 1ae5d5ad487d51012825a8e279de3545
SHA1 c9f2a711e8b178c9314d786798643df1530299eb
SHA512 4ce48ac96c388d84c5beb0b017f8e882b2afe085039dc9c5df656526caef6476cee33d0b44f5bc87b30163f17d535d92f323a93524cacd64a16615720e99f867
SSDEEP 12288:k3EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:k3h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T171C42388F5CC18F3F2AB5379521883D9E8C5A84E7C6032A79E6BC9B54372D0D491F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e69a4ea1a9a3b1b0c9145c549af40c3300b887210ce18bd9f89afcdac5eed037
MD5 5aecd7a7b1ef48f326b64194333dfecd
SHA1 3ffc32674b1dba21f885f4678d440fc7be6d7d1d
SHA512 dad4d11ab589f4a4a8c9c0502a62c737a8e6f4206c7a02ea2d0de3636f219fd6b23e9c6a176a79bdf66905777454dd56cd08756b50b00f40fbcfe42927d668c5
SSDEEP 12288:7bsfHEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:uHh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1C0E40149E28802E9D06F6279C3554681F3637C2597E0E3CB56D0F97E0F36A849DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 71ead0320b3b32c057ccc5d794988447f7e0d816e9598b40fe372f656db3688e
MD5 ec128fe997bff0b2968e777b7ddc3127
SHA1 3b1ce08f5cb1ed32b4d370f687f3f16ccc2ee767
SHA512 35466702c8288877ca87ba7b42456e319bd8466d08178d78a8cc7370e4cf13b6f86762ad70235d840a24b9ad7dae8fb23d19e7c08e5815adc78949f773930986
SSDEEP 12288:UZEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:UZh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T138D42384F2CC5CB3F5BF6778111C8269B58AB8097F2061D7A916CAE54271DCD8D3EA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d6a22fee6181e06455e7af2a254a75eec06e5fd34ef92dd08c5bbdb699fb74dc
MD5 9365adb497c881f748bb8042a4c18cee
SHA1 34a9e68196c2b2e5f7b64b91e8637919eac65616
SHA512 e782925d603fd8f407256b781d7ec2df0fa557a43b724fd6cee12ee5f81206b90e7cb543806083372f96f0c82fa470e2e26097e4312f642124d4a683f40d391a
SSDEEP 49152:NRZwQCyiHiQEaiPnM69pf1HWzRYz/zq+P:/9xPP99ptHUkL5P
TLSH
T10685B01E62DC46A5F0BAD278CD674407E6B278165731A3CF0291C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 032c93b4f26f54725ec443b35d27ed44ce34738efd3a94d94dfb5cedc363650f
MD5 feafd708bb81fbb1bfc4fd0d1a8ed552
SHA1 07dea96b10cbf602de03a841171161253c3786af
SHA512 010b99fc2552ca2d6574764664fae8f49457f43438d6386a0079fcde461ae62a362302fa14059c88462972b88232da3e10c5cd35db5d62e01cfc17c66b010add
SSDEEP 12288:KbxA1U7KpEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:KbxA1UGph9pf1HjnamWzRdaz/zdA+Pol
TLSH
T100E4025DA6CC18F1F17BA23D85958205D772B81A2720A3DF1591C2BA0F37EE85C3AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f7739e118190bae1ef5b1b274116aa075da33afd6a9601182ca6f671f838593a
MD5 606439f2671a1ec3f398c636f7020b95
SHA1 5d5152f2d699314e61cc08241554294dd6726b18
SHA512 71a98504eb4573fb5d50553e27ffcd16db9eeb88428e9bc5f4b81c234840f2990133a1c051f6f102994c3416c2fa5474cc7c69af83437f5961e64c39fa755abe
SSDEEP 24576:zjsmP0yHaqrVqHra44KDzMsrnGh9pf1HjnamWzRdaz/zdA+Pol:zjRP0yHfVqzlAsrnI9pf1HWzRYz/zq+P
TLSH
T18A45AF2EF2B910F9D4AAD136454507B5FB71B42D1F209AC70170C634AF0AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 318a024ced0f052bf8735b3ba29ca758da030180502fd0c29c44360c6c540c22
MD5 fb1eead433872831e74ec79592f35d85
SHA1 172b26abb51a06852681581d70e11616c5e3e3b6
SHA512 56f84e8242b1ff03f8a9160622e6cb98f1613f3f2959c0aee6d25ef0e4728fc9b652499611f7636d4ed6064e1d802214e34b6f59000f76dc4473fde3d0e7b43a
SSDEEP 12288:1vEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:1vh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T188D42388F2CC18F2F6BB577951188299F485A8093E3032E79867C9A54375D8E8D3F972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 15544521267ab1e5b701e16c20bd928836e5c020553ed5932fe249d184367e6d
MD5 8bf13ec4e78085937ab194b3e18517d2
SHA1 3de619d60ae7de416b324a618fe381d5372f420e
SHA512 7fda40eccc0a3033acf5f9843d3d57c9086ac0feac7ff36bc66fe176038ba4d1d8735695a1da9d3a5e6ca448a4b497b9236b109b6fe1d3cdf6ecd820fc777c9d
SSDEEP 12288:+ObfA4LWO+vAYFT1EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:nbLBUT1h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T14D250144F7D800F5E97B823CC5668616E2B2B85D1760E7DF03A88A651F237E54E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 3efcaa1833438f726b5dc9e75122aef57f829dcb093c1b6ee08f5c768e3c6fd8
MD5 c406187f3dc0b1568451bdfaae0fc3f0
SHA1 0ea534e460ba5dc6f77872d0463aaebad66e4bf6
SHA512 111ad1084e3195eac7731ddb5e74e3739b81f5d12fab1e212fc717e8e1b3f95b6e76f71a6aa374cefefa9eff707383b0d2621178e03ecfea28483a57910e69c2
SSDEEP 12288:270Vm9IYNvUyBpwEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:npYNHyh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T18A05F11EA29C1CE5E57BA17D86828209F2737856171192CF05B0C2BA0F27EEDBD3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 55a742d3db4c166ab092b49843c74097889d1c6b8a59b28a2c17775f9ffcd248
MD5 f9a2f882abc7ca2b605eef040dd33193
SHA1 6e0dbe9600762c39b87b159311526167f60045f9
SHA512 1ae45f31b02303e42b2297054166cfe9528b5e44205a8d29394980a5f0a40db2c28e9fda29ca52439e8ad97422c4eb0252b6ff46ece53c721404015743714405
SSDEEP 24576:xnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKs:xnXoJJYH84VVS6AmEOJas+cHBjSSKHPZ
TLSH
T16465BF9EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9b25ba232f4ad0cd1535e4544022115c45511a0ec3990cf147f0599af2a34c9d
MD5 d8bbab99394acf4154894e9782de8096
SHA1 2cdfb206757f599d7ccaef88e425fa2ce129837f
SHA512 c971143a91e60436823e7a9b0d0dde351f722d4505a7979d0d236481a6caf06a9d4cd23b9171cac594847621c42d8d3d211e24e51c5bd67054ffa2b5d812a201
SSDEEP 49152:0DLL9TuJ0M/TYj2Pp9pf1HWzRYz/zq+P:X99ptHUkL5P
TLSH
T1A3858D5EA2EC42D4E0BBD6BD85B79146FAB2B855273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 bd25aa6ef2e114d695be4377707e3567d99e5a2f2b11495832ff2cf94340936f
MD5 c14532e9f705e77d77e4596b54d5d7c5
SHA1 721e889bd107b0b8c2adbbf224f054d8a875158f
SHA512 698df2cc3303730707bde8e22c9936cac1af7e883fc8b5662e28d5a3a434abc87a0dea48669a01bfca96df80fa599338f727f3a7654db4aa5709f45c170c59f3
SSDEEP 24576:iegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w1h9pf1HjnamWzRdaz/zdA+Pol:ingOJOmPOHzj9pf1HWzRYz/zq+P
TLSH
T1E555CF2FB7BC15D5E03FC17D8A968916F6B1782613255ACF0160827E5F2BEE42E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 ad1d92def8e9dbf78d516228f13f7f43054431dcdb3020f3333340a723939347
MD5 eb5b7ea074081ec0e3b2a34e0698197e
SHA1 2123376e83eb4ec13593ee2d41823db2973a9038
SHA512 f7cccab9eb190d4424e9de83c6af63a9987860acf85ae54cda59e85e9838245ebfadbd5ac25b4303e8d0ec5853c2e16676d8ff3a54db2d4c5f064c8a53078434
SSDEEP 24576:SLJnJiTk3R3waE4JrOPh9pf1HjnamWzRdaz/zdA+Pol:SLJnJK8R304l49pf1HWzRYz/zq+P
TLSH
T13515D06CD2E810E8E4B7C2B4815A1796FF71346D2B2169CB59B4C5313F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d16451e061167f3265e2a36c0fcb5a1d14c45837634f715334808c0d4b34840d
MD5 79e177f928529f282cb5414315e1091f
SHA1 971b6e06e9fad6098af3da0ef43c31eaa702c9f2
SHA512 3103f32c11b6aa76d10d2526647cac589bf8b88d32116527f871eb1000b92fe840a8b7e0a6e548d288ed955c584d52644bc87e6b320d061e62fb50555a44a972
SSDEEP 49152:Q9mqCzDScAZmlvTcFg8Ph619pf1HWzRYz/zq+P:Ss9ptHUkL5P
TLSH
T1B3955D05F7EA5298F8B3CAF1C96694159B327C409B34F7EF0A80C96A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 2db65b69a284768d0a96c8b7be3f11b74288d89ab51e7a479074d96b0a3128f2
MD5 ad4c1cf78c545dcc412b9e6c3f0b28eb
SHA1 b402fdd976e0945e4376eee16e2a5a1f6b6fa49b
SHA512 2c77cd14580c9711896a8445baa09afdf2f807919dcb5963ab27938d1a010999fc7762e252af7079c117451588318e03ae0d439430c2d5f040e27230669de259
SSDEEP 12288:blYJeXm5nkEUuENEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:blYJeXm5jUuENh9pf1HjnamWzRdaz/zg
TLSH
T1A8E4128CB6CC30F1E26F927D91958658E3A2B065271123EF45E0C1BA4F76ED91E3EE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 329be0d787f53812037be236646c91a20ef74fb0dde224df68fae42d2704a67e
MD5 77b9fa091bb90aecc86a6bf032a307f2
SHA1 076a3229c5923d69d0cf4c493348538d80685c45
SHA512 1b8d061258e24f306bba871577f3b0bbc576f1ece8e401e716e5f13a055d705591f21ce6eb0a726c88b5e24b5441625c1451daaa37168fc9a651c8b9b3a822c1
SSDEEP 12288:Zmu6kymEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:Z7tymh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T128F41244B3C824E5F6BB063895628294EE65BC146F2053EF55E1D63E1B32FC8AD35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 1f402f50793289f538ac027ad3f30ec32f2a2eae9e5afbbb1a5e99689a791431
MD5 0481306c256564db4148e6897cf1e92d
SHA1 9d6b9918d87974fb8e89bf1c14dec18da1d6fb0b
SHA512 b3bff8b97420974ef7bece6f9f6330668bdafa60c154fa972db14d10cb9f7bef78675895c383c5925eef5e4138cc94cfb78223493f33920cab37a7ef69dfc91b
SSDEEP 12288:SP1EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:e1h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1ECD4238CF2CC28F2F57B577851284299E585B8183E3031FB58A6C9B58772D898D3AD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b86e4e311c8aef59b8ac8032d2422b5b811b9903b0b5c7798519aead16602c34
MD5 9da4b330a89540ac62fe409532d17091
SHA1 38ac8e652cb0f9ab645b6917e59e01b5e628f019
SHA512 9adedf037879a57c6ede177c66bece4a36d5571a7f76e44eb09743fd3df21a7522eca04e828ac0cf702430d27003c649d232fcb9b2d57618321e51399cc745f3
SSDEEP 24576:BC+TyQIu93VAumZr7jmMh9pf1HjnamWzRdaz/zdA+Pol:B/TfIq+YS9pf1HWzRYz/zq+P
TLSH
T1E4558D1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 26a1388a1ee713dfd18668836678cfbebd4bd85c7cd5e6670672ffc4402e3449
MD5 631450418f739f886785ed094a1281d4
SHA1 640ec3ef3264cebdd15f04b8d1f22e89748c9899
SHA512 28201463cc5a5098039cbeef0dd15d8cb5dbf9716a5c81b09fd139e4b7c0152a8fdcc13eb257c40de4ff5283af22f7ce2ee7c5814ef804b5b673c6b67880d332
SSDEEP 12288:ScyrWOstaa3kcsxEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:jLQikZxh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T186F4F10EB3AE00A6E0BBC23C84454256F6B37435572263DF46A1C7790BB79E9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ed05e9f775623fb500eccf5e36c3c46a920e24a3d349e7e909581c7d3bf35bd5
MD5 5024a531bad93b11a9de0e7fc4fe57e1
SHA1 0f288a78ad795ae917375eb7401f7ccc49a1076b
SHA512 8e74001d3686a0f224aba7746ac2e87c840296d5b706ea172717e83797e02f27b22d93a21fb9a961b6cbd4349a19f727d400da775726590a42c2370829304dc0
SSDEEP 49152:6pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPo9pf1HWzRy:XpC7b4+80GTkd9ptHUkL5P
TLSH
T161A57C3DE2E810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-454-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/432-434-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/432-537-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/432-506-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/432-431-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/432-470-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/432-425-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/492-513-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/492-358-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/492-349-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/492-352-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/924-395-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/924-390-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/924-515-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/924-397-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1312-383-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1312-362-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1312-368-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1312-370-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1312-372-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1496-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1496-337-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1496-64-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1496-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1496-52-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1496-343-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1496-512-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1496-61-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1496-344-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1580-24-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1580-25-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1580-16-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1580-212-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1776-269-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/1776-384-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1776-259-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1776-263-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2240-40-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2240-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2240-228-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2240-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2552-514-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2552-385-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2552-381-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2588-254-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2588-260-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2588-262-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2588-248-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2588-247-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2868-302-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2868-308-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2868-516-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2868-312-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2868-433-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2868-518-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2884-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2884-29-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2884-227-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2884-35-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3052-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/3052-0-0x0000000140000000-0x0000000140139000-memory.dmp

Download

memory/3052-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/3052-13-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/3052-14-0x0000000140000000-0x0000000140139000-memory.dmp

Download

memory/3140-526-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-524-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-522-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-521-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-525-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-528-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-532-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-527-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-534-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-533-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-523-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-535-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-538-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-530-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-529-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-536-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3140-531-0x000001A745860000-0x000001A745870000-memory.dmp

Download

memory/3204-229-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3204-74-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3204-76-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3204-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3288-322-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3288-508-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3288-320-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3288-314-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3520-519-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3520-408-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3520-402-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3520-401-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3936-285-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3936-400-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3960-420-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3960-291-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3960-299-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3960-297-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4220-236-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4220-242-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4220-348-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4220-245-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4232-274-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4232-282-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4232-280-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4232-388-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4992-325-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4992-333-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4992-331-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4992-511-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5092-418-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5092-520-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5092-412-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5092-421-0x0000000140000000-0x00000001400C2000-memory.dmp

Download