54c6d22b4604af38faaf55507bfe95b03b67649e1408ccaa098f95002dda88d1

Analysis

max time kernel
145s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_ca21385029348f22d678cae7aa81f638_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 11.4MB
Sample260530-tbd5eahw7v
SHA256 54c6d22b4604af38faaf55507bfe95b03b67649e1408ccaa098f95002dda88d1
MD5 ca21385029348f22d678cae7aa81f638
SHA1 b6cf5793bbbd75bbaad11ddd82e4f698f6b63df9
SHA512 d9160e0db7b27f1ac6839189088aefa16575d5dc619b292f6c99383836dc4b2f6b345a8788b616e6cbdc66ba67103fb23deeeefd93fa9d753574ae6e42ef3afc
SSDEEP 98304:9azWPq96A8C/Le5M/tZwA8bUg1VVihiPxoNaioDw/z:9aiq9N/Le5M/tZZ8bUYVVHxoNaLA
TLSH
T1B3C60606B7F951D8F5BAD674A977662AEE32BC618B3083CF1150560B0F32ED48E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3992	alg.exe
2128	elevation_service.exe
4188	elevation_service.exe
8	maintenanceservice.exe
5036	OSE.EXE
872	DiagnosticsHub.StandardCollector.Service.exe
4456	fxssvc.exe
2552	msdtc.exe
3252	PerceptionSimulationService.exe
3128	perfhost.exe
4944	locator.exe
3952	SensorDataService.exe
3392	snmptrap.exe
1420	spectrum.exe
4688	ssh-agent.exe
5096	TieringEngineService.exe
2420	AgentService.exe
244	vds.exe
4884	vssvc.exe
1500	wbengine.exe
1600	WmiApSrv.exe
2064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\367ddd19f6d6c89d.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-30_ca21385029348f22d678cae7aa81f638_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_169453\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_169453\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a887d924cf0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c92aa5934cf0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8e058934cf0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2340	2026-05-30_ca21385029348f22d678cae7aa81f638_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: 33	2340	2026-05-30_ca21385029348f22d678cae7aa81f638_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeIncBasePriorityPrivilege	2340	2026-05-30_ca21385029348f22d678cae7aa81f638_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3992	alg.exe
Token: SeDebugPrivilege	3992	alg.exe
Token: SeDebugPrivilege	3992	alg.exe
Token: SeTakeOwnershipPrivilege	2128	elevation_service.exe
Token: SeAuditPrivilege	4456	fxssvc.exe
Token: SeRestorePrivilege	5096	TieringEngineService.exe
Token: SeManageVolumePrivilege	5096	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2420	AgentService.exe
Token: SeBackupPrivilege	4884	vssvc.exe
Token: SeRestorePrivilege	4884	vssvc.exe
Token: SeAuditPrivilege	4884	vssvc.exe
Token: SeBackupPrivilege	1500	wbengine.exe
Token: SeRestorePrivilege	1500	wbengine.exe
Token: SeSecurityPrivilege	1500	wbengine.exe
Token: 33	2064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2064	SearchIndexer.exe
Token: SeDebugPrivilege	2128	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3244	2064	SearchIndexer.exe	106
PID 2064 wrote to memory of 2672	2064	SearchIndexer.exe	107
PID 2064 wrote to memory of 4132	2064	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-30_ca21385029348f22d678cae7aa81f638_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_ca21385029348f22d678cae7aa81f638_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4188

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:8

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4952

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3128

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3952

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1420

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2252

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:244

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3244
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2820 2720 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2672
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2816 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b55f1806ae6731b990f5793f1846be498496574ce8a7db2f4f3bbd36bc740fe5
MD5 c6415e2e4b1cbf44cc4f2da8859862fc
SHA1 fa1d897487e88d7fadba16c17b0865d162462426
SHA512 a3cf204df380ee8f08eb75ed0437426d94a4aec833dae10624a5dd5e45ada188d79056ed00528ce85c88f77ccdb02c80d657030e4453bfa57f55d4a14a10d2c9
SSDEEP 49152:Kb+632BuPkFKRrdE6ohQstBhuXjfS4LWxncDYf5zaCpXxPuR6E9dA:83q6tjBLoDw/z
TLSH
T1F7D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 49d4ca21fb088b1c4e9ca0042f3a8b14a743c28009db7d26f1e7401160cfe173
MD5 f6a11f46be5977611793bd878b96875c
SHA1 aa0c794080d4b0bf80d18fb9a235b5960cb6d86e
SHA512 91741b83fcf360aa160e616b8a783fa34093b93cb25e86baedda72cab5ac1be4fbfa7832d24752ed0b17ff46448e8bd5e0a30839580890640bdb8edfd1571c19
SSDEEP 24576:DXYfDtczAY0Djsf9nz4mloFQnpXUMPQDR6q79dA:GtcuDYf5zaCpXxPuR6E9dA
TLSH
T15275F129A79404F9EC67423CC8A2C111E772BC5147A0F79B03E499665F337C95E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6eeb8210eabe72501fd05760c3de8c3edcb1980259a5c55200e81f561ef887f0
MD5 fc369d52f928443086a03db9c5397085
SHA1 ca162cdc97b7cd17cf7520d01d229ed1c3922a71
SHA512 f4db403bf09bc0998eaffa74a011c63a65bf2bf84abe1dba56254d9d24aef8443739f6775cdc127147f9b64e27d0699d248c545288b402b78b6428bcdbf105e7
SSDEEP 24576:z0Le5ji0hmxnrMX0Djsf9nz4mloFQnpXUMPQDR6q79dA:zPji0AxJDYf5zaCpXxPuR6E9dA
TLSH
T10585AE16F6748331D073C0B9C5D2A69EEA7130825B308ACB5286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 31c1c0a8a2d6e0d7bd98e9e814fbc338b85b3339de35a8424bb0e8b83dfa3dbe
MD5 9ceb4750eadce6d9a234413806f3f277
SHA1 15f6bf7d4e139b6548754287c2342286794d99aa
SHA512 fe7e4f8a9852eaa767288ed773694623ca6cd2cd20f3a260676228a961e6cc4b962c83e2788f7eba128c4525c59c61dbc27844c2fc86aec6115a6ee15bb7b488
SSDEEP 24576:7a7/ezSC6vUyDZaqgrvWx6q8wyu50Djsf9nz4mloFQnpXUMPQDR6q79dA:W/ezSC6vURPvMHjyVDYf5zaCpXxPuR67
TLSH
T14F756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f3d5b88868701a997d561d81c69934ea97f23449b1bba9fcb97574e91a9f0fcc
MD5 e3e0c5c2fdf09f3b346b6bb348ff74a7
SHA1 09366fa07031d2361ddb1898bba1e8e804a946c8
SHA512 cb9fd88648cc5a99f3e367adcdaf78c026cb69199759783e220becc555502078f983b141a0464cf8821ae832144fe89c7de8885d734a0d47aefc99edbed2bdd3
SSDEEP 24576:1VbqPb88hv/lV7s0Djsf9nz4mloFQnpXUMPQDR6q79dA:1VO88hXlVTDYf5zaCpXxPuR6E9dA
TLSH
T15955AE66F6748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8e5248a6561e3036e9f5142a2417caff812b331aa121f278005ada71aea8e6c6
MD5 88f7cbc7a43a91fb3d2ab6443f5d6dee
SHA1 cefa23fb0c2e7bcebc8ea7906a385d4ff5f27596
SHA512 8c31ff1277470e06f4ca5fe0eafbd61e35a9b3064527be2588cf11f63b3181e7c8637bdc46e3402224a9a7612f57e326d47847457cc58d4d1324ef0556749f9a
SSDEEP 24576:FGb0Djsf9nz4mloFQnpXUMPQDR6q79dA:XDYf5zaCpXxPuR6E9dA
TLSH
T1CE55238ACF0851F2D4722F3C28B1E225D3D4BE207DD53E6A77A1E68A8C7474BC4A5587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 059251144820126bc66651e89c72d6206d25df3c9b9ea69f7f946c918fa3dbe1
MD5 4fc57b56bedb6fa94a4f98581ceb67b9
SHA1 3a83de441e50c76457627a824ddf46c78b5556b0
SHA512 1888e7350cf6f367d7a6824b764607f77e87a017968e1b9b6dfadf53a0e6d834031a21501d05bc5509979ec79b58a1b16f55b813737d9ae60d157c02c7a4321e
SSDEEP 24576:tJIU00Djsf9nz4mloFQnpXUMPQDR6q79dA:tJIU3DYf5zaCpXxPuR6E9dA
TLSH
T14875BF7BEE28FCE2C27A5D785A91C200D7A278304F62A3CBE165C20EDE236D55D79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 39c95ab43d6322d39bf58039a834d6f3083373e882c00bb2d06df22917e6b97c
MD5 c683a1260c7ee9042fe3c123772cdaf5
SHA1 c2c301b1eb1ef91a820e043e00a04ec63bf593c8
SHA512 d7c708f2128e52d8c1504d6cb356c817a79bc024d829a48d293ea25633a7602e4d226a8dd21acab5e67f21f09a0032e4bd9bb3b5d1a06603b0ad9145fdfc2a16
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THE:MQvGAdlCEL8c/pRNw5CgoDw/z
TLSH
T18D266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4429dbc0b4f928b0a8c7a2016a372caa218e39c3325f6218a20eb3b99b05a1f8
MD5 b3fa3a50f407a40637feff0841fe8d69
SHA1 bb3f12e88a164005221334612092e0b545264a27
SHA512 c669e3c43f7afb9e6cc9b59e579af0a845d40326bb1441d3bf0e5c7190673d8f80a3877d04f38612aa49fe568dd2f2f3e5fe41b0146f639699f48ea06591adfe
SSDEEP 24576:EwewsAju0Djsf9nz4mloFQnpXUMPQDR6q79dA:9lj5DYf5zaCpXxPuR6E9dA
TLSH
T13D75E031FE74E036C67B0DB51B35D716546CB9204FA12AC3E3E88E9E99702C26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9cfef7a2e7f68b2639c296cc98c295b34f938e59e898c7fb47a533270eaa36f9
MD5 ac02fe810926c9d525bfcdbe3969f983
SHA1 a5e05cfc374e4ae725232c7a456f85d966217763
SHA512 8b200d4b66013214299526a1b0846e123979eea55ed2c5b992319e27a543ff3d44073d00fb587361c2a8bc88497bf801ca7ac7a00fe4f1652e2cf954c10be114
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH+A:lUEtQevvqc2W1cpV29I32+
TLSH
T1DB474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ca8fbb6d6031802a630148055e754448804e43f1efb2595a3ba5eac70444bdab
MD5 6620d8bb9db5a2caf5eb7029b04fcfc9
SHA1 455d57b888f4105805e7064393456339889f5a4a
SHA512 b5eab38e95756a41f52163255241f62cb9e587d679f3984e6ba4d6a89ae9b0aaf2495fc3ddddf62da9c49ea12ccc9cebccb124e18c5910f5934d761d53d6734e
SSDEEP 49152:QCbRquA/m2yL5zifFiV+XenmE3/zZDYf5zaCpXxPuR6E9dA:5oqHVjnmUoDw/z
TLSH
T1A1D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e0c33357f033861375d5d38b7fae2b0b2dae95a260a27ffa5b6772e9d17e184f
MD5 0db602de7faab46633d9e6a458ad3414
SHA1 99d5749c6b4242fed461efdf40b8828cd42e84ce
SHA512 dc88f74a83c10cfe1704c9edf666e720d4f62526495ad87953b133f6c24222751b8e13d3161531030f94254af9a26eec792bffcb4995afac48fbd5bae5767c97
SSDEEP 24576:wAhGLmIFoiwtA5l7S53V0Djsf9nz4mloFQnpXUMPQDR6q79dA:wAM1Foiq56DYf5zaCpXxPuR6E9dA
TLSH
T152359D81EBF951D4F5B3AA7899B69170EAB6BCA55E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f7a8f924c6be9d8a513cc12d0bd15aa881f7f049770774ba939d4f97a3700fc3
MD5 6266c57296b97350965d6f97d83c0b30
SHA1 d0bbe58c9c395f9596398ca9cb159d413e06badb
SHA512 59e376c6825222b3c41a7dec1e82c9897a256744eaa8f190d9232a37fc00598de20fceac7fc9ca65ceda8ffa78e61612494ab7c954269739933ee7baf3a70918
SSDEEP 24576:uwuXOWq0Djsf9nz4mloFQnpXUMPQDR6q79dA:uwQOmDYf5zaCpXxPuR6E9dA
TLSH
T17565F14A7B9408F9E97356388597C136F7F2BC112A21DB2F17A0C65B5F33352AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e61e745334f9e28919b8b4a4d5d58822c59429795807879c8ece8d61d0963659
MD5 d9b07f90f18bff1af4f926aa1a617330
SHA1 3d3293fe9b72f21f3b6b649839c40cbee53e07ed
SHA512 00ff574fac307a58b219f1f20d8a1fa323c0b06e39818a51c310cc5a0f5a25d609d747b595bd94c06317a10c779e0181832719136e0afbd9ef2775c7094efbac
SSDEEP 24576:nZu/0Djsf9nz4mloFQnpXUMPQDR6q79dA:5DYf5zaCpXxPuR6E9dA
TLSH
T1B155128E6B9420F6D0B31B3C98F19215D3B178227B7227DF2660869A5F32BC65D39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a607e1f809b5b4d840ad6415e2dc026445e9ea5c8cf3b8fb08e3db1ca69fc8b6
MD5 af9693e0cbc9c592aae8bb14adb8ec25
SHA1 2d81ad555188c298344d4026fb954a256ef98e8e
SHA512 d059d99a22fb7c554de610b8a44423be3f0144f7c9adbad2788d4e8d62ab966b81587a27c71c58176a22656ffbd1324f82ac792ff927c0126b973fef1dfae843
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UI:RQRQyi36YOcPuLvw2gAf+PN3HoDw/z
TLSH
T151667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2914403a9c3865b8f467c9b95c650c3d142366e617901b5f41c7271266a577b9
MD5 9aad1021ce4a29e4c884ffaf8c352ecc
SHA1 6daaeb309e173daf6d6948cacdfa493abd0e7466
SHA512 a67f92895939ab7f8bdc2f39e2a92ea268de539b820246ccee10ca360f8fafc1789db58c0bc4a03a7417c53e68b320866679c17eee6f721ed3bcfe57078173c9
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UI:qQRQyi36YOcPuLvw2gAf+PN3HoDw/z
TLSH
T12A667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e7220b672bbc294796ff324d3bed5034a751d8338dd2d27000b515e02075ca1d
MD5 7a0a3bff65ac76475da00c3719d9d988
SHA1 b4a4eff862aa8c51fdd081ee86fe8d9540ecfc79
SHA512 6648204d2a3be8b3fdc9c9cd16b9d58456d9b7fa83005d914a89560e5137ee2d150b75fa966635197463216c32a3992b449821b8aa9bb40844d8292740e14534
SSDEEP 49152:M68Qg55nhxeWu7PNU3/JDYf5zaCpXxPuR6E9dA:GthGRc/JoDw/z
TLSH
T157B54933B2F600A9C45DE1769F4A873196D17C718FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 991dc35ef5c1e286c4c54c4c3c842ff8438ec191b3fd9ee62e98fcc57717d1ac
MD5 635ea10c8af6f72fc2d7c2f66e1129bf
SHA1 d9d7ea80c61522866bdf38bf5bd7ed903fcd0926
SHA512 e95795fb47cdb5c1a5061c486ae9c9a54a18d4cb366fec4d747bc6d9e89903aa4de65d64d72d71ca4eb509e45e98aa75dc651ff1dbc177402798b0c2b7b5cb1b
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99+:xy5112gYy5azzVvD69nLKnhZ2oDw/z
TLSH
T15B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cac53aa33ed9d2d28ea76af43b9001b994f62f0f8228132de084e4da12aee7cd
MD5 09c16a03092eef2d028beafc4ad69375
SHA1 131fec0edcec168ca72b7a71e0ed2d8b1a3cfb26
SHA512 a1469bd878528ffe30e9c8efed0a5314ccb064168d7afd3e2dee5e9009ce881a4acdcf9f8a24aeafe65ad86d56df2ffc8fbdfb222007cfe651105ad47d3679e6
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glrDYf5zaCpXxPuR6E9dA:lu6JmQxd2d/oDw/z
TLSH
T1A7D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 69cb668136d9c0b351fca5ffc965f0d1db8a0f4952465a70bfe5df821aeed5bf
MD5 b85185c620175d2136a9222bdc144e68
SHA1 ab0104af75b026b633ec89d2ff7f8562e2a001df
SHA512 014834edabd27abc0003a1958a6f7fc1921fd0c5775b91c2b584af22b6e1da112010cd3535c89fb61990a16ee564c8bdea89b0694757f9b8f3af1190c92b284b
SSDEEP 49152:a1hpsNoJpF1A6yU44CwH7R4xXDYf5zaCpXxPuR6E9dA:amifPVRUoDw/z
TLSH
T12EB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5b9b8af8347e30b330b9978f742ddc9de504c0b7d87282613b1ed9b5be84f530
MD5 dcc0d26fe48dfef84123e225cafae8ed
SHA1 3b6d2b8fa1224b74cfaf1abf33834d999c7b0c7f
SHA512 e90bd2eebc0bd1e19a3df0e55f5fde4afac2b082b0f5fb372265f0e0657f69212c24a2652d4e8aed5c2f9c9f42f1e3ee9033ca5863b0ae0b78e83279b6b262a5
SSDEEP 49152:aSuZQIY0Be2KIRVtOnks6NMHqMDYf5zaCpXxPuR6E9dA:E5dKOi61CoDw/z
TLSH
T1ACC5BF03F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2be078ee0fe761ad25d5da643ab0bae98492cd96a68de5a82c06815e7032a20b
MD5 00f8384f36f293ef1cb9717c9868d750
SHA1 d35f9cba319d99716d12762c8308dd12e5eac0fb
SHA512 7172aa5d83e1bebc04109f40ce62d798f4b6c6bc81fc9b907a6e4d3e875d1c93a1023836d6649b9044a5551267815a4f2524ef86348ef44d2860bb17f65b7ac5
SSDEEP 49152:whtSn8EApI0figGgiDn0AP5wbDYf5zaCpXxPuR6E9dA:hX2i/phIoDw/z
TLSH
T13B95BE13F2D900E8D06ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 70de13cf11b03e3d5029b7524c818ff85896e75c68ec9f695bb6d3c44684d663
MD5 fb3118a73cd99310795a5a282695c9cc
SHA1 085a90d13f3b41d4658b61a495972d553737cb6c
SHA512 0e13cce36e45288a75124006eec2ae070b2e692d0a286f28442fdc8f4d143fe933d305b1f53a851034dd12ce82804cc6428ad03515f57555157b61a886a30cb1
SSDEEP 12288:GjOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjhq:Gj0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T11755238EDF0951F6D0312F3C18B1E328D3D4BE21BE963ABA77A1D14ADD7474B4065886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d16e66ed3da094f73b8668dcf59bc466a3465b55615881bac65122da26d77a03
MD5 06043ce9c6e02418b2d033d26e59746b
SHA1 c78ec239e98bd3c0d8637065280dcbd2c4003a15
SHA512 7e1908ad170cfe673775dfb785a747cdd0fc9d374b5f028a68f7815b3fbe0b965e5cf3f9e94985459d31b1942e9c253e3c90b6a500ed2134dea18daead84bbe7
SSDEEP 12288:0COFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjhq:0C0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T12F55238EDF0951F6D0312F3C18A1E328C3D4BE21BE963ABA77A1D54ADD7478B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 656aa11bdb8c0cc451f507d709c8a6c64c1ba8972838a24b29f086e24f8f31b2
MD5 d3b410b62ec1565f49b44cd4ae45b036
SHA1 5d0a7fb419403369c3ee0daed8b4cdabc55e79aa
SHA512 e1f9cf71f96fa0c344e079f4d383803bd50126b6bd5bbfb96d87cab16d5a19dde0b5c03a227662924a6f8c22f87594f884962d1172048755255a7f4da0449e19
SSDEEP 12288:08OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjuq:080Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T11655238EDF0951B6D0312F3C18A1E324D3D4BE21BED63ABAB7A1D14ACD7478B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1a5e3ecc899f97e00a1ad848f579708a2f36333dfc7279a24293b7bb79c6dc7e
MD5 8507f4138633ef4232289e97907de485
SHA1 3c5855a29702644af46862654ee4cf403de685e5
SHA512 a33c98440e424d1e77ec5de78ef816a64c574386e7cd1b0ba19dfa3259cb549c84d9a8323fd91531d0eb604f3ba561bf5879e39b1d1548738127be5c2a45e510
SSDEEP 12288:6V1OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj1q:C0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B055234ADF0951F2D4722F3C58B1D225D3E4BD20BFB23BAFB750854A8D7178A9474A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 246b167bd597815adbdaf542ed32101dcf1cd52b34b8a3eb75a7f922dc0aeab2
MD5 64d2c681a77ce704322360bc912a5b7e
SHA1 7fb770c5724839ed56160c42b3b078c4443bfcfe
SHA512 c5377dcd8f91da28f0dc1b53c97a301662db0fe17eb6b09e128dc086efb253d3a68746c08e08c12e1aaff47b667278818cb2db9a202f43d5c090d0de6ae93729
SSDEEP 12288:zNOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjuq:zN0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T18D55238EDF0951B6D0312F3C18A1E328D3D4BE21BED63ABA77A1D54ACD7478B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 994be397e72593a7115bf91c343d169f297abd34118736ee4ee8c8716a42d3dc
MD5 439d2ef7036a280babd9f7040c5434b7
SHA1 13955a53702fe9ab788df6be999c3b97d143b4fc
SHA512 038fed7e151d23ccfdcd2ac778874e50c80762930ef0dd39d584c9b7c53d8dfe848f909866653da001906688e7d0f5f148eedc371e4f26f30009e064682f92de
SSDEEP 12288:QjWOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjuq:AW0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T17255238EDF0951B6D0312F3C18B1E328D3D4BE21BED63ABA77A1D54ADD7478B4064886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5546af07061dc1b257b640d2a337457bf3c28a8ca0df08da26e0086121e382c3
MD5 9f54ed0389a45276c7e1c8fca69694eb
SHA1 42025364f53a6fad028f6c381ed1d18390a4f34c
SHA512 4f8e9a4a06f45ac4258f077ba206795996ad6de4bbb54c2e89ffc87dd361b838412c2ab5e73aa53a0e76e758fec2ca01e292946e17088f21332896417fd6e882
SSDEEP 12288:96OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjGq:960Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T15B55238EDF0951B6D0312F3C18A1E328C3D8BE21BED63ABA77A1D54ADD7474B50648C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e7b973da35d0caec8c19b58269fb0e5a1920525884108ec32b8d5838172230b7
MD5 74afd3c37e5d6c4d9aae68965ba6c99d
SHA1 da0a65ffb6a23d4cb6cee54075cf0f39cfb91942
SHA512 a8f10fae54aedbc43ac45a6ebab39430387434c2bc1adcf2f4e481cd983c1943b01636e01f431b5adf99da3ab8854bd67ece3317656a618fb9cc15a5d3678b97
SSDEEP 24576:qZMJzFVSOi0Djsf9nz4mloFQnpXUMPQDR6q79dA:qZMJzfxDYf5zaCpXxPuR6E9dA
TLSH
T17F75F199B75018F8EC73463D88619916D2F27C261BA0CA1F13E4366B5F333921C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0f19df05d1e6d1e2083d9cee03da03fbef22851fb8fc930ee84803167e61e793
MD5 e8640836de0a3a8ed6c91b7bd42c6442
SHA1 072ece1c2c9081885ddf0549e6e87b141bf1c192
SHA512 5dcdc7b71c09d804d070222c44af2548fe51aceb8f11143ea35737aac01e613ff9faccfa82c928c6821ef5f2893771b697d4d1e4735e3cb38b78fe875e42b0ce
SSDEEP 12288:fvOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjSgq:fv0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1EA55238EDF0951F6D0312F3C18A1E328C3D4BE21BED63AAAB7A1D54ADD7474B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ff25c6c73d0c3de5b5309cb0389ca1dd2c089190ef4f75ffd537993adbf8efdd
MD5 27608faf0754d05a321e3a3d95435ae3
SHA1 0761af2f12b814eb7266179a767bcda37a94341b
SHA512 234890e03385f33815b48bd21810a34fe0247e9302bc33e0e59a23a7d5d5ea4a2f72554fc39bc9b562fdd01d7a73858ceebee5579a82f4c595731355b870c75e
SSDEEP 12288:KLOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjSgq:KL0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1AF55238EDF0951F6D0312F3C18A1E328C3D8BE21BED63ABA77A1D54ADD7474B4064886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 34450b5debb62e49980d852920d5bf0996485af2cb664717f22a38c2bffe5f28
MD5 6988ae0e30c56a8ca4291d1315dccf50
SHA1 77f1e0c0fc6dc702f7e0b30b625acd19524b33d9
SHA512 defe2d2cd067e5f6dadce379f45536e0cf1811a8e4c24180bf259d5b36e37b463c887a836149faef33fb9ac43b4460ee992233069f7f1dbb87b03f77816db4bf
SSDEEP 24576:tzye0Djsf9nz4mloFQnpXUMPQDR6q79dA:tGDYf5zaCpXxPuR6E9dA
TLSH
T1DC65024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 278bc5961cae6d68ed89ffc16273015537878a995fc5a700c1b44d691c2f8ea5
MD5 24ccc991e06ba417cb632594ee348c3c
SHA1 6ba920c982fd1239ba1cdf336d79c31e0a4d7b65
SHA512 ae1bf2b5b8ea260116870a4a8871c4f12c0137518a7dd6259fae3e6ba6f15917a2e886bfd47ddf205b0832fcfd6390a5d532ddf18025ef3e6644e2c33e02b79f
SSDEEP 12288:ZvOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjOq:Zv0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B955238EDF0951F6D0312F3C18A1E328C3D8BE21BED63AAA77A1D54ADD7474B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6bc905f0aa923554895b694a1a0cac47560565b4cf4099a15272b0ea119b8c63
MD5 1e34f4d1fe810b26158547e0e0b9ff75
SHA1 6daebe06c4fae799409089780164e0d362146de1
SHA512 19aca316e5dc54df59f78a2d974d81710a080814648749292a39c71e2568212622f83e50b5c292210a04ec6d196ab387144e50a1b268f3d330777e2bc3810574
SSDEEP 12288:ivOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj/q:iv0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T18E55238EDF0951F6D0312F3C18A1E328C3D8BE21BED63AAA77A1D54ADD7474B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 466d68e1d4b9484117642e09121484e08f6dbc721ea14bbee1bb4eb7ca2e9518
MD5 5caa966914255acfecfc16c15aa6bd1b
SHA1 7c3635ac636ca3cc781dab17e65f3fee91a1d744
SHA512 855a98a0c5d87173aa9758814300636777bf4b3f7bfcbfca37fd7599c994b16cfda7d540e9df20af98a7263d1d81297b6740e2442c8c63dff63326c449fde153
SSDEEP 24576:kzye0Djsf9nz4mloFQnpXUMPQDR6q79dA:kGDYf5zaCpXxPuR6E9dA
TLSH
T19A65024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 dca2381e5d9bcd81fffee7c1fe1224a039aa2844324f6fd1cbfa6268b1797c2e
MD5 eb11162200868482ab39d8662f2b9976
SHA1 769e5380175d0ce60980acd3828e006f9be9b855
SHA512 22a66d878f4d689a68218e15a65677445929e03231ea215152be0fedf284bd13ffb5e95837c15676d872819a0b325ce92aa3d92d807a316234959b40155b3907
SSDEEP 24576:+TuaLl3z0zDM0Djsf9nz4mloFQnpXUMPQDR6q79dA:+TdLljeDYf5zaCpXxPuR6E9dA
TLSH
T11875F199B75018F8EC73463D88618616D2F27C261BB0CA5F13A4366B5F333915C3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 06621f75e1870611dcdb85b93ad21c0ceda07256f84146b4d9661e1ebde79fd2
MD5 cd9a07f62ad5026ff3d8ae57255f51b9
SHA1 067c1b430765f16fe6867cb6e390f4db6dca1513
SHA512 4837fb03c104d832c2af9e47b14cc4906f4bac1c3875ccd932aeec063cccc0765f3643aec45d779eff0431c6fbb29da685a83d217091490f81330fcfed2d7d8c
SSDEEP 24576:Q3xd9CHKy7GZA0Djsf9nz4mloFQnpXUMPQDR6q79dA:axd9CHKyaxDYf5zaCpXxPuR6E9dA
TLSH
T1DD85CF90F7E410E8F0B39A3988729511DAB67C591B71DE8F13A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 28f3925a2b8fc3689c2361ffb3cb29b576e61bc9a1eea77d7e61d88a765ab307
MD5 0362eb5a0bcb38a335c81e91e3f20972
SHA1 7c0ab39a78eac6ab04885ba411511ac059177a74
SHA512 3fac335319be7b5f2f2af53e2199ad147aed318e9b61bec6877834e7ff7f754ec2e306a72c2168c6e8d75b00bca0cc1392e7822aa52a5cb1da71614f891d512f
SSDEEP 12288:/cOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj/q:/c0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1BA55238EDF0951B6D0312F3C18A1E328D3D4BE21BED63ABA77A1D54ACD7478B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8987adabf2f7544e49ba161e3914f5ede217edf61e2fe3013a94f8b296600089
MD5 ec69d068f6c76314b1650efc85e40fc0
SHA1 57874e47de937f311723c24379fbaa81b0032fd5
SHA512 1867560499da4a6e02cac71a478104cffc52d35d535768c9643e53775015548262368163e0f5c9383ca4474d7369baba572224364d5e04a8da8f1309e71112ef
SSDEEP 12288:B+OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj9q:B+0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B755238EDF0951F6D0312F3C28B1E324D3D4BE21BEE63ABA77A1D54A8D7474B4065886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6334bab88b424d72c323451da3b7df99d9dbc8d7d9db6b16a8f9bdd32ab10bb2
MD5 52c06973d0958cdcfe7a89b90645ffd1
SHA1 e3413255b6b534902b6df7ebfdfc87d99d02b8e3
SHA512 f36ab8b0cc4c498133cc4726f0e34886ae9b68ca94755ebe07337441242bb9900ff79d6a4c388cb726f5a3bd2a31d79a006b18cfdf8b44a1c04baea7c8c6df7d
SSDEEP 12288:fxOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjhq:fx0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T19055238EDF0951B6D0312F3C18A1E328C3D4BE21BED63ABAB7A1D54ADD7474B40648C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0f4190d0e9ea9400eb8d0fa67c77b9aae73d7d216895bbfd8603e51997f1b0f9
MD5 3ec66b3a431545462d96ec8ef6d71dbd
SHA1 2628ffb03bb3c624b1b5ea44210c7035515b6945
SHA512 927f365784cb7c6f2018f6d2f53e46b6c1ce9bfbddc878ad8089117f81fc008abce349ba26940f2851ba4451ccc44db3cf07056ef41efa97e0b0d8cae377c1ab
SSDEEP 12288:5vOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjhq:5v0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T17A55238EDF0951F6D0312F3C18A1E328C3D4BE21BED63AAAB7A1D54ADD7474B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d841c5ba14338d14ac44646de109f9554c8cba03372e1ac3bc095b79160273b4
MD5 84eea1d64946cd3790f5afe52f5ca522
SHA1 e00650f33b2da19b672e5e7b0a3fe4b92827e981
SHA512 520aa15877515d4b64f710127a738976436ac1fa8850cb54d57c687e0b0e1e438bc1408127f1fca4e140f546d9662c9043c6e0d386cbb2d2fba70d8c8cf7172d
SSDEEP 12288:+ksf/OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjEq:0/0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T11565F14AD64802E9C07E2638CB619601F3737C21A7E1A3CB67D0F57E0F766859DE9A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1917dccb583f1410aca08cc7f94bfa7ed4655a7308c54eb5ff04a1c03af8900a
MD5 dddb94e4167eefb7bb544ed53974c21b
SHA1 408f0c68138281fe8543cd6d283b6c87a09d626b
SHA512 c6540874415bd424b69f51926df6b6c4f979ca0cb7a2ca4b6dbb24cfcbbffa5c3e2787227119ccc2b797219a3f619971c54724aa6fd7a8b5a1a04a9dad7ed84a
SSDEEP 12288:79OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjDq:790Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T19D55234ADF0951B6E4712F3C14B5E234D398BE207F913AEBB75092899C707CB8874987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 94631394ca5cf76a9f7c3fccaabd0920ce1db6f5e4d7b373ea732a7c5ba7f6d7
MD5 72401fa892191d5d81e4ddd362977891
SHA1 172b28d7d7d1adf92809aa2b6201e84b2040d6f1
SHA512 3bb45e1cf854409e5fd40ccf23fbbb638a97fb8522f8cc981e25d42adb865d3daed1d49f96be2c66b8124dd64ebd4c94bcf4cd54fc0bf6e16d5d131d2b7ec692
SSDEEP 49152:0RZwQCyiHiQEaiPnM1DYf5zaCpXxPuR6E9dA:a9xPPmoDw/z
TLSH
T11185B01E63DC42A5E0BAD278CD674407E6B278165731A7CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f8fba5bc2d4e1acbb6e929ae46fbc558091fd2634ca4b8e51e4b1d4a3e5f6c24
MD5 88c4b3e9bd068e11314726a92e85e952
SHA1 0c4b0a66426575afaf57c0478bf97aa15055d7a1
SHA512 2226002fee4feaf9fd33dff7acb71d293a48931c57b198a844a3576e4656f9bb4e5fa6e2a2af03d9777557307f24bee193f0a292346613b86154cc7007bf7678
SSDEEP 24576:IbxA1UGN0Djsf9nz4mloFQnpXUMPQDR6q79dA:IbxA1UxDYf5zaCpXxPuR6E9dA
TLSH
T1C155026E9A9C20F5E0726A3C58E18205D371BC262B6167EF21D1C27E4F36FD95C35E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6dd89511d2e0e35d67b4c9da71a238952822a07dd56a6104a75b1aeb0291f33c
MD5 2e2af2f84fff9668ca8d12d90dc806b4
SHA1 58bed841b15e8ec803d5901d4f79e9ec8e9cb5b5
SHA512 fe74006d06dc9d7de2b4cca676bc86f2143b8d8db982cfcaa0dcde9e2ab2b3f1439afd37772371b3837367a65a75b011c52279f04cadcb85869b7c19043b26fe
SSDEEP 24576:1jsmP0yHaqrVqHra44KDzMsrnQ0Djsf9nz4mloFQnpXUMPQDR6q79dA:1jRP0yHfVqzlAsrnTDYf5zaCpXxPuR67
TLSH
T16845BF2EF2B910F9D4AAD136454107B5FB71782D1F209ACB0170C634AF0AEE99E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 676b547d31c18a37657314ab2ccf4b02615091549e7339a5201973a9cc9babb2
MD5 85ee4d2d6c9ee499f6aa2de241a8b468
SHA1 8dfd56e98ccf16a97bb6709c422e43bd59ddf272
SHA512 a239383e1fb7d7ae605a80c89293697cbc9ac3adf46fd2381e8dd65f771bed929337f42df608a59eddf7625faffe26337f515bf9d9edb69d2906821d7182a824
SSDEEP 12288:ZfOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjhq:Zf0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T12A55238EDF0951F6D4312F3C18A1D324D3D4BE207FA63AEB76A1A14A8D747CB8475982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 fd80140e4b916072cea8e00cb2967c87c473c99a20b7f080ded09feb8e16c276
MD5 2d1b83035afb6c55ec65f42ed6a2e42c
SHA1 b90d88b29c2197d83edf40fd3128c207a61c2053
SHA512 c5ba550a4ac4155ebf33745ad33edcf0dc10f891a6cf3f553104da09036931d58460fb7e7663b0032f94fbd5794d039daac896a1e0d8889c75a73415838c3e3f
SSDEEP 24576:DtLBUT50Djsf9nz4mloFQnpXUMPQDR6q79dA:DtLBUaDYf5zaCpXxPuR6E9dA
TLSH
T19D750149EB9400F5E877923C88B28616D3B2B85D1764E7DF03A88B551F237E64E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c4ddaef0b4080b30e0401ad67f5540183f693b6ff30d1324990a7a93b866f3da
MD5 e7736d5caed408775d5d8c6c40a6d642
SHA1 19a7c7e53019cb1f4ba74ac64fde13ab559fd651
SHA512 9bbf7609e32acb167b9e151290484442d61c050fb6b1818a75151b0f32ec1b9b90e26cc66852c0e10fc3ed7890dfe0bca8aff8d26220a679af8da944df9ed3d2
SSDEEP 24576:DWYNHc0Djsf9nz4mloFQnpXUMPQDR6q79dA:DWYt/DYf5zaCpXxPuR6E9dA
TLSH
T1DF65F11F965D08E5D53B623D89C28209F2B2B8621751A6DF15F0C27E0E27FD9BC3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5b163c847b900bc6e7026d2fc9effcb8fc10cc466aef3872a12300cfb4cb008a
MD5 27afb7163e8f114ccb34b164a2e7cdb0
SHA1 9e521d7e4e6fe7ae62a6253837887bf21f1f8efd
SHA512 44905cfdb6e345237a1d9e98f22369a41e9110d233fbee0bee1747c64fd031c01c693774485edf96d79f5281d055eade5e89d3ef886e7b93cb2423eae999453b
SSDEEP 24576:SnXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKz:SnXoJJYH84VVS6AmEvJas+cHBjSSKHPj
TLSH
T16065BF9EA6BC04E8D5BBD13CC5C24506F5B178621331DACF0261C2BA7F27AE55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f88aa5e5f3c398674ac638af74c920763e451a54f9075b9017caa0656d20f4df
MD5 01e2148d2f2c6e10de1db4837cb99707
SHA1 c3a9622950353d79b8a6e037bb87d45b20226a35
SHA512 4ae32945f7cd7cc6426311875f5d5347f078bcfc945b27fe27a20877533f014f5122e05931ca4add68febfcda5d00c2d441ad2158894ee82fb2e89f69a1067aa
SSDEEP 49152:FDLL9TuJ0M/TYj2PMDYf5zaCpXxPuR6E9dA:2moDw/z
TLSH
T11F858D5EA3EC42D4E07BDABD85B39146FAB2B855273091CF1290856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 f559ccdd6e4d94c9ed52559e40b0164d3810b2cf647faa708cd2220e35b673c2
MD5 bc4b67dfab71c304563b6e618b8a2d86
SHA1 a3e54de1a8e295dcadb74365cceee1e50b74b53d
SHA512 f01f7514858201fdb4f539311f3b231b02a3ca6776813db635a50e3dc70905e399dd9e5f92e2e2277cf46eec026f96dde8224f21864d8436961898d67714a3e6
SSDEEP 24576:xegJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10w50Djsf9nz4mloFQnpXUMPQDR6q792:xngOJOmPOHEeDYf5zaCpXxPuR6E9dA
TLSH
T13055C03FABBC15D5D03EC13D89928916F6B1782613356ACF0560827E5F2BEE46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 1372a0dc4dd541b049590fec41491e459e8b928ed08201ce1352038b17e5c017
MD5 a7085984dbbb2884a256838b0f4a4b15
SHA1 229c97a65f49da340ed3c4ffeb5caf6e73bd1dba
SHA512 4fbbeafc1da6c429c819d4499ebe485b5be02290820959ad52a2bc162ef454e2205e44d2cdf7cfe5040cdf276f99f63d735de920f980a836c0aec3ec5cd8ef39
SSDEEP 24576:RLJnJiTk3R3waE4JrO/0Djsf9nz4mloFQnpXUMPQDR6q79dA:RLJnJK8R304lDDYf5zaCpXxPuR6E9dA
TLSH
T16975D02DD2A810E8D4B7C2B4815A6756FF71383C2B2169CB29B4D5353F12FD0AA79F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3439342e8c8e0e80e87da2830f95c5b093d49ca8f327184de4a8df7fef0eda4a
MD5 84ff0ffc839a40c403e2ed84e9e6283b
SHA1 6208c51c9b66ebd6354b2eaf913957550734e0a8
SHA512 5792b37d9e342d2360d0b8ef60191bcfcea433bdcc5c51879dee309e303af2012423b8a8f7f93573420bf3a4e42c8ae1ee7b5f9162f6875aa21386501fd318c1
SSDEEP 49152:G9mqCzDScAZmlvTcFg8Ph6wDYf5zaCpXxPuR6E9dA:ILoDw/z
TLSH
T14E955D05F7EB5298E8B3CAF1C96294159B327C509B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 91c1fb58fea07a9d0ea6c1bc6cd65a9be1d7e108a3509dc9cec1694a182fa138
MD5 2901e6792f0f7f333e82c9dcad200409
SHA1 9fad3ce182fbba25186796b3c724506fd8ae786a
SHA512 453921bd2dac7ded635087b59222de9544f0aca5955322ad0b93c7ee559f246201aaddd572e1f81a70c80376525fbb2c4eb93880a8e4f97180fcb8f3fa3407b1
SSDEEP 24576:8lYJeXm5jUuE+0Djsf9nz4mloFQnpXUMPQDR6q79dA:8lYJeXmRUuEJDYf5zaCpXxPuR6E9dA
TLSH
T1D655025DAE4C30F5E0365A3C58A18214D3B1B8316B5137FF66E0C27A8E76BCA5D39E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 728018ffcd2b3f9ccb2cb394437149a283f1143bda968a6b61ade395c265bf72
MD5 a9f20938ef05cba57af91140b6797231
SHA1 f82db28dc66db3db7f02d3ae7ee7407c406aaba4
SHA512 c493e7a38076e4e11290cb40c25ce14e02245f6d0a9321bd4b093703d461ccf1e737636cbbcc0bb2273734b29f9d8c1576deb511c46e1997869d4d2ba0d6d609
SSDEEP 24576:G7tyw0Djsf9nz4mloFQnpXUMPQDR6q79dA:G7tYDYf5zaCpXxPuR6E9dA
TLSH
T19E651249AB4461F5E4711F3C98B28264DBB4BC206F6167EF62D0E62F5E367C5A830F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 4f31c626127b1eafc5a368e49ba9ff857e04dd381439e9255a7b2b72ad6cc570
MD5 827375745151ef73b111d849a3842fb0
SHA1 476eeaf86f149d5555b0695cefd95e13b7dcf800
SHA512 c622353a4f0d5e8059ed2710463d9346ca86d3e8bbb446adacd98a6ab3090b8e40009cae5b6abb4319232038756c13cd49327594cb75f2057d3e3fb5e09292cd
SSDEEP 12288:SP5OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjhq:e50Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T13F55224EDF0960B6D4312F3C1461A224D2A4BE307FA13AFF76E0E56ACD7578B9471982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0bb0a0ebf5969fad5e42e17a3b4c36ee6f0e69c9c3b75f06c847873443ffb33b
MD5 c086a94dd19a4f8599362685a2aa2ab1
SHA1 9e22c57210bdce03db8ad54911a0afc396fe8b18
SHA512 9700facec48e04d91a57adcc5ef74be30a1d19d532643e394c2974bf4b38e5caf7d538735e689f2682cd5392c3b28aab68d1c85e310e6fd27c37edafa03118c9
SSDEEP 24576:IC+TyQIu93VAumZr7jmi0Djsf9nz4mloFQnpXUMPQDR6q79dA:I/TfIq+YNDYf5zaCpXxPuR6E9dA
TLSH
T1FF559D1DA7E919CAE176C675C8A34493E633B872237186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 14bc8e87df9dd97d72d413f01fa1d61ea7ccb91f5ac5dbe1ac9f0ec2e6630c37
MD5 76db24ae9bba347bb08809a48a05553e
SHA1 b334edd8e5c7f9d6bd7956349db080088b0312f2
SHA512 692ef7809120556b77e490dc04b6a1ec92ab9902171e802bfda7e097979202965e33dfc4e4cdeb48b0efc3932bf32596c0a3bea9ea3671ce22adda0aedfd19ce
SSDEEP 24576:xLQikZ10Djsf9nz4mloFQnpXUMPQDR6q79dA:VQik0DYf5zaCpXxPuR6E9dA
TLSH
T1A665F10FB76A10A5D077823C88918215F6B37830575267EF52A0C7794FB76DABD38B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0479ae7ab65d1b1949e69c825c0aa7b9fd864bd1910e5dd53ac61b7bae69ce76
MD5 46a7d949550ded15d1fa1af24a321c3e
SHA1 a3635b243e514f309b6c74ba19c9d5a3976fb121
SHA512 bf65ff7b428209ade32af6ab91441269913ed5bb6dd4ea532bff706cc4e35cc726f004622c2f2c97e53dbb8832d767411d2e86e551b35c71457117730f0c427e
SSDEEP 49152:NpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPzDYf5zaCp5:OpC7b4+80GTkGoDw/z
TLSH
T15DA57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/8-55-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/8-49-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/8-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/8-57-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/244-392-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/244-521-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/244-389-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/244-383-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/872-233-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/872-360-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/872-234-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/872-240-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1420-337-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1420-518-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1420-329-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1420-335-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1500-413-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1500-416-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1500-526-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1600-428-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/1600-419-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1600-425-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1600-559-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/2064-432-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2064-513-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2064-481-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2064-497-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2064-441-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2064-592-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2064-438-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2128-28-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2128-34-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2128-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2128-224-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2340-6-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2340-10-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2340-13-0x0000000140000000-0x0000000140B70000-memory.dmp

Download

memory/2340-221-0x0000000140000000-0x0000000140B70000-memory.dmp

Download

memory/2340-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2420-375-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2420-368-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2420-366-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2420-378-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2420-381-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2552-265-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2552-256-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2552-259-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2552-391-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2672-533-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-527-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-540-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-537-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-534-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-528-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-530-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-538-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-535-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-532-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-531-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-529-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-536-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/2672-539-0x00000222AD500000-0x00000222AD510000-memory.dmp

Download

memory/3128-285-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3128-291-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3128-286-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3128-415-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3252-271-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3252-279-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3252-277-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3252-403-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3392-324-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3392-515-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/3392-318-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3392-326-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/3952-525-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3952-312-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3952-440-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3952-314-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3952-523-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3992-14-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3992-24-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3992-22-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3992-223-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4188-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4188-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4188-38-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4188-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4456-267-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4456-257-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/4456-245-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/4456-251-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/4456-244-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4688-341-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4688-347-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4688-519-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4688-350-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4884-522-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4884-404-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4884-401-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4944-295-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4944-302-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4944-427-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4944-296-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5036-226-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5036-70-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5036-72-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5036-64-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5096-520-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/5096-352-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5096-361-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/5096-358-0x0000000000890000-0x00000000008F0000-memory.dmp

Download