9d7a5a1e7193495970056d26bcc92aa18e23f3dc34ba90af89f89ee6faa99c05

Analysis

max time kernel
149s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_b281d869437d72e955877d174137489f_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 5.6MB
Sample260604-n79cjady2v
SHA256 9d7a5a1e7193495970056d26bcc92aa18e23f3dc34ba90af89f89ee6faa99c05
MD5 b281d869437d72e955877d174137489f
SHA1 ad584502a1a32445f7d8e21e297b4eaf91353f18
SHA512 a2b502e67dce420c8e038d23b70b16cd3ea89bbed898b3c78304a7daa64da70afbfd426932cbe94ae744f20f955bb9da9dca658c39ac30eada62d50fab0059c1
SSDEEP 49152:k+VwASO1GtlqvqdLZ9Yacbvkx0cjEw/Ewl47c6ujUtZGndouhGWXfha4pHov47Pf:rqCz0j5l4AUM/VxoH/lY+6beD527BWG
TLSH
T1DD56AD79A6BC00EAE47AC1B9C6865227E771741507F017CF2AA446FA0F27AE01E7F741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4256	alg.exe
1232	elevation_service.exe
4992	elevation_service.exe
3012	maintenanceservice.exe
4908	OSE.EXE
2296	DiagnosticsHub.StandardCollector.Service.exe
2972	fxssvc.exe
4692	msdtc.exe
2096	PerceptionSimulationService.exe
1856	perfhost.exe
4528	locator.exe
1876	SensorDataService.exe
1036	snmptrap.exe
1708	spectrum.exe
232	ssh-agent.exe
3396	TieringEngineService.exe
4504	AgentService.exe
776	vds.exe
3024	vssvc.exe
4312	wbengine.exe
2400	WmiApSrv.exe
880	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_b281d869437d72e955877d174137489f_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1c702067fe8d2f74.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e01a66a1af4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5034c6c1af4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003152f26a1af4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8fe216b1af4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000730b736b1af4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4200	2026-06-04_b281d869437d72e955877d174137489f_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4256	alg.exe
Token: SeDebugPrivilege	4256	alg.exe
Token: SeDebugPrivilege	4256	alg.exe
Token: SeTakeOwnershipPrivilege	1232	elevation_service.exe
Token: SeAuditPrivilege	2972	fxssvc.exe
Token: SeRestorePrivilege	3396	TieringEngineService.exe
Token: SeManageVolumePrivilege	3396	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4504	AgentService.exe
Token: SeBackupPrivilege	3024	vssvc.exe
Token: SeRestorePrivilege	3024	vssvc.exe
Token: SeAuditPrivilege	3024	vssvc.exe
Token: SeBackupPrivilege	4312	wbengine.exe
Token: SeRestorePrivilege	4312	wbengine.exe
Token: SeSecurityPrivilege	4312	wbengine.exe
Token: 33	880	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeDebugPrivilege	1232	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 5260	880	SearchIndexer.exe	120
PID 880 wrote to memory of 5704	880	SearchIndexer.exe	122
PID 880 wrote to memory of 5736	880	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_b281d869437d72e955877d174137489f_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_b281d869437d72e955877d174137489f_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3012

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2180

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2096

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1876

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1708

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:232

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1460

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5260
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2964 2972 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5704
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3012 3008 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c054544395ca7d1b051e0cb598e576acdb80b3306dc154cfe816e7049c95d737
MD5 4d5ee88dec2e065ffd6bfacea165dbc7
SHA1 f778e59a9c691524f48ed162a6b4ba2cdc20338a
SHA512 25a011b203428cc2b861a17afe68af41c9d5a84b4a860c89a080e146dbab32387e32e14e3aaf103c69df6091340f5fe96bda9f3ad0178dc9f9a49490c40f144a
SSDEEP 49152:gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnCDmg27RnWGj:K3q6sjBBD527BWG
TLSH
T1BAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 29034834966b25d678afb2203715bcf090de45ea8649d683183a88bee7b6edd2
MD5 925a11d0a54a3fd92bc856162da17194
SHA1 c548d68b050a8440d3df51af09c96310086b723f
SHA512 54febe9c1fdf09ff0b530b90cfd6df08f89fe3754f7c76d66890fd9fab729d0ab83fa4371187c67eed4f527f24533a775bc6f94df3ca624844981136c543e701
SSDEEP 24576:rXYfDtczARsqjnhMgeiCl7G0nehbGZpbD:utcUDmg27RnWGj
TLSH
T19B650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d53261fe4b587b6eb89369a2587433ff6919fdb27d429a1fc4f07bf2c23b0f8c
MD5 dbed592c161f8cbec389515b0b1e298c
SHA1 fba2f8c23dc044b167c37e8ec9d3837b673a4f49
SHA512 0fcb1fdaf3fc8733e711f0cee222d994eb5426138d8676d25394e9a381a17d0e67f12f545efcebc3e40b93c4681e7bfaec4ade2b8d5431595a34bfd7c4ac843c
SSDEEP 24576:A0Le5ji0hmxxrMmsqjnhMgeiCl7G0nehbGZpbD:APji0AjLDmg27RnWGj
TLSH
T184859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0334e37d70649b98ce226cefda2d7a7c88c5af836a87e72f56b839602feb251d
MD5 ce1b7254dd46984232237a51a165c094
SHA1 cb24305ef3c90b661dd236fdf37908573fbfb200
SHA512 5011a37b16e13a5790932867b717b2f9197b65b8c930284c60bb87909833a008488c53bc509a5e2d92b771dc0c4d92941983f94779e0322b8c3d81821bb115ff
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWn6q8wyuYsqjnhMgeiCl7G0nehbGZpbD:Z/ezSC6vUzPveHjy/Dmg27RnWGj
TLSH
T137755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f20de6e3c3bf24093410b82117ed9212eaf689219f5820bdbe995dbf0ae1b6b5
MD5 b61014a2f7c604ab381088f98ab1bddc
SHA1 23ccae60ab09c290c9b77ca1098a8b6409f0f9a9
SHA512 1efaeebdf16152d5ba3182a005cfb824f01620294ac15a2e4dd67ec4d8d75d7c2a726cb7c86a12d48ba41b6f7f241b08804c2490a3e917bb40e37a5192deec60
SSDEEP 24576:gVbqPb88hv/l+YNsqjnhMgeiCl7G0nehbGZpbD:gVO88hXl+cDmg27RnWGj
TLSH
T17A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0bac2cf918554771ef441b084a581a55d8bf5316d71a430465d37b822c85c428
MD5 adcf8b8bb252f50fcabce122d0c7ab89
SHA1 bf0449e5a4506948b99a9963468a7adac78fedbf
SHA512 87c8a93d0437ba7fe237a414a7f2675b7dceb52b6355eb5283caba7f22a0bded9574aee575c72d3a2e12234edabf97dc0d2592487619a850a82be8210679c230
SSDEEP 12288:LLiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LLisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BF864C50DAEB7608B5C3E9F51EAC137E56982008536A637CFEE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ddb2f6ce1d3a7061310808861865c6374e295fa898c0af69dced034838a9a908
MD5 9bbca208a1d00e90a6f0017c97e0ab88
SHA1 3ce4949a1c210aff67a8c9b037b4d54f09ed8794
SHA512 53626a4162372b43f1baaffda3f174a6821163bd158834d75bd46385de39c6b9dbda8412ea0f2c574e39f3d0759a7b93ac4a39a97b65ccd428e5cfc21d3151ea
SSDEEP 12288:7eBNUbTVO86UFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:7JIUFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12865CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 580a5c5a09a6b239dcb5457b87991d296574ed86ca50ff8d3c4df33952d775f8
MD5 843471aeb4b23dbbd443f834170b5a2e
SHA1 b10289c934b39fb44fb100adbd22a873aa90dfdb
SHA512 fe1d30afa1df2c364d78778e1df3fdc6e343c573a431025f4ea326161ad418dfa9bfe0fa20120b0cfefca39d0808aa5d8ede7e79038ea9cbcb89e2a53f70fb04
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:LQvGAdlCEL8c/DRNw5C0D527BWG
TLSH
T198266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d48ab4c18efd625e15bd596a26bf8a55a3cac8211b38e0e46d1d27ed9d969e52
MD5 8bed0f3798559f688e8911d748c73ee9
SHA1 bba4154103bc7f49b47dc187db48f43e31407e89
SHA512 459c36736308d67ad46d4bb676e04030281dfcb88c76f1af16a944e0398be2d0dcb450e74b08e43943bfe6bf34e5489739bd14e32101e131b30767a3f3341f82
SSDEEP 12288:yAwSfxL/2Dc3RDLLmt0LDQewsAjnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:30ewsAjnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D075E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2ad16903d4699d315be29db480b2eb56e6bbfba7955fb120cc5f8f5a3f120a52
MD5 ea9c670e8c164f7c1a70788b472ecaf3
SHA1 d3eb4c41c0d6fb27d81b4fa12f25586d02cf195e
SHA512 95f3e0b89aa6e3d34fef6b0a5c00d6a965220159629d2b6aad45d54cca360373adc4577bf2f852b921930bd62652127a43e00154c0cf2302bd169d77d33cf545
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHzVQBWG:9UEtQevvqc2W1cpV2tI32qB
TLSH
T1FD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 54c6f17d0f17e6e847a27ab2a86c33bc146d6fec380d92bfa004a40df1cc4534
MD5 634428eab82df0641b3680b36d762efa
SHA1 14eb0ed2750674dee8b19baf845534e2e1e0ab09
SHA512 2bc226c01acc79b460187324a7f9b24ca81434376f5582096318e791b100b8be3ba297f0eb0794abb95ad5402360a3fd17dc0163385f4a8440ad68f8d488af3c
SSDEEP 49152:JCbRquA/m2yL5zTfFiV+XenmE3/zbDmg27RnWGj:GoquVjnmYD527BWG
TLSH
T1EAD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1e335e5f2d405c0d1dad6bcf3bc48250a875c96fbd8b23eb9d8694070d0395ad
MD5 e6429621b1a226056753ee4a9fa26c80
SHA1 63a8d8ab0e51fb1ce66be17ee6df609b5bd624b5
SHA512 b900d774f09a5f169eb3628c2e6b794d1b0e03283a5a969b0dae3e3030ef7b1dce8d3564009b27622cd1bdab6dc01f458647bbdcdc5742631cab65d6991e9625
SSDEEP 24576:GAhGL3IFoiwtA5l7S53MsqjnhMgeiCl7G0nehbGZpbD:GAMUFoiq5IDmg27RnWGj
TLSH
T1DD359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 62d4f8a6270f2b45a5504d9a3ca9ab1e651f3aed7bd83cf8edf1e7a622ba59ad
MD5 cc1154abff8565590adb0a006ae56825
SHA1 6b792a906dff39cf0a894cdfaa8849e6e941d773
SHA512 631e1b8cb7c6b5032fe8ea938460cf0b837de0f379f23a486e8852b1bbb0515a1bcf32023beafaa4e9c7af3de86401eb17cb348e61aef01ba03f81e0807f4d1a
SSDEEP 12288:5mw5HEjsChNVBFgl0WDm+C4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Uwu4OWrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15665F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f937b213c1d05cfa0f0fd159c7516409e84930bfa8308b694c5044387bd34c11
MD5 fed7cefd44f769832c7dfc50255c5e3a
SHA1 dc2ace07359a4e9d15c6944827b856f63596fd92
SHA512 3c3d7ee55b6032719b5d54b81524b8bd6e7f13245697b49034efd6baa1239913eaa701d29c816519be116876a479269ce077b325bf47f60536e3879eab5c80af
SSDEEP 12288:EeZ1IyXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ZuesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1855512AE239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e1261c5c8144c3df412627cb5bfaa9924591c57cd911d7f56d2069342b7b8598
MD5 ad2c63815f47cda9520db3854afca588
SHA1 862554838a20f547ce67e5b6b273a01ebf76e2f4
SHA512 073a9c07d4cb6ef0b8a5bc25c4496195bed19dee710d815df9653b25d45408658be4470c1965aa43d3503d6d9ac739bd01e5fd0f53572fc4c1b225de6880ce22
SSDEEP 98304:LQRQyi36YOcPbLvw2gAf+PN3tD527BWG:6QyiKa/X+PN9VQBWG
TLSH
T1C2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ff3892a7a782b615684f0a1e431de4754ea2cda7e1189a935e49e07b9563a9ec
MD5 7c1f6c6e4f350e68daa1c8eb1559e9af
SHA1 724645d35129b5bb4582408215f9af45e72e344b
SHA512 5f6a957f2249a6a7508b47d8311e9b9d8f2bbb2c0e2996311470d7cf521beddc65efcb95b7a5bbf32dba59a089537d86efb83c3258aa3502c9643a99536fd689
SSDEEP 98304:RQRQyi36YOcPbLvw2gAf+PN3tD527BWG:IQyiKa/X+PN9VQBWG
TLSH
T1E9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bca96affcd9facfd90ad3509d9b77a658a95b2314b317c6c66a2267fd4104691
MD5 10c189c9cb0c45775f79b05801b3a5bc
SHA1 f4b8b71e79c1d1db8f19e769dd2e7df1be55a641
SHA512 f6b94ed89baafea9523e0faef9991be6169b80bcf79ade3527d5148b226458e57d7773539ffee5a578495f974f956e46db51e3bf1c5e2446f76b3e302426fe0e
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0usqjnhMgeiCl7Ge:U68Qg55nhceWu7PNU3/LDmg27RnWGj
TLSH
T1D8B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 be6d9c00069d365dcef5a33d132d3e5421bf5214055d63202fca9dcfb92fcf62
MD5 2bad7caf7dfe9bdf9e7c34e4c5a2edf4
SHA1 01fdfa1f8ac578d5bc82296e904c4ba9c201a01c
SHA512 6f8712de50675820f3930b6a2aa36cc4fb78a1218abd560718a3127bd4d28669251e01a9792756ebfaed2b9a80a23a92d006c714734c82d22dc8538ee7ec0e7a
SSDEEP 98304:ny5112gYy5azzVvt69nLKnhZmD527BWG:6LIHEWhwVQBWG
TLSH
T183167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c55af59c9daf86b504058e6b5b548fcf97fd4f9375f9dbe3c5b5241e051bc2bd
MD5 5d07df6ed5ef542f1c50dd257c448fce
SHA1 838d078c55fffc7f7d2484260ad14d4db2132bba
SHA512 efa34272b8fcca4ffccf837d24cff3b3da185a86ed5205a4699619df6971b7de22bb2543ff5c915a01c6e2d332aaa86f8ed12ee266e8454d9798088400a97df0
SSDEEP 49152:0B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl1Dmg27RnWGj:uu6Jmdxd2d1D527BWG
TLSH
T1DCD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cf7e2c9295f6f27bf9c1a952a4aff1f29301ed5b83531b72bf0559d6ebae7bca
MD5 d9a8e4ba9f32b06c666b36dac77b86d9
SHA1 a13809c0f4108bc1f0376e22d5305bdf470e6a31
SHA512 2b6723dc961d6b35f6c24b4befea5bdabe0a9b9c79c22185d7fb2e0d7918d8f8964ccd8195e6c94cac5d6033f5bbc4e5fcdfc6ca74134f51f66d426d691142c7
SSDEEP 49152:z1hpsNoJpF1A63U44CwH7R4xZDmg27RnWGj:zmifPWRYD527BWG
TLSH
T136B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b97af1d61600e188996b8e15d4223aa10fbc5ab8239f7974461ba570f0ee6f90
MD5 34eb8fcddfaddc607304230d6020535d
SHA1 2e6d8ffe1c63d0740b5b3780a58107d09c51d62b
SHA512 1adf4ba214678ba78dfc3b838917ae25e4c6b46ad8a3a0a170632564411e2749a853d0279a6e6940f9014b3b937d5e4e3b34368bcaed8b7bf7f1e4a03592bf59
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqyDmg27RnWGj:a5dKii61yD527BWG
TLSH
T195C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 22f7e15e013ea5730f7acc484bd26296d3bbb9790f81c8306b9d84467becdb1e
MD5 f38f6d38258404229295c5ea94037522
SHA1 56b81dc32cfca8bccbae39720ecb8afeacc141b6
SHA512 c31cdb091d7148b962c5356ff0d3ac1f80edaefefac1db9df60a2c3f677e52cb71c41593f435a948f94a081685b655892204a9869591208242824cdaa9086e01
SSDEEP 49152:fhtSn8EApI0fig3giDn0AP5wlDmg27RnWGj:OX2imphMD527BWG
TLSH
T17695BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 69f1e3ddb285b22b16bf91c74ff00c402edec4fc386b15f26637a775c14d9cf5
MD5 6fde4cb89fa772d53fceba6b7246a690
SHA1 779918603da60757d193b976de4d30716feac03a
SHA512 d9dbf2706cefa2d3fe14d6ff46d752ac90b6beb3b919c363f635498f8682afc3ffa791db21a1a8a43629f035120fca949601285482c69ba4f1c67b9d16b69c9c
SSDEEP 12288:F6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:F6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B4523BF965C41CAE52648B5C3E5F10EAC073E57E92004937A6B7CBEFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ce7253bd63accd6b097322e0e995777829121fab6a7ecb848ed4442d82d975d1
MD5 9e5c3614c0ef2ec013b76a9b6684a05c
SHA1 5acad62a90de38570f38a8defd31431225684dfd
SHA512 e3619e6873cb4c05b5de665da2c055d427a1f5a3819d64c9d619a0c99a9fa338bf5147003d229141648da1dc88727971098447bee79f516fc916e8dc27fe1938
SSDEEP 12288:1TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BF965C41CAE52608B5C3E5F14DAC073E57E92004837AAB7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 40088b3fdf31b4f95be44733091e254eb4b0dd7ab5f41651806e7cfaaf93ed82
MD5 024beff5fa3daa93aee1f80236f4bad4
SHA1 f19889af2bd4100391ab206d15c665a867cb405a
SHA512 0ae678d3bab389289e063ac88c78e2d6a34ef64b517909dca2832541aa907c7d8682a109dce4a0b16d0e3e6f850d4b8e7135cf7a1399a79dfbec60cc3dfafb19
SSDEEP 12288:3dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BE965C41CBE52608B5C3E6F14DAC073E5BE92004837A9B7CBDFAB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 23cf44e697d7a11083d22d93f991848292c15105c69f59ffc7cf77e7e4b6aa75
MD5 6520bbd9111d260cf08083e265599b8a
SHA1 7d1f3472017aa40127f59d83908eda3eed0dc1aa
SHA512 8470bb3136398fca085840857ec85608f6cf3a817bd24e820dfaef4270a1e1a0e9eef119970bcdb28b4e5a43d0f4726658c910ea7d28119cdf4d441909a1032b
SSDEEP 12288:LVsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:usqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F45236F575C00C6D87285B4C2F6E11DE8237D96EA3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a2ecf635ffb58e0c387a3cbf81470b51891ef6aacccfcf7af64a88cb4915eb11
MD5 0919779e0ba0e21a78846892488bdc7f
SHA1 1c88ae825ea845f609350ff0873780a456f900cb
SHA512 b53d0db1a71037930179def67cd6226abf50aff2d85d10b5fe4218ec867938106fb404877120ed455bc83e1c35badd516147f800ccfbb972ef970f9787ff5d3a
SSDEEP 12288:+0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BF965C41CAE52608B5C3E6F14DAC073E5BE92004837A9B7CBDFAB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 50572cc787347e2e0131519d47fa1abbe5f4656e474bd1a6b1179cc8adceef33
MD5 f77ae17242265e6a5ed521d88ef5de38
SHA1 9558a47029b817db3c979e16063934043e16cc82
SHA512 ec5907eb056c16124b0a2e04f8714eb04b0e4065fb97174cd0f0a35f6ea9cdda21421f6f6539f9e76d87d7d8320db7cf9b042abd35013d7e6a30ee5751210531
SSDEEP 12288:8/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BE965C41CAE52608B5C3E5F14DAC073E5BE92004937AAB7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 13017b02cba475be02dec29be1f0982d781dfb1fefebc11e8b9c6d68fc86c236
MD5 4dd48c967a85f36a992ca2ed0bac8c08
SHA1 c9524783fa869f3c53920957bca516524b0ff1a0
SHA512 c8486ceda61bc9fa3bbbf39d0546ef61d3e630de68862e777817093b803200ba63aa55eb93f4f4fa86f4bdc0e452912e587a3c8cf3ca3cb8bd0e76e34052d9c2
SSDEEP 12288:87Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:87sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BE965C41CBE52604B5C3E5F11DAC073E6BE92004937A6B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9bd676f6cc5edb3a64dd55a3a9b3162c08ec88abbfdb61f971114a02d69f4e72
MD5 29dde7106322663cc7895a2e804637fe
SHA1 e2644806522f90c17f0171e079f7de150980c06b
SHA512 f525680b17f532247dc599c59c1b8252944a58d6e30bf14935d4f460a7dade5f17bd2b7b0d59eac44117d8fe9ddf168828048cf431af94560e4174a76fff9460
SSDEEP 24576:GZMRzFVSOzsqjnhMgeiCl7G0nehbGZpbD:GZMRzfTDmg27RnWGj
TLSH
T1416501A9B39018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 90415a829c45bae843f9ef53e9eb2f03e4f071de7745e8179c6427304b97caf6
MD5 72dddd09ad001de488924f658d18a611
SHA1 bdfa9d2293c9a0651c607f285f0d0d22bf5ded2f
SHA512 8152f09e397c2b18cab343063e27b877b17ffc5b3b02f49be549e6cb007725ef05c2a579c726ac3925edc7a3e871c29fddc3e2e5671e6a2d031af7628b8c4fc6
SSDEEP 12288:kOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1244523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFAB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1bdfd3cab946ad74411564c4f28a4714cc7487a74178c939530e9535cd4093a0
MD5 ed02f01c0223b3f935b819db0148092b
SHA1 352644bd4a4628199cb85ccbdacd015f4cd5ec3c
SHA512 e714b250eafc67723c249467fd40e99e25d01e221c562ce563c5cfb3e63e564925855319a13a9c8c34609aecdae3de2119c40e462bf89a9268f78a46d3f38613
SSDEEP 12288:USXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:USsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BF965C41CAE92604B5C3E5F15DAC073E5BE92004837A6B7CBAFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d39719d4d52928cfc133cdd55b44a40a3e3fa667289eee8b986da8080c7254d2
MD5 e193541c6e10fccacb13fa1fd2fb5e65
SHA1 6a5addd1aaf853a2215e69a2b470939937fc70c9
SHA512 30cb36767ce30a3fca192046fe35936fff73dd2aa31ac6cf404d7c8e0125675aefc16a83f9d025609d0f4ff021e27ce70c40bddefe29804b4885c5b063ecea0b
SSDEEP 12288:HyPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10955125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9db446622fffbf4220c454ed62da24f26c9d4476a48cdca9cd5ba71234115dd3
MD5 c41e33d4f6035379793593519a468b2b
SHA1 5a20464633dd5e828d5c44a5c29c3a7a68b9084c
SHA512 18f6e39a37fdec4ef397e13c0a83fc8c554a4a74d27ddab7a59ac8733d0579d17e2213c6051983412f72b44b11ca29a9866eb3b535019ae0b6793377a6259106
SSDEEP 12288:oOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 80acad1a8c92f3939d0cb77b2d699d57595f3ba3553bb9a98f3c0fad894fd8af
MD5 06b8dc42a1cf9bfc135f0f6bb0025553
SHA1 fcfe5a2d9656978c8fbd6fc709afc8c75b1f4834
SHA512 069f1de29bbc10f99a271553249df848a9a7e40615ee611ba282c2efd068a1e4cb93db5dea5977f62b26f7597274655594991a716fd9800334dacb99d2d16f30
SSDEEP 12288:tOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837AAB7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1cddf20f9f22f343cc5b1e62a9ae28f01256fd161ea1bd72c1062c2d785190bc
MD5 2ce1877a58e45dddb1c2169ac8af9d3f
SHA1 b037369454d3d6559d0d93bb080e967eb7346b5f
SHA512 f49f36ad287c632c47c7189aadc0c1ca531a6d3266198a72e7228f0d2b9a617214ed514231a7066be4b4c011c3eac59ba45a30e8914c7dd1d41a64a522facf41
SSDEEP 12288:8yPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lzyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12255125B73A530F9D1378178C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7dc2c64cb5095a4f63d26f22697afaf1aac810003fe13f8db1fd5b5dfc0f5656
MD5 c3a436d20ee3735ec11c3bf74a30dd4d
SHA1 4b5a9d608cea36120a815a0265fd0a99732cfbf9
SHA512 2dca2f6986cd57ffdce27c103046af4d61cc94e856459b4351f56e07b3327e0b49d11660bd2fea9ff84fcec4fba24abc4084179f486bb14d6cb73d42216abb30
SSDEEP 24576:qTDaLl3z0zDtsqjnhMgeiCl7G0nehbGZpbD:qTuLljEDmg27RnWGj
TLSH
T1FA6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8ec6bdbbd424898bab77b292af96d60acf83a21f5516769f7520485df9153ca7
MD5 06248444e22c692f99fa297698fb2875
SHA1 c1762eac0b998aabe6f63d99e3b3158165d6b9a1
SHA512 460d2eff5c20e70a042e37756eff2c0a7ea30ed9792b0012b5c7a9d4933be3df517cf7ff4fb0f9eb6eae7a6c101555f8f2b41725ee53a7c0d510083bfe972bc3
SSDEEP 24576:v3vd9CHKy7GZJsqjnhMgeiCl7G0nehbGZpbD:/vd9CHKyaTDmg27RnWGj
TLSH
T1A375CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d5f1783e7333a86642060be3d8504b16371a8f7b0b360bbfb307df5334561699
MD5 ebe68a63a968595c627d91f8862dfabd
SHA1 58dff78c4626856e2f33b10940fcc62e452fa2e5
SHA512 53245dce77cf1741883818f2e31cfd9169b69aba98fb9c28995710a7d7191ce8913bc0d0eb13a754d76fb2eb8b7abdfa75d06ac2dd1bba5124d44bd17bf696d8
SSDEEP 12288:q9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1754523BE965C41CAE52608B5C3E6F14DAC073E57E92004837A9B7CBDFBB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d187faf9411b25cfb2e7302de8009617ecaeafba4f017da5e0d4e190f7be24be
MD5 258488608520664be91f3c7d8c6a15c5
SHA1 9b28f81719bf6ced28aa02707981072466cba637
SHA512 33398e6824c3c11c527602966e79af45316dcc32ffa96fd26bd6e790f759cfc504f59c31a5f09c519118876882b2eb1656e4c17993b5e9e5e5ee6fb1b32b4ef9
SSDEEP 12288:/3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A74523BE965C41CBE52644F5C3EAE10DAC073E57E92004937AA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4f83d9f2df8af5fbf286ff261b79c7a809b1384fa920a62dcf2556a3ae736345
MD5 e34c20de22c0f16d0a8995cbf5dfe881
SHA1 b39761622ecdc285c9f83d42e08ca1b5000a5332
SHA512 25f8a8fe4a205f33ee0fa846a4ec9d0504da2845c5c9539d18f0d52cc19255cb5b061f7b2e16ef104a9d2627a7c97340a5754dcefb78cff93fbe25ea8e456898
SSDEEP 12288:KAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD4523BF955C41CAE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ddc251fdc10b176c337cd7884a9b7af0941f04eaa206945bbfa1f87c0851f672
MD5 6eb1c1ddca9e25370cb18c45facf836b
SHA1 f14d835eacba8cf53929ec50f1879c66d016ddb5
SHA512 13bdb37922c4efca12cbad52e21d28d94ea5fd460f890a4aa6f4629bd5543f6e230adcb9d162a0ae8ca198f326e6b02106c6e74f9d01050eca6a70a35e552abd
SSDEEP 12288:3OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1654523BF955C41CAE52608B5C3E5F14DAC073E5BE92004837AAB7CBDFAB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7458139eea170f1ea5ed7713d1ccc755669d03d48544f65ef883306c55d6570d
MD5 776aa4d0493eb3708b76f586052f7340
SHA1 803f235367ea70bf5e69dd02c3c02f3e5868d118
SHA512 8fd814cfb5ce5834fe5799824f3e4217126a8a19381ed026dca152865a9e0bb5a52f9a53a3cdea3a0670ea5a642b1df565e066b7cd76fbde62c623c1a82c09d5
SSDEEP 12288:3bsfeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KesqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E55015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 af195306534895b8580b88c3dbe900eba9f86520d723500480abd72250795837
MD5 7e6bb0d33a2e65b7c4722e526458c7b4
SHA1 84694d8652a4d05f486b9a9376e5f5be51a69517
SHA512 177875b82a61522ed448290ab930c7e6f4e05e136db272c2d8fda4231c6cd2fec1e889fea64034179621ca22890041aaaef9cdb8e07f3334576ff19b34559c3c
SSDEEP 12288:S7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F45237AD34C518AE57609B482EAF12D681B7E669F2044C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 421b2fd8071f514edc5e98a42df410f5da3820006ce8d5f1d95867cdf8ec3920
MD5 510e864957efe5c4ce8767dcd4add4be
SHA1 79acf8fac391c89a5f6e38eb404af9c579aa50be
SHA512 ed06b28982d70e6f4d7b94119beba6e75f08fa2ae9c41b8359c6e2c8a70c6af6cb74895015768c9bfcff7d02d176a9bf7b41221c9dbe00ffbb29b91db50b8c82
SSDEEP 24576:T8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTClsqjnhMgeiCl7G0nehbGZpbD:gRZwQCyiHiQEaiPnMQDmg27RnWGj
TLSH
T1A185B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 af14a87b778d9426dfd5279e4c336f10ed271068ed603b38f9d0926403e70fbb
MD5 bc98dcb72263bdf4a997e58146cdfc2c
SHA1 b6ca9ff76e88974627bd4aaf87b32d9bcb36b732
SHA512 3519d0990e2e69bf500b1ba1ed3e9402c31937651dc2846383ade0b316f4a8b648598dd970d359081d670a98d20838d1283a7d2b5be90bf47b5849e2b6cdef23
SSDEEP 12288:JbxA1U7KrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JbxA1UGrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E755123E62AC10E5E176917D86D2C10AD7327C26672093DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 afa7397f96df391c1d7d51d6ef3c2639ccd6b70084907b0f600f1aa303829de3
MD5 1d1b26f74079f99ae699c8bfbe1badd9
SHA1 46d2766322db48bae9fdb1777882f3a08acd0084
SHA512 51e0cba13a0e6e25918f9b338d95b33ed9ebdf80731f0ccf372e4e16d2e11a4b310ff3c7bbd0f0b5757b7d96eaf1f5e84c6ad4509631404118d2424c70a176b3
SSDEEP 24576:kjsmP0yHaqrVqHra44KDzMsrnqsqjnhMgeiCl7G0nehbGZpbD:kjRP0yHfVqzlAsrn+Dmg27RnWGj
TLSH
T1C145AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9eee77cedfbed1514281a5a9d4d36b114d3985de6be185cfc10d97463a557a33
MD5 7cef24f174d2ef86d90f65b30dc341d6
SHA1 b49e83a1cf985dcbcc470c562489590ff24e0f39
SHA512 397c12b36da23fceb777c8cac81a5a63814a18ddbe64167d520dfea608c88da0b12c4e6c12534a288a944617b02c585a504e236379c599bb86fec44d88f8f89b
SSDEEP 12288:UNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE924C51CAE93649B5C3E5E11DA8073E16AB2004D379977CFEE7B54E84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 4b82c71d03da21a789852396ce46440a97fa3a3e10caefc77ab8fcf961e232a9
MD5 3152586c70dfd500f949101daaa6852c
SHA1 63314698a806cb1df6db4d872b60f6ea2ed388f0
SHA512 3263905650c3269d0379fbc313a06d3c31e816d2fdebaee2d26dba0541cc9f6dad1ffa30195eb9b5d4685a0f412b7d55c1644cdc8aca314f5f6cb3f3a0aebfbf
SSDEEP 12288:hObfA4LWO+vAYFTPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:WbLBUTPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T156750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94A691F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c6542e5f91c7a426e09ba226e3c5a0c719adf1cb475580a38f9fbdda12359102
MD5 320465947a07c71a63d856d6c9a92cd0
SHA1 c34462791414057305fed8f3a0e5e04b3dabef37
SHA512 9cbd57e95e8e9bfd18798d07dc135b0f2b1600e71f6bc433e52123fb14002cc840eb63f924c35c5a67583b0ed7679fef0394355f67613ab5dd8e878953f90fdd
SSDEEP 12288:V70Vm9IYNvUyBpYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:SpYNHusqjnhMgeiCl7G0nehbGZpbD
TLSH
T17065E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c8f0a10e2ef6fce587708a87ab6f3eb9f3a2db8a9c3582d72327b05f08d32332
MD5 7391c757b0936bc1ef635c39dec6d586
SHA1 e4278357ae7abbf52591c1b19ed36d6282bd7723
SHA512 85ef738f16006dcf1adb006cccf701dbb5010a7fabc7399a786442f4bea13a995674ae2d6d67b9f7e058515a79200b90c0b03cbbdbf74c174c4919aff88dd149
SSDEEP 24576:unXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKW:unXoJJYH84VVS6AmEOJas+cHBjSSKHPI
TLSH
T18C65BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9bb957104f49bddd62cc3202c0f3662a2140b0cd47b8170d01ac68371c8c02b7
MD5 b70b6501df830e6653bdc02b06d5bbbc
SHA1 545e9b0475fdd4d86654fa0e00ff32342df61c93
SHA512 c9add955dca11d6b34607632f8c357c72c89ade949d7bae7d898c040f21f2c0fb5baf2076aed6e057db37877c4a5db265c36bf684fe6e52d80b8120a1c0c3e70
SSDEEP 24576:bv7Xbxd9Tuycf8M/TYlSuxrr2PCAsqjnhMgeiCl7G0nehbGZpbD:bDLL9TuJ0M/TYj2PRDmg27RnWGj
TLSH
T102858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 61172bb9250cba185c5acb089cb15ffdfa6be58a67c0dd31c3ec31ed4a3d2cd1
MD5 728fb10eca94d86c4a33781679a4525c
SHA1 55236269f7856b704d7282b7fa09608815047899
SHA512 de3ad5b15257cd27a6193f3c04878a7389582b38867021f9460e4741dad3905761899c6d171c15b6b91ec947b1807020e6364edf5870af0bd8aabcf58624e25c
SSDEEP 24576:PegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wPsqjnhMgeiCl7G0nehbGZpbD:PngOJOmPOHzzDmg27RnWGj
TLSH
T11855CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 40866740b1709dbf8922e1b498985a04e45a657d384bd253590fc592178305b8
MD5 46fc035446efe0b0fc3e9893950b3b54
SHA1 b928f9d511a25f26ef9c8562b8498405bf752347
SHA512 9ebbd437ce1bec80721a1768337542715566f2951df716d3b01259bf6c616b2f71190c4037829ef70e5afef8754e332b727bb14be1960a410af6bfa5b4772dff
SSDEEP 24576:RLJnJiTk3R3waE4JrOtsqjnhMgeiCl7G0nehbGZpbD:RLJnJK8R304lODmg27RnWGj
TLSH
T14D75E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 551ed443da20c03764b82d6214f36501081dd17de7746cb90abb6a48850aec62
MD5 00a054d48f74fab61b443d66e77a80d2
SHA1 4dadbab8addb75ae59b61fdbbde98f8eae19a5cc
SHA512 12b0ebb22aeedf819b420901bf46153144d0a33fafe87076bc6be185f5b746214a54bbab3f86d1c28393528bab1c20bb921034114547f97f8d5010d8efd46308
SSDEEP 49152:E9mqCzDScAZmlvTcFg8Ph6dDmg27RnWGj:WiD527BWG
TLSH
T1CF955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 85cac21ace0be3a4a3421acbc5186e2e16a8ae9c77eb5509e6b87ec7ee44ec93
MD5 e61b12a4d73cde668ab5e4328d65db13
SHA1 407daf1dfb2f566b56e6231f77cbd4eaa34c88e7
SHA512 4af118cd29b5c211ec7010a0c82b743d8ad040535cae56f2208942415a00d6f704a79e82bb5d640a6b5a13e46ddbd4b2659a5e4a0049d65b781c704e7cf630f4
SSDEEP 24576:clYJeXm5jUuEPsqjnhMgeiCl7G0nehbGZpbD:clYJeXmRUuEzDmg27RnWGj
TLSH
T15A5512AE669C30E5E13A8079C2E2C508E633B872671017EF55E1D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 0bf7413cdbac714d26e71af95a0c8340dd9613d865ec727c5a28ca6b1b4c9c6e
MD5 a43430688f8dfa12f41598f27b01c93b
SHA1 535f662e6a1d325e65e1763274d19290fba1c8e7
SHA512 2c2c066faea24babdf85c50298cf986279d9facc095b04423a62887be8883167306933a10aa65f110ae839b9b3bcaea9d1d5aef3912fb1f6396cdef8cc5a0dbf
SSDEEP 12288:vmu6kyKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:v7tyKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T173552219639860D9EA7A0578C6B3C158DC367C219F2042DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 02b727ee379268aad2f5dc63fff22d70e900a5fd454e2edd6875b9b6b22f81a6
MD5 6259d9ec783a54b603d50be83a2ffb0f
SHA1 021162681c4b0e148b015cd534c862b7328176b0
SHA512 971f942316fc0e4ed19a9a4128d59a88eaeeb92990097ca73bd4b5756ff681a53eab416e701320e21950f58c038fb8a0a35aef0c9601d44fdb76a82d894db593
SSDEEP 12288:DPPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11445237E525C61CAD93644B4C2A5E10DA8173E36AB2014E779E3FCBDEBB54D44B38812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8cbd34d7824d42819412e57fe45ebe0b0c8ac75daff4ed86b02f15439da6b3f2
MD5 8654a4c56fa86b32e40b959478ac82f1
SHA1 2a3bc10f6303ed808a8f0a1f5edac458aeb2e4c1
SHA512 d85b3bfad3bba797bf59234a7447379c53b705c36399dd44fa789c16fe7ffebbb2de74c33283bbf5c306a0ea87d457c531f8f70d76fd212df657f6f617f8ab48
SSDEEP 24576:DC+TyQIu93VAumZr7jmcsqjnhMgeiCl7G0nehbGZpbD:D/TfIq+YIDmg27RnWGj
TLSH
T146558D2DA7E91DCAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 b89218be1aca2459e012d00a53d7dd9e113690d167773ebe2aa6346f6b785f3c
MD5 dc8086d4f909bd82572cd27d104af53e
SHA1 f1a569840dee9337a045ce93a2b4a4c4c3b39e4a
SHA512 c80e2593f6f10ee728e45b9483b79e4453ef5eeb95b50880546a8817682724b8415a6de0446db93aad2539e210ac862ffee97a2deed13b9abdd51c6d67d030d7
SSDEEP 12288:vcyrWOstaa3kcsjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:WLQikZjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14365F11FB3AE0095E0A7817CC8858116FA737835571163DF02A1CBBD5BA75E8BE38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bcf2d43ff07e527f40fb0887bd64461da8c4e201dc73b4074c8acf11deb566e4
MD5 a2d0fa2e547058d320523763b49c7fc2
SHA1 2f62ec521ad60612ab7517b00fec17e2eb27a596
SHA512 9a1f18bb2b04f7b0201d882c818f6a94bb95b64294489836cc160407e44e6154f067d6bd33a609bfa73688b26aec00f46de79ffe2459f049d307be91a64d0448
SSDEEP 49152:bpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPeDmg27RnWm:wpC7b4+80GTkFD527BWG
TLSH
T1CEA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-511-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/232-340-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/232-334-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/232-342-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/776-513-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/776-372-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/776-378-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/776-381-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/880-486-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/880-470-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/880-502-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/880-517-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/880-421-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/880-427-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/880-430-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1036-504-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1036-316-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1036-318-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1036-310-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1232-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1232-38-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1232-29-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1232-225-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1708-507-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1708-328-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1708-321-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1856-281-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1856-404-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1876-510-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1876-429-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1876-304-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1876-306-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1876-298-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1876-508-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2096-392-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/2096-277-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2096-271-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2096-270-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/2296-232-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2296-353-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2296-239-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2296-233-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2400-516-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2400-416-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2400-415-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2400-408-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2972-250-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2972-243-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2972-266-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2972-244-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2972-256-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3012-61-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/3012-51-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/3012-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3012-57-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/3024-514-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3024-390-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3024-393-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3396-345-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3396-351-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3396-354-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3396-512-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4200-14-0x0000000140000000-0x00000001405AE000-memory.dmp

Download

memory/4200-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4200-12-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4200-0-0x0000000140000000-0x00000001405AE000-memory.dmp

Download

memory/4200-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4256-17-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4256-224-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4256-23-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4256-24-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4256-16-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4312-402-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4312-396-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4312-515-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4312-405-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4504-357-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4504-363-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4504-365-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4504-368-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4504-370-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4528-295-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4528-414-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4528-293-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4528-287-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4692-255-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4692-380-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4692-264-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4692-258-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4908-123-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4908-71-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4908-65-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4992-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4992-41-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4992-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5704-525-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-528-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-522-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-520-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-524-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-523-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-526-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-521-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-531-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-532-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-533-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-535-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-534-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-530-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-529-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download

memory/5704-527-0x000001FDEA0F0000-0x000001FDEA100000-memory.dmp

Download