feea8548e3c1d042f60abfd79aee952fd5d3ffc687a8c0d6dc2eb8925eb2979b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_c493a8fbf5f69b0126882def5d1cdea8_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 11.4MB
Sample260722-3aybbssvdz
SHA256 feea8548e3c1d042f60abfd79aee952fd5d3ffc687a8c0d6dc2eb8925eb2979b
MD5 c493a8fbf5f69b0126882def5d1cdea8
SHA1 8bbc8d51910ac7cd4c3983ff13946448695cd806
SHA512 2efef3ac76388cada2315e387065fc3309e2544ca8f3fee572d6c12c18259d171162f02e3e6dcf4341918f7da6e9d60cdcffb8d7f63124638304e37a41fb118d
SSDEEP 98304:QY9w2vsWoUhy6sREPcl8xZWaO62HTRqTK/whF91VHwEv11wlNQ1ya:QvKA6syPcl8xZ172HTREK/4xpv11wl2
TLSH
T1D6C63903E8A545E4C4A9D534C57A9223BF60BC485B3523E32FA0F7252F76BD0AEB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1328	alg.exe
400	elevation_service.exe
4572	elevation_service.exe
2900	maintenanceservice.exe
4528	OSE.EXE
3736	DiagnosticsHub.StandardCollector.Service.exe
2508	fxssvc.exe
1304	msdtc.exe
2144	PerceptionSimulationService.exe
2108	perfhost.exe
3196	locator.exe
820	SensorDataService.exe
2180	snmptrap.exe
3172	spectrum.exe
1460	ssh-agent.exe
2304	TieringEngineService.exe
4832	AgentService.exe
992	vds.exe
5112	vssvc.exe
2624	wbengine.exe
452	WmiApSrv.exe
636	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5f77cab0a19fe9b3.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_c493a8fbf5f69b0126882def5d1cdea8_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_c493a8fbf5f69b0126882def5d1cdea8_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-22_c493a8fbf5f69b0126882def5d1cdea8_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_c493a8fbf5f69b0126882def5d1cdea8_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7012dbf301add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000427923bf301add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d92934bf301add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009406efbe301add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066a2ecbe301add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cc46fbf301add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe
400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2588	2026-07-22_c493a8fbf5f69b0126882def5d1cdea8_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Token: SeDebugPrivilege	1328	alg.exe
Token: SeDebugPrivilege	1328	alg.exe
Token: SeDebugPrivilege	1328	alg.exe
Token: SeTakeOwnershipPrivilege	400	elevation_service.exe
Token: SeAuditPrivilege	2508	fxssvc.exe
Token: SeRestorePrivilege	2304	TieringEngineService.exe
Token: SeManageVolumePrivilege	2304	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4832	AgentService.exe
Token: SeBackupPrivilege	5112	vssvc.exe
Token: SeRestorePrivilege	5112	vssvc.exe
Token: SeAuditPrivilege	5112	vssvc.exe
Token: SeBackupPrivilege	2624	wbengine.exe
Token: SeRestorePrivilege	2624	wbengine.exe
Token: SeSecurityPrivilege	2624	wbengine.exe
Token: 33	636	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	636	SearchIndexer.exe
Token: SeDebugPrivilege	400	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 1888	636	SearchIndexer.exe	124
PID 636 wrote to memory of 4340	636	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-22_c493a8fbf5f69b0126882def5d1cdea8_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_c493a8fbf5f69b0126882def5d1cdea8_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4572

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2268

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1304

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3196

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:820

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3172

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1460

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:452

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1888
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 49d47b72e957e2bb6300e9004d46b2f696de50db71a630c1a8f2c449192141da
MD5 50624e02072f4d728ba77b30683655ae
SHA1 e85994f037bf45e5441056b1f9fa49ad614eaa30
SHA512 bd2cc99bb6ca0b1960d866f0fb3d707e53cf969d06604b327269fa45dca23a8ca85e978b76848c5fc06e3c1ce21abe1413c15d8ff8fe07469097b15d2ec8ae2b
SSDEEP 49152:tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnR11tmlNQ2ayVup3:z3q6sjBA11wlNQ1ya
TLSH
T10FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 549432a09deaa1674ab5f44884f1c5207329e423ead587f9f3396cbf5cfc43c7
MD5 95dace0db94497e122ce363ed6842a4b
SHA1 edb49b7120b1300bc5f857c344a057c06514ea21
SHA512 31f4ab411fdd43a4ec6b5d994f0d23022d06988639cad1b60287d7511e6e22747d7cabbd59ae0a63603076b532c2e934df7c59dba6e9280888664ea3b85ed01f
SSDEEP 24576:ZXYfDtczAIl11tmlNQ2OnBdFQtP51llPup33kT:ctcH11tmlNQ2ayVup3
TLSH
T11565012873E508F9EC678278C8B2C511EA737C954764E69B03A499251F333D85F3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ac734d587e31cf6098f0e0e3f83411052c80d9a84c2136076909a88be8f6fe2c
MD5 42f657bb5bfd63de4b39423743ebc7cc
SHA1 ca19ea795d6b14cab98f255d44e080c623a375bd
SHA512 67f43cf0b63644b8fd6f3406bd3f06d083ce016f197c4168af80db3d585f7eeb1eb73cabe7bd4bd468945abc8d9014d40d2005128f70ebba493fafa85dcfe1d2
SSDEEP 24576:T0Le5ji0hmxxrMbl11tmlNQ2OnBdFQtP51llPup33kT:TPji0AjW11tmlNQ2ayVup3
TLSH
T18A85AD25F6748731D073C0B9C5D2A69AE97230865B3089CB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0ccaafa2c23e69152a22f787c02f65486d963d7261da6232ec97d71fbd2955aa
MD5 bbb41cb449ab96ff5d83fbba7781c677
SHA1 3c5fdd29ce016010fe33e169ca52c4c3731a558a
SHA512 e6bbe27c4ff8fa0e16318afe39431bcfabde2a1bf15eef8d6f3d46ebe1986b52afdb6e01813af92c52ea976a79572e03fbb530f99515958ee76b9f207b70e92a
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyuNl11tmlNQ2OnBdFQtP51llPup33kT:a/ezSC6vUzPveHjyi11tmlNQ2ayVup3
TLSH
T192756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4f8f6263b174ae3b797a8356b4adf5bd89a609fbde22ad4eba1a989e1f0347b2
MD5 916c45e899907df5ac37354a9a8b29e2
SHA1 af502a61c77c6dad1232a0ce8ed416ed56f727e5
SHA512 1ba8d480e6faa20bd77e354c2bf906a4d80649bd607b270183af5fbe31564716f523a9e28981f5c0ab0c0cd6879acb28abd1105ab2af92817eb45d7eb19bbeba
SSDEEP 24576:QVbqPb88hv/l+Ysl11tmlNQ2OnBdFQtP51llPup33kT:QVO88hXl+P11tmlNQ2ayVup3
TLSH
T15A559E65F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 53d47dfea17d8507dd364053c50f351c41f68894725fad1b252e171b4ded6b50
MD5 f04f06e0aa4e24c12f736f524beaa618
SHA1 ccd35a745fa73854199db80a9b3fdf8be16812bb
SHA512 cb5f907a348fbcf9405398771b5a08dbfd5ea0940c09f2ce3b70d06667fa1ab088f93e0e61c4dacddb959bdb4261cb4782adf5eb53615201a9cae2ebb6dbbcb0
SSDEEP 12288:lLflnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:lLfl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T11045230814560CE5DEA74B7060B38EE1A9EC6CDAFB9E24274B00350916BD77D935F3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 bb2dec521af9c71101a4c3be0216ff217bc7c140ba082f50be93b6c31ee04912
MD5 6c64a674454f11d5359c80eb163d2d50
SHA1 8d71c781fc773be48d1499115f3a97b63ceedc48
SHA512 7b71f2caa236b005a85b2c8a97e811a9bee2b1dcb9d80b48a4ec239548a7b2c78060680f5f1d04f48e9595c484ee4c595e36a61f8f0b4c99ffe5c20b164383d4
SSDEEP 24576:JJIU0l11tmlNQ2OnBdFQtP51llPup33kT:JJIU411tmlNQ2ayVup3
TLSH
T1E765D03BAE28FCD2C67A4DB85691C740D7B278714F52A3CBD124820EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 628275d74e5dacb9d012b1162def382a94f61becca772829ccc1bb0df8d0d647
MD5 43a7e9ad136570942a7c1de925f03298
SHA1 5811de4347ccfe01b7ca7830b1f8ad26d1f36271
SHA512 12949f364581768f854b9d73922e702a47a75f277596ff09dd1090d4a827cee28dfffa69c4c86392ff0a5bec97085f252aa6f49a7f8150082faf670b36b46b8c
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THq:uQvGAdlCEL8c/DRNw5Cn11wlNQ1ya
TLSH
T12F267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 26881bee19b4a49b2f6038f0e2570b760896e4b988285a1e3134d869063b12b2
MD5 060f1e9a764023b0de1e69a023205f5f
SHA1 0874f42d031c6014a9868dc92485aea0331805e7
SHA512 1e011ba48053b997213d0217522a31ea011abe85a8a50ac5ecb8977ef89b95338266b386d2524252d8658414aa41dc988645aff2bbfd71bef5c1653d78c81407
SSDEEP 24576:d0ewsAjul11tmlNQ2OnBdFQtP51llPup33kT:GljG11tmlNQ2ayVup3
TLSH
T16875E030FE74E436C6BB0DB21B36C716187C79604F6229C3E3A85E9E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 06611059ac4fe499c8b714975f21b25046bec6746c9ea502c2a8203f8bf9efad
MD5 7b176c5feaef1b33b400192bff21acf5
SHA1 bf0da28c74b309af00867447ea0860064e647289
SHA512 0ecf2fa4c31b75d9e6067995150d5ae531ce9938c199e5fd7d608930e1481853bb0f61056fbae5674441f23d1569393fdc21dac9ec6b0c01947fdd73893ea41b
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHe11wl2:lUEtQevvqc2W1cpV2tI32aS2
TLSH
T177474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 309e130711c3846cae734eb6e48501c0a6bb370d56f8df3b455a90486f28c859
MD5 09e719bfe59c9ad564a22946aa16fa8e
SHA1 f49ede1e3892b2a7925a44725af7701624cf5d0f
SHA512 3c920f98c74b4e2322d957fed194af714d628cd27935ca4582c87280486ecbc2eb493210d4e9824892746f41247b276bccc08534b9a4e4f0e7b2b431211c32ae
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/zm11tmlNQ2ayVup3:+oquVjnmT11wlNQ1ya
TLSH
T1DFD58D0976B881E4D1F6C77886A2CA47F37178154B31A7EF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cc8a03835b1167401373db26b9bcbedc0489f207285880135512ac1376f997cc
MD5 1431aa1e72fe8b2c3b370260bdab27ed
SHA1 18367802f6520cfcb8f530298bfd3893312be752
SHA512 ce8dc18e5b34429b26ebdf663a12dc4cd31699bb756ef73ebeb7b1a1af2e19cb8fa37c5a56dc1bb722c55413f601e23fc0fc6282cbe1b175d1890f6bd9f56471
SSDEEP 24576:ZAhGL3IFoiwtA5l7S53Zl11tmlNQ2OnBdFQtP51llPup33kT:ZAMUFoiq5D11tmlNQ2ayVup3
TLSH
T107359D80E7F955D4F5B39AB899B68571EA76BCAA5E31C20F2210D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dbe7635b5012ff11f5028c4713a5c03b61ae058a132d6308d86a37ee124869eb
MD5 805046ca6e9fd90aeca308a39b214c20
SHA1 5a1cbccbe7737c9e971411962ed1404fddb2c96e
SHA512 dd9ac57e2088b1744a051e191bb75e184e3df9d8152c404dcaa5742f392c56bde90110e3ce17084108862041a73d45296c9132323203b0fa60a12e84805a5066
SSDEEP 24576:wwu4OW6l11tmlNQ2OnBdFQtP51llPup33kT:wwvOf11tmlNQ2ayVup3
TLSH
T1BA65F14936A50CF9E9A786388557C536F7F6BC022A25D71F0720C61B6F37361AE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5d6c62ad3d4aed856e18e2bf3c7ea58229a3a2a982aa274d5f5d72f6c13cb091
MD5 35acf4930b123561c8bb3e6a12170b38
SHA1 e910b395b5c9b0c37504115b339b76d2eb7c114d
SHA512 8589ebbb2d2b7acc27d159d93387df9b0d72bc22b4a5477a0ceb6dff35e8f40251b62f8e4ae6d9668bf1307ddbf724d7ab4f5b6b3f8cc18682a37e69c77318be
SSDEEP 24576:qZuDl11tmlNQ2OnBdFQtP51llPup33kT:p11tmlNQ2ayVup3
TLSH
T1E555124822E424F9E5A34778D8F28A45E7B57897677603CF0710122A2F77BE51F3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0f4b241d2a323bd558a8d0c1048280ba0848d88e6f60b9db6038e97fe89fdbd9
MD5 6256e959d11114f6c70a750e5468f38c
SHA1 e3b03b8c7abe9ffab17b332fdc322fcf3aa4c925
SHA512 1a36420d19132c656f308223be37b261a67888ef05fd5313be4d4aa21e44efb6f1a3eeae2083e6c9f41a2c0e9cbb0516204e3005d002539da9c4a705070373ab
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3U11wlNQ1ya:NQyiKa/X+PNk11wl2
TLSH
T1FF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 333dcd08abe24e1ddebc249b033da972256bf031b5a8b05b9068d7960a34a5a8
MD5 2b9e0bee08d7e00d2b789c766d99fbee
SHA1 17960a8d6c4a8dbed7a5c922261a16485993deca
SHA512 5a7066fb007086817ef9f3b81e3fb621004ed07c26cbb94c6e696b158a514e90ea70fae16ba652b7b4aa07b150265586be522dac867d69aee7a89588f1240948
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3U11wlNQ1ya:aQyiKa/X+PNk11wl2
TLSH
T171667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 26f21dfb1a7254fe28fbab3893afc627c5c952e09ffd014c87e4daaa1b22c117
MD5 a5a15d1c9332423514775a35354b4f4a
SHA1 af7c7420c2c1e9de6657da35a99c3838b26df3de
SHA512 eb56a13b7c4e675246ca5aeaabb7e9c6148be4996db1e91e89c3d45bd0603809fdf867e02f4930ee6f4839f330edfb153266dd3151efa7c806cf69f5364b26bb
SSDEEP 49152:p68Qg55nhceWu7PNU3/W11tmlNQ2ayVup3:3thLRc/W11wlNQ1ya
TLSH
T117B54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ffe6291887ac081dd20f524ea059a75f88cddd65df49bdc885cafa733130fd13
MD5 92731a5b7c3fb1808aeace74d7924e06
SHA1 8b79599953f9736332c7f9b019a2debd4dd692fe
SHA512 a650c67cd58ec8fa98efcb7e84595838259f7e6d61950bdafe39d58235e15f927cefadc14c09752df20c8ca362cce8110a9c47847746f3c97bf48966acfa240a
SSDEEP 98304:Ey5112gYy5azzVvt69nLKnhZd11wlNQ1ya:FLIHEWhr11wl2
TLSH
T122167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5d1f0a92bf1c49e9816bd66bbd5f6b6050af6e6e7fb34e26c80b48053cfcd9cb
MD5 6993d598bf3d7b392a6acbcb59203d5a
SHA1 9d528782c5486273f32e31faaa6b3ce62fba4e4b
SHA512 1a4075accd957840662c181e326cc6a08e8996f3d427a31e1f7400cd1f763fb7a9e6ec00c538b6063197403f12494629b93f55df6748ad48552728106ecd7ce2
SSDEEP 49152:mB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl811tmlNQ2ayVup3:Uu6Jmdxd2d811wlNQ1ya
TLSH
T194D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e2c52b78e90b8c45c3ae124d46c030c73a79cd209dfd04a05661c564ac586620
MD5 e880ab409108ce74123ef6fdbcc5c56d
SHA1 f69d0bc854c3f8d76b336884ed784e55781fee43
SHA512 9bded5ef2549c2a55092bbe6a59ee8a2a9b12d1557ed27ae108908fc7d58ee08c091cdaf0bf6b94539c3149b4ac8343604ea69d60fd5571030cd755394580496
SSDEEP 49152:n1hpsNoJpF1A63U44CwH7R4xY11tmlNQ2ayVup3:nmifPWRT11wlNQ1ya
TLSH
T1DBB5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d46b2c87ad78c42d873ea0edb83aa799f96915fbc1a65b63c694e29f06f7a0da
MD5 ec9f7325d68d3a272dda5280db36daff
SHA1 274b193fae246e9561f16373f2e0e172ced2faa2
SHA512 77631b0d29d938f55184a9a3c011fb724476c9f5dd64c7b594b2602d85f53e42c021a2b0e7df96d345e39b73754265cc0c9d51625dca8120f1ba142dde02a308
SSDEEP 49152:WSuZQIY0Be2KcRVtOnks6NMHqB11tmlNQ2ayVup3:45dKii61B11wlNQ1ya
TLSH
T14CC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4600d5a604f898480fa549248d4883fc16325f9ffe7d6421affc44ed505db4d2
MD5 5e3febc0554669e52b60a29e6defa8ec
SHA1 72c1afab33fe36221358b47e1c2f0843ad2ce369
SHA512 e5a49a35996978d87f4d03a24af3ab5b8e973f82f6f5a5ec6ad6d06129d0722769d31a8f54b74aefd686b95c89be46171d5b17db1076d22fd10cd253fcb1d5bc
SSDEEP 49152:ihtSn8EApI0fig3giDn0AP5ws11tmlNQ2ayVup3:DX2imph/11wlNQ1ya
TLSH
T19A95BE13F2D900E8D05ED174C7568632EA62BC160B39BAEF0A50B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bda3873f20e7ca8d662b1f1c3849fa9d17d0ff6fdca408a5ac65b64512accccf
MD5 029465cdb080c67e97447615c5ae01d6
SHA1 7917185d765083b0c141d09ba5e2ccd12b55733c
SHA512 ab13da2e76ea03df0b340af6c8e075293189e03a01877a212cd8c8dfe4a06e5481b2614a3807de79295c880e563be818a73903b254a6b56d2b97ddb47dfd7992
SSDEEP 12288:5nlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:5nl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1A445230814A70CD9DD538BB090738ED4A8DC7DDBFB5B20675B0430156BBA7BD235E2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 36d3016ef47e1124d857e3ca5bb312d39a268b254ceba01c315f0abfe4a0b149
MD5 a508fc3f298f83b8c4a95b2f7149e6f3
SHA1 dc607ce74735fb52e2973b43dc463a95e1dc34ce
SHA512 c2d96a0db73a0d7836558725d3cbbf20213ee2e503c66b1896c44dde476993920f183658c60acf301ca010d8172584dece4ffb18c4f95bdd9c2cf15890d0fcd1
SSDEEP 12288:rSlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:rSl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T17645230814A70CD9DD574BB0A0738AD0A8DC7DDBFB5B20675B0430156BBA7BD235E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2805ef59a1b35eba5a4c9ed979c8b551a921e370e274102855216766863dc210
MD5 7ee17d37e7d99c8d97725ed86dae67c8
SHA1 0ce830da2eb843fc84df6918c2336f35d365062b
SHA512 b30b904a38b17d0f941c7626671cc8cad6fa95f2c95da65b776aa28a824bf9d8ff741ade706ccabe5bfda77a245750ecd85e0ead1173524a210a982a004a193b
SSDEEP 12288:tclnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:tcl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T19E45230814A70CD9DD574BB090638AD0E8DC7DDBFB5B20675B0430156BBA7BD135E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 23e0ef13dd360f7a6f6ec9ab970e928042cf532ff6f15d6b9626134791e08ee0
MD5 2fbb91a3fab8539436e16594cebe51db
SHA1 aad0b99d5ac9677b3633d21a3cf17607ecb3fe19
SHA512 03d971a5a0f29bfcece0cd16ba2ea613d536065bb08aa3a3717d7b09af7b7a15e44cd81a300fe6d933efd2a0f50cda87399f93f358258dc06c360ad5a683527f
SSDEEP 12288:oV5lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:cl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T17C45230425AA08D5DCA3C770D4738A91E5FC7CDAF72720AF5B0024191FB67B8673A7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 733d5a620bb7d7bf649d36f76d7d5d4bf0e0f83526e77e134e56ab9d62e3d2f9
MD5 d3534a2d4b8de312e30d1ff47435b735
SHA1 615c5b95e048e55987a22783a8c44696b26672dc
SHA512 304a923c0160c9ba03cbdf8fc8c51be283de462ac107b9153c5bae379ae59811b7d0a0c5ff0ee7bb63bf5962e9e15b9c8a46bff2ab12c6b0f8481fcdafc488bf
SSDEEP 12288:VRlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:VRl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T16945230814A70CD9DD574BB090638AE4E8DC7DDBFB5B20675B0430152BBA7BD235E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6caa43f98f34e5de8c3a35f84b61238f2fca76d5300e1eaf33d63babf78d44c3
MD5 c20d6ab02eef8abf73fa64613379a3f1
SHA1 8c790efc87a52c5ef341dcfabb2466a79789a19a
SHA512 7933373ca08166ea0b7233cdfa1910d48b5dc0605f400abcc2b814f96c2d051fcd0564b503e04895741d8287c6754f688a5a3b86c832ebef5cc4fc1d3233e484
SSDEEP 12288:P2lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:P2l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T13B45230814A70CD9DD578BB0A0738AD4E8DC7DDBFB5B20675B00301567BA7BD235E2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 117a6ffb846ba689bb57e7afed6a239c9882be5f6a2685cfd6c4681b42fae3e0
MD5 8808ee77f63edf6b751a450ae11173c6
SHA1 bae44a2a5c5fa52debf938fcb8b74e466b7ce718
SHA512 241b25f6cc30d82c3c022b31558cd9610ac8224e80d15db76af84938770ae4e1bbf25432d1727b815baac17a82e810887c336b9a9c6c4cf39b96479a11d40342
SSDEEP 12288:KqlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Kql11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T17345230814A70CD9DD574BB0A0638EE4E9DC7DDBFB5B20679B04201527BA77D231E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b220914899dbb5b215d33d0ff06726a2bd49dced582ef3e89835552e24131fb6
MD5 9f094a2d87cc4dcd03a114c89953995b
SHA1 aa887b2457ce44b3412879576da33082dd2c7de4
SHA512 c7c7e6b685f9b5fdf924578c0d422f8cfd7b73ca4778aa7ea25e8b2b8d216ce731a821dfa3941dca69675fdefd76d34ea64c40580a30884b748dc9e21358dc94
SSDEEP 24576:UZMRzFVSOyl11tmlNQ2OnBdFQtP51llPup33kT:UZMRzf+11tmlNQ2ayVup3
TLSH
T13365019473901CF8EC67823AC8668916D6F27C5A5B70C51F03A436275F733A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e0af1f9a0110d8440ac7e9d88b6b4edc92659b8034d44360dc46b59fea9d9a3d
MD5 49bf2777c44b9e84e4ce56fef26a0fe7
SHA1 41a0f699c2bfc2a60859b420cca63b0b05a0becf
SHA512 216c5d43377cf27045997df6a00715162aeddb55a91f8c4f5c33e26b24e1ada347afd52011525b01dca14aeea549d1483aee5af4eea3e00505773878180fe0ce
SSDEEP 12288:7TlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:7Tl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T13345230814A70CD9DD574BB0A0638EE4D8DC7DDBFB5B20679B0430152BBA7BD135E2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0a75cb36be298ca98ed160fd61dec117bc3ada7da8f847441642460a6431246e
MD5 3001fbf1b53e2519711029e182f75ea7
SHA1 baab4a2d84b66a49996c6554a4426b4f735c317d
SHA512 3871807648d32b4e0253c1ae5559ba89351a036ae7819a1e816981097d013efe7fd7f2f5ccf3bff6f27f2fe09bdee3d5046473c21eb96e55d2ff44b000225b8a
SSDEEP 12288:tvlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:tvl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1F745230814A70CD9DD574BB090638EE4A8DC7DDBFB5B20675B04201527BE7BD235E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 23a4e1e87ced73ce2fc5a022f4423daa85b07e0f24ea92c70a3df0c171fe9a8f
MD5 74f4776caa77221353edf0ae1eca8a8a
SHA1 32d981b3c3dbdee7f73a1baa10ee559739697381
SHA512 f4389a58da647e584c7524fa4316aef0948c96950076fe45e43a1acc8602d551f51484e34ed498f5c5e70451564c5ddc62d3578d8667828395b44a5f2812d805
SSDEEP 24576:yzy+l11tmlNQ2OnBdFQtP51llPup33kT:y/11tmlNQ2ayVup3
TLSH
T14055020B32A220F9D5778234C8A20E41F7B9B8765B2559AF1710163A2F377E45F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 499984fca48959ca7100a5e3463486812f980a1f1f151dff8a85fbed8b606df9
MD5 165e1d8139a3cb52b7a565f1c4321df7
SHA1 14342956a7ebfe41197622c0b1d6bd0829787e57
SHA512 8945e44fdf42e8da4eebec57a167e8799c751f0ac9077e6edd30b39b96b62df9c8ebb5e9c784d527392a839b0da965342e9f8d329ea2d9e0426727c0fdd2f374
SSDEEP 12288:qTlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:qTl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T14C45230814A70CD9DD574BB0A0638EE4D8DC7DDBF75B20679B0430156BBA7BD231E2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0fd90d24040ec580ea06408ce6fe2150cc2330af84fa6232ae3773be50ccd37c
MD5 c6c164834576918ec3492ab1349ff94f
SHA1 b394b8b045979de1556c09a5988bb79cc45834ba
SHA512 828492a471528bbf40d2b6a951875277f764ea796788290097b6a7549881162b016a8bfe81c04da116a31b78842a854ad1826143374632b299b3e300154c5eed
SSDEEP 12288:PTlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:PTl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T11A45230814A70CD9DD574BB0A0638ED4E8DC7DDBF75B20679B0430156BBA7BD131E2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 97bd8ec148fb5f6049079324893351723c2c6edcb5514582fbd9ffc79c199257
MD5 fcae1d30b140c1eb9ca31e53e11ce6bf
SHA1 0b77a9540d7cbb63b1f04d30855a00820eaff784
SHA512 4fd21ed3bac93f36c3b04643aa03d9df5d4fb3134d04653e5ef52638fba9ca43058286430332b3bc1bc6cfe334170840b1094c16b070b759789c1fe66ade6327
SSDEEP 24576:Fzy+l11tmlNQ2OnBdFQtP51llPup33kT:F/11tmlNQ2ayVup3
TLSH
T13D55020B32A220F9D5778234C8A20E41F7B9B8765B2559AF1710163A2F377E45F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7d37f38f75ff0ccbe790e9e0e82cd6f5d83d280b58e0af2af22e065f1757ba55
MD5 46aaee2b75ae27235c6e8d99aaa302aa
SHA1 3e5d5369428f82ae9bb8c7beb5c7c3aac4ca950f
SHA512 ce40ecafbc886af0d17606da8cfdd52c86d3ed724f7a3aecbb26ed7b5c187ea2d20887ccb74bd6f10c8f93fdb302883b2ddbb9a31e41605b9c9c2163fb5612c9
SSDEEP 24576:LTDaLl3z0zDMl11tmlNQ2OnBdFQtP51llPup33kT:LTuLlj311tmlNQ2ayVup3
TLSH
T1AD65029473901CF8EC67823AC8668956D6F27C5A4770C51F03A4362B5F733A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 495766aaa318e58bc6d0f4ce0be98200c90ac2daa67906da52047913f15d2a0c
MD5 18ceeb451f9ef50378c5866a1fac0458
SHA1 63ae2331188146b1f7bb96ef26228728845e1591
SHA512 e9aab6b4eb029ab095280befcc66ed45a233bcb00bb1b0cfb30bd1f1271686ab352d438b2e39a7546b729aeb2bc3a064d2c91f39ca59e42441a9d1dcd5948cf1
SSDEEP 24576:R3vd9CHKy7GZQl11tmlNQ2OnBdFQtP51llPup33kT:Bvd9CHKya+11tmlNQ2ayVup3
TLSH
T14B75CF90B3E414E8F0B78A35C9764511DAB67C9A5B71DE8F03A4251A1F337E18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3f31d3381e2fad9801c642fbc59bb78e0fe6f2f9756c54b8af7e946b6c5af68e
MD5 9f293c4963fbfa7cd35c01f2ec921b6b
SHA1 0770183f1be6d539d4d6f5c12960a60f379847c4
SHA512 6f17ec7686e34a494a00ee5e218764800839acaea8b193d6332d614d1dca54b6d7e8630e8cc13dcecc528e731fecea349495fb7dfffc575ec7798e981cf6e5f8
SSDEEP 12288:m8lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:m8l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T10E45230814A70CD9DD574BB0A0638AD4E8DC7DDBFB5B20675B0430152BBA7BD235E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f22eccc8be83f2d3f703f30e0757d97ea6565f3ee12bda3ca963bb71b90f3edb
MD5 c0cadc00a3a5cfe012b39d5f1c8457c7
SHA1 2486d7ddcd761229e5fd4a96da0826d25b8fb081
SHA512 a886b7c8494ff6b08e4d4ab6cf21ec8445ee7450911d399e52925db44837b8b887f76b4d77bd31f55407164f1f96bcc1a8d2e42b63f7316b6cb591432a8118df
SSDEEP 12288:KelnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Kel11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T16445230814A70CE9DD574BB0A0738E90A9DC7DDBFB5B20675B0430152BBE67D135E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 11ac10caa7d9e2bda65beac4b95858eb779fca7255c9e407cf9433c61a4465dc
MD5 59a19fdaa01050d90a01844aaa20fcbb
SHA1 460a356feeb5366169f66a7d2ac76fa5346356ac
SHA512 283750e7480d74d96701ee14044a19cc6b8edc9f4f2a610971e71fdb1dddd85bc8d09a8e519a0ff0fb2b770570732253d5aa9a34c3d8c9d0809db6aa3f954865
SSDEEP 12288:qllnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:qll11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T15945230814A70CD9DD574BB090638EE4A8DC7DDBF75B20679B0530152BBE7BD231E2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 81d0e9d62b20a5d4195e06153d399c00aa52c2177fa71f373f79e7bf79e3df60
MD5 142bef38487e2697ed0ca3d50d7417e5
SHA1 b509b33053b4a96f751b3d830a78927f1ca13e00
SHA512 05a48a6926aa21b0bca90d3f064d9ee5b4a1aadec0d6666fa295fb36ce41771136b778b7ba4248a292fab67dcd15236ef6fed1f6c44e2af1140a71bf3bb0ffc3
SSDEEP 12288:nTlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:nTl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1C145230814A70CD9DD574BB0A0638EE498DC7DDBFB5B20679B0430156BBE7BD131E2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6f0e1a32ec533ff78d45d332397d60097e5b5c069d4ebac9fc8c5520dd6aeda0
MD5 33136e308a95ac90a234ad4e4de0dce6
SHA1 76b0705b4f6aa46372b4b1bba2b727220e47d295
SHA512 9482d34b04318985dbfadaa09ab0c9f85d74a4a0ad05bafc63f6f224f64a02bdecd0792086331a96de824f256c072dbe037085301800a8bab5911c8c29d53259
SSDEEP 12288:EbsfDlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:7Dl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T10C550108D29801E8C46F5270C7628A40F37B7C6697E292CB57C0F53E1F7A6A45EEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 13dd20a18cac3149c52404ee306a9a1bb4c5292a64fbefebc2f92a07219860b5
MD5 e8ee99c5095dc4d7c95776bb53cb7c00
SHA1 d96247b6a2565952ddbcc8c4962c7723d8ec3cfb
SHA512 894d20886633d94e90147e31cf062fe799f9736f8aa46ac444b1c4083940e3d033276a51d654ee32a6b5a087e2b5472f191f074e12f3b26f9b7711d0792b6c09
SSDEEP 12288:9PlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:9Pl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T12E45230811AA0CDAECB74B705073C97065AC7DAAFF5A1057A700311927B9BB95B2F35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 82dcbaa78408301fd413d1eede37d20173a434c9c078eb5f5252ec6d2f89a87e
MD5 c8a01e62e95917516748e2b47b299025
SHA1 10df4144b3cee945582490ef0c71c0a655547e78
SHA512 b2358e57ddfda95cd401c34a849a1c3b05b6eefd6769a9a365201bdb5ad490f81869034321009ac62036cc5429f03d2d83cd54afed84a9391522d5a5f00b8d41
SSDEEP 49152:2a0h2GEkuAe73q3pp46zwwQP11tmlNQ2ayVup3:2a0hNYG4Jw611wlNQ1ya
TLSH
T1AB85AE1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 6a611ed14998d50679a3b15835ff42c6e026ef3b44022100d2763b24ac866e8e
MD5 68d2178d010396e2026b9d7507ce2295
SHA1 00e146ab21784fb019f02760b4d21ece1a0322ba
SHA512 404dd577e70bda510c3064ee6dc9a07ff9241e2cfe299b8b94d0a7f04a979c4ef71078dc185899d30c93262d9584ec1ef9ceec22f5489b71dea49e7acd0c1de1
SSDEEP 24576:QhbHjPel11tmlNQ2OnBdFQtP51llPup33kT:QhbHju11tmlNQ2ayVup3
TLSH
T11355123C16AD14D9E572D27891638A46D774BC66271263EF1381813D0F3BEF81E3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2d3a86bf2e03fe6705da17c2e87869be8b10b08b06687505d55dc632983d3bd6
MD5 93cc734ee1953334e6cc90ca345b02f2
SHA1 e4ade1e97f590ccf664f4a87a7569e2187104c55
SHA512 e317810f46171af3c6eae79f1f56e712b3ac4cda8d192aea0df92cb314d2c41fff77cbc89033e46d394e3f1a19c6a76caa869c757d4e7facb8d5ece56f9f55e5
SSDEEP 24576:W3YgnJcRTk4yti+R5dpR/Gl11tmlNQ2OnBdFQtP51llPup33kT:WIgnaTk46ppR/+11tmlNQ2ayVup3
TLSH
T1F145BF2DF2B910B9D8A6D236450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 351add3de704cdb1e3629b868625d6a170b24242bb7333d53354149f8e7b0c08
MD5 449a1e60376ad8b31486665728e27406
SHA1 f9ee9d5a7dd34a253c19bd37874b34dea9acd96b
SHA512 e157b25d58c6e04766963523f5beeda85ccb9bbd4907a5799e5d3c4f98cd5998a2f9149966e57f91beb56943330721257bc175358f7666db310f619d3dc3d5ef
SSDEEP 12288:27lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:27l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1FB45230814660CD9DDA78BB050638EA4A5DC7D97B76B20E75B00301527BE7FD137A29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 07e4f248b0fb0893020e93c70d260e7a5733c22adbda0df19d74320dfcfd2fc9
MD5 244d57a72b713adf97fe7c24a3048461
SHA1 62fdd60a0855b9349e5ce15f01ab6ab4e2882a3e
SHA512 9693927a79d3cdf58b547ff4b27a5a871f5674a306f990c6c830179b0ec3064dbea078bad588191fc8bf27452368d3f561424854c2c8e55b729e27f655452920
SSDEEP 24576:qbL3UTUl11tmlNQ2OnBdFQtP51llPup33kT:qbL3U011tmlNQ2ayVup3
TLSH
T19575F114E6A504F9EC77823CC8A38A12E2B2789D1764E6DF03684A651F637F54F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ec4146720730fb0d0389264f51d7f62e70e8fa7b784e33ffba501860482094fb
MD5 8ed167670cc0d4e00eaed7ce62e3b080
SHA1 f357a86f369b645184ae2500acebcc0c8b3ff3b1
SHA512 c9e87be0309f50c1e77d333804bb74f4c8bd5dd85c8e4673ba9002f62049713d1899a98d68a2df4400224091603374bcfa61e31a6dda0a39f973ddd1ee16017d
SSDEEP 12288:3pFtIOwlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:aOwl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1E055121832ED14E5D476923885938749D3B5B8A6572213EF0380817E1FB7FF86D3AB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 173c52e09c9f0d4dbe67640135f88050f406b08257b41c49131fc101b93f9fe0
MD5 68c781fb05c479e794109b1392f49653
SHA1 240fcdff87fd5e3ec38d82322e575bf63345d0fe
SHA512 08514e4b777b25b04ea3a639168d97a6930bd76ce2d65e4f314eeabf48493f86670ce661e0417384bc88eeba9e37f68abff836d1e5c84fccf70f9a74514a448f
SSDEEP 24576:H7NM9YmZqmWMUkPjZM48Mv6bEhsfl11tmlNQ2OnBdFQtP51llPup33kT:H7cBWMpPjN8DbEh211tmlNQ2ayVup3
TLSH
T14D659E2E6BAC81E5D477C13DC9A28645F6F1B4611B318ACB1252833E6F37AF44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d99adb968d4405169598bc80fb43a6bdca0e5e6ba6363ac5b09927040b7752f6
MD5 dd790a1ed304770d3919a3dd208c390b
SHA1 d410c20391a672ae777e856014f5e8b8729a6e64
SHA512 c0e187c157f46ec3dfe7d9039fc2039e59632b4242b97eb029105ba922a6a79484b316055b14c70ec6ade744cd04e7ac4c908c23cb404edb4ee58fa8474b31c1
SSDEEP 49152:7F2YuHNETovcvNYf8km911tmlNQ2ayVup3:a6tCf8kU11wlNQ1ya
TLSH
T183857E2927ED80A4E0BBD27D45B7D286FAB2B8551B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a0eca2c51537c8e27321257567a8a771ab475159644778b84f6f182dc1fd04c4
MD5 4b8d2accc6a985f15f0f58026149c978
SHA1 7b5aa0564ae5291da09129d8cbcaa9ce66e521e8
SHA512 26d1a56120ba3acaee7d29149475d7bcd9470492c2e35cc8a609f0f81f534867c8a64402fd6a2d0d59a6426ffd4f9dfb01f860be68cec9fbb671ff30b5cb0156
SSDEEP 24576:VAFs06+OmlfkNXEbTosl11tmlNQ2OnBdFQtP51llPup33kT:aFs060lwXuv11tmlNQ2ayVup3
TLSH
T12065AF2F62AC00D5D07ED17D8997C91AF6B1746707256ACB0260863E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 4fcd9563a5750f56f90a83dd6c4eba915423748edd448de01f07ba25ec2805b8
MD5 4b9481a8ce3fa6d52b4ae73fa3b083d5
SHA1 dfd39153fe98cf2b6661e5a4f0cf98be0463f20c
SHA512 632ddf93643d21441a79b61260ce45dd52f8563f1e350cf35d8234708d4850de377e0c6ba140b6d4d9dcd83cb9f212a6ce283d8beac1628f0d58c4b1cf019568
SSDEEP 24576:vJnJ5D3Wtll11tmlNQ2OnBdFQtP51llPup33kT:vJnJ5DGtv11tmlNQ2ayVup3
TLSH
T16875D02CD2A810E8D4B7C374815A1B95FEB2387D2F2269C72864D5353F22FE09A79F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ffc38ea4bbf1e1cbfff2d959affc9d9ccda7232e70b538387c0f89b1c37260f4
MD5 6334b60e8e6cc6c9ab931ac50c9233cc
SHA1 07cf6f013a6c60019b3f47d57cab5799d714e37c
SHA512 b0f571ddb54bd67b239ecd133087c500ac57d9f9ae2ab312748d04fee3231bdd74e67106949cfe648d1b5ef718353c4a9afad8a9532881fbeb6f644309681b67
SSDEEP 49152:po06DIKdwc+eQnSt65aVx11tmlNQ2ayVup3:+z11wlNQ1ya
TLSH
T1F8956C05BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 73ab5129199d4a419c650ea53a288e5cb872844ecf61511c8f251fa15744c963
MD5 3da0050392097b97eec8e1c63193866c
SHA1 3d8ec1f6190f58b33a180cdf1b1a2d2415a6df6a
SHA512 da3af915b5f7f59f575bd6b88ac06525bb3a0c1d19bd3804c2e9805ec9f88533965e98b666b7a95a78714b03898e6f81dca543bbac4cc877cb59d69dee632c20
SSDEEP 12288:UEP3Rr8lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Pr8l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1CC55121C26AD20E9D427827890A28A44D3B5F0B56B5327EF1750813E4F7BAF92F3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 70d60ca1c7fe019189ca417b1c168edc8a4b76087bf8002ce929eb66b7a7bbce
MD5 58597460c96eccda9ddf20b0318a4a16
SHA1 bfa02c0057db3f6c65347434eeae523cf0ba4e87
SHA512 252fc2b9ae19ed98d4e53ddce68add71b616deb1e94941df6eb9271e0e7be8d7c100d1a45cf3d2e2be0b6db2f9a8cbfd0c9b95e5e043ae985666ba841c1b1cde
SSDEEP 24576:zIyOl11tmlNQ2OnBdFQtP51llPup33kT:zIf11tmlNQ2ayVup3
TLSH
T12A552308239818D4D9B74734D57386E09AB8BC21AF2211EF5240F23E6F7BBE46A35757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 dc12917fd61192ee32e82ecb31cf17e68a24db7b3699af0c920a48fccf6c1c41
MD5 f64c78e68adb58b23422856adb327b6d
SHA1 1c783b757baa1e76c02c1acd2bee8908960aef20
SHA512 2f9a62de09984b3b27e1b442ecc83fa222044879045eb8cafe183e96055647d9c983ff3cc91ba901326a16d688012997f75e5c6218448a122c0368d8446b87c3
SSDEEP 12288:dFglnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Dgl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18745230C10671CD9DD634BB050738EA0A5EC38AABB5A30FB560071355BBA6F9237B696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e90a09ce26b995b6a44bfb34167ba876b0e686b768e6b34ac1be033316880572
MD5 d0a9fec9e12e549b197229c1c1f28f04
SHA1 f7ea582a12c6b520a428d7732a6da1dd48d7f751
SHA512 0d4d03e62522f11aadd54d8365062f2572ac3de2c7e09c84056a5622d4e06015f684bf2077ad2b52d6f3742efacc025f6a7873c517a97421b39f229681fe01e5
SSDEEP 24576:yQ9MxZKdcz97w33l11tmlNQ2OnBdFQtP51llPup33kT:yVKXV11tmlNQ2ayVup3
TLSH
T12B558D2DABE909DAE177C27594A240C3A673B4311B35D6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 88033b76948a556f36167d6367888f25ff07a749b760af404ad7352528cff492
MD5 20694cbffd52c104b6e2bddd3997743f
SHA1 310cdc276117235c2dc8eac2b179c17333154b6d
SHA512 bfba4ed88ae3a78a33605ca05d4b5fd6cfd6095e89593f40df976ac911e69d69ef4c6ff86c9571d9c002144fcc7903dfbe9a6253c6ff4d45b1ac40b31c7eeebb
SSDEEP 24576:vyocxApql11tmlNQ2OnBdFQtP51llPup33kT:qocxApS11tmlNQ2ayVup3
TLSH
T18465E01F776A00E2E076823888868745E7B3B0715B6213DB5681C33D4F77AE97E39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ff4bc695021478abb90a61485703380428c197a637773098f74e1eab46e7d2d7
MD5 a1f9751f06e0258ac7eb376c55ccbc2b
SHA1 2d47f3fea2e7a36be0f55093ac23c110faa05f03
SHA512 600eabf87b308bce528bfcdda97838ee62135e432855be139644fd3ccfde7ee576e13f6db9156322f5f9412f66ccbcee3e8f1b3f866bc317758f3c3b0ca4882b
SSDEEP 49152:XWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKS11tmlNQ2ayVup3:P0zuNIO11wlNQ1ya
TLSH
T1F7A57B3DA2BC00A8D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4b82c2399996d9ea0474b1d3817387a97b8758b07415b5d6844aca777f4a460e
MD5 23c0feee0cd205e04ca95f19e8b5b0dc
SHA1 13c0fd7865b746c542da15b72e2c00f106002f15
SHA512 ec9c68b9e0bdaa56f40722b45f42cb04da6fbb04328b0618447a06417491abfa15fb98c2b80a4e636cd10704af73251ad3b49f4afc33287fa71533c48ad129de
SSDEEP 24576:y1QT7EcpfxR+N5AWAz3ooiYujMqb8l11tmlNQ2OnBdFQtP51llPup33kT:vTDxR+N5YzT4jMj11tmlNQ2ayVup3
TLSH
T14055B02E67F905E9D1BE86789A23C512FA727821033193CB4260C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-228-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/400-30-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/400-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/400-36-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/452-416-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/452-419-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/452-599-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/636-449-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/636-424-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/636-430-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/636-600-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/636-465-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/636-504-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/636-431-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/820-303-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/820-509-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/820-309-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/820-423-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/820-302-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/820-507-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/992-596-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/992-376-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/992-375-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/992-382-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1304-374-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1304-263-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1304-259-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1304-269-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1328-13-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1328-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1328-22-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1328-227-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1460-343-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1460-513-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1460-345-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2108-398-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2108-289-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2144-282-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2144-386-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2144-280-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2180-322-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2180-320-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2180-314-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2180-506-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2304-562-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2304-355-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2304-356-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2304-348-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2508-260-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/2508-262-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2508-248-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/2508-254-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/2508-247-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2588-25-0x0000000000070000-0x00000000000D0000-memory.dmp

Download

memory/2588-8-0x0000000000070000-0x00000000000D0000-memory.dmp

Download

memory/2588-0-0x0000000140000000-0x0000000140BC2000-memory.dmp

Download

memory/2588-1-0x0000000000070000-0x00000000000D0000-memory.dmp

Download

memory/2588-7-0x0000000000070000-0x00000000000D0000-memory.dmp

Download

memory/2588-38-0x0000000140000000-0x0000000140BC2000-memory.dmp

Download

memory/2624-406-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2624-399-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2624-405-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2624-598-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2900-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2900-77-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2900-75-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2900-60-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2900-54-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3172-512-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3172-331-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3172-333-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3172-325-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3196-297-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3196-291-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3196-418-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3196-299-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3736-243-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3736-236-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3736-237-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3736-354-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4340-521-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-520-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-516-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-517-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-530-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-522-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-524-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-525-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-526-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-527-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-528-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-514-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-515-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-519-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-518-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-523-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4340-529-0x000002BA3F4A0000-0x000002BA3F4B0000-memory.dmp

Download

memory/4528-230-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4528-66-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4528-74-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4528-72-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4572-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4572-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4572-229-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4572-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4832-360-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4832-367-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4832-361-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4832-369-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4832-372-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5112-597-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5112-393-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5112-395-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5112-387-0x0000000000710000-0x0000000000770000-memory.dmp

Download