aab6fc721afd29279d0b659471a650f6d55d91cce744ae738c8ec268739d2304

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Size 1.7MB
Sample260808-py8kbafm3x
SHA256 aab6fc721afd29279d0b659471a650f6d55d91cce744ae738c8ec268739d2304
MD5 61586bab874d6283b1cd1ab8a2953d82
SHA1 70962e700a8fb83e5573689f1234127fae33fc79
SHA512 3f6c83b22444f0e43c1114aefc361ae5e260ef3b9d0a04a2430b112b1e29629e86be112d9f6ea8c84ae88baa7835c416e342f4ec620dd1ceaf94a26849525029
SSDEEP 24576:Azn4lgwg7LJft9rAutNCirDNIo++/Foacs:GCe7LpvtNZDNV++/9cs
TLSH
T1BE85F111B280D072E87702355FB9CB6A663DFD540F6542CBB3DC2A6E5D742D12A32BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2860	alg.exe
1408	elevation_service.exe
2816	elevation_service.exe
3876	maintenanceservice.exe
4932	OSE.EXE
5048	DiagnosticsHub.StandardCollector.Service.exe
1820	fxssvc.exe
4316	msdtc.exe
3236	PerceptionSimulationService.exe
220	perfhost.exe
5108	locator.exe
3684	SensorDataService.exe
2888	snmptrap.exe
1616	spectrum.exe
888	ssh-agent.exe
4796	TieringEngineService.exe
3812	AgentService.exe
3848	vds.exe
2436	vssvc.exe
3712	wbengine.exe
1672	WmiApSrv.exe
3640	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4950e76e52bf895.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000121691063427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000999b21003427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9eb10003427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df87e4063427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000308e49063427dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025dc57063427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1f32c063427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe\""	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4112	2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Token: SeDebugPrivilege	2860	alg.exe
Token: SeDebugPrivilege	2860	alg.exe
Token: SeDebugPrivilege	2860	alg.exe
Token: SeTakeOwnershipPrivilege	1408	elevation_service.exe
Token: SeAuditPrivilege	1820	fxssvc.exe
Token: SeRestorePrivilege	4796	TieringEngineService.exe
Token: SeManageVolumePrivilege	4796	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3812	AgentService.exe
Token: SeBackupPrivilege	2436	vssvc.exe
Token: SeRestorePrivilege	2436	vssvc.exe
Token: SeAuditPrivilege	2436	vssvc.exe
Token: SeBackupPrivilege	3712	wbengine.exe
Token: SeRestorePrivilege	3712	wbengine.exe
Token: SeSecurityPrivilege	3712	wbengine.exe
Token: 33	3640	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeDebugPrivilege	1408	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 3520	3640	SearchIndexer.exe	124
PID 3640 wrote to memory of 1172	3640	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_61586bab874d6283b1cd1ab8a2953d82_elex_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4932

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2900

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:220

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3684

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2888

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1616

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1560

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3520
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1443a57ed16d17480ec5e9593d5ef6409dd25ac89d83b428a47387cd6b645e3b
MD5 58f224afcd69ce9579c7de823fb6181c
SHA1 70d3921b997062adf6ec1d0473bb1ad21740a5f8
SHA512 bb3b050c76c2a6cb13c3e957a1a1d628381274510796915be373bdaf3ae57fe78bb132ba0b1d9cb4c41c11a15ff472cc6a3ff133b88612a0136ae1eeb23b9533
SSDEEP 49152:Fb+632BuPkFKRrdE6ohQstBhuXjfS4LWxncvtNZDNV++/9cs:b3q6tjBVtNp++/9cs
TLSH
T19CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 cfee1c9d64f8586afa7787811c4c482742a056c4b5ee7855f77239b8b8d2f4ed
MD5 78d8c6d43df416a26886f00139b10609
SHA1 19e79a8797182974978a7145347cd43c9a4e8b21
SHA512 d462d48f1778ce0ea01547dc7bfdb4308c9193b562ca5c8bde1f9ec9aea66c21504516f68b5900cb5ccfda79143b5060f122e80a6cfaad778c0836240ae863c1
SSDEEP 24576:NXYfDtczARft9rAutNCirDNIo++/Foacs:YtcevtNZDNV++/9cs
TLSH
T16775F129A3D449F9EDA7813DC8A2C505E773B89447A0E7CB03A895294F333D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ff973f3d1b7512b192a31012199668b193a6e76490684f19cbb0b238fd2a42ea
MD5 ef405d3920d7f2eb9531074be24cd714
SHA1 18f6ce81880256defc6d38d9718db6d9262d6f8b
SHA512 c6dd1d62baef0fd2f5ddb557aca4c8439a39d64ae61b259a89c39aca2884d2953f678905ebfe53da0565bd7f0929400747b6bb0485e940f1a03d517a4ff52fc1
SSDEEP 24576:X0Le5ji0hmxnrMUft9rAutNCirDNIo++/Foacs:XPji0Ax/vtNZDNV++/9cs
TLSH
T18595AE16F6748335D073C0B9C5D2A68EEA7230851B308ACB4296D77C7E67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a3d95fded7f78ff79d7461b41c1ceeab35eadbf0854e34b6fbf5d88b47bf524c
MD5 d8f4db64cf77b07bb1416485ad501834
SHA1 9c67bd0886328f74319dc094822a4a74a823b1d0
SHA512 dd761500c83ed62c6c263cd71f87a59c4878f40864f854776c8ba4799bfe6bc6f24bf9a36ca53c3dd9ab68c9719d8cc6692c05b387878ba9f1d6c799eabbc8a1
SSDEEP 24576:4a7/ezSC6vUyDZaqgrvWx6q8wyu2ft9rAutNCirDNIo++/Foacs://ezSC6vURPvMHjybvtNZDNV++/9cs
TLSH
T1E9755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6fe0b580234b6edc0592bb5b1fd1d52e2215741c4f7e224d7715fe1391bb7f80
MD5 7ee7d18e59fd1752ae96473d01b115c2
SHA1 c145626bfaf19afff5cc6a643807608bd5c4fa45
SHA512 b5a4985269d7437f93a34f441e5153187dc71fd286bb8b20b395103c3ac0e390392a21dd3d76d0fd5f785d9752a43d332156d48f1b427ae2e0f3f1569d9f8846
SSDEEP 24576:MVbqPb88hv/lV7Nft9rAutNCirDNIo++/Foacs:MVO88hXlVpvtNZDNV++/9cs
TLSH
T136559E66F574C331D073C0BAC5D2AA9AEE3234415B318ACB1246D72C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 564d27fba5a2fce51ae3a967ff368c1aeb2df96524d4c21e37a68d26d3bb738f
MD5 e909e28f1a8628ef297027a92ec76d78
SHA1 a52ce5fd7344edee07655246f0ef2f0886da2153
SHA512 e98f8f2baa1badde5e75965f166786916f652eb1ed549c4e793c118c439c392f4b973b8144a5ae571095d0e268d007c6d615e603f1f156728808ac0db6cc56d7
SSDEEP 12288:6Gg/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:6Gwft9rAutNCirDNIo++/Foacs
TLSH
T16B65235FD204C28AFBDA407B21FD9B0857B6ADC819A9455B236F750CC8B46B4D02F6A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 7826bce6ae1bb5ae771a06b9496763d72fbb4c9f5bfb139149c100ccd8af39a5
MD5 4312cecca8d20e7bc5be0669222044fa
SHA1 8a273978a8a1ab93a6748c3e2c391b00ffd2605d
SHA512 75e1d5bd41591d7edb71372df73d481f107c4de94006e5012cff9c17511539623a1bee4e77dbbc2c62c828ae3b9a6384c4a8973188691426b27d315a84a6197a
SSDEEP 12288:seBNUbTVO86UR/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gm:sJIU1ft9rAutNCirDNIo++/Foacs
TLSH
T1C085CF3BEE28FCD2C27E89B956918700D77278704B6293CBE175820EDE235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 238661df1d3c901c82370a1afeaf4b63db8a9842574e8dd97ee902648c52c553
MD5 dd81af0fe38856deaa15c7c2a8bfc97e
SHA1 bad03fd0d5801d5e5ec233f237105ed1995aa550
SHA512 0bdbc66b577b63ec7538675f9fb2fba96f4fb1075b678450f837ddcfcbbc30b90afad80542e0ec708f22983ef4abae6aba670e99a5d0a8ec8e6552eece7561c4
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH/:rQvGAdlCEL8c/pRNw5CmtNp++/9cs
TLSH
T143267C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 9f15b70740e48e196e108c5c3eb27b8eabdd30d72649518eefb00268fde7dd20
MD5 b45982ca61bc1b1cf62d862d0bfc0104
SHA1 eafa410a92e94cb2ce8cb9d6bd1ee952528ff375
SHA512 724c05a2dbf9b04a8a7dc694af715131a8fd1318cb2ed941bd7954780a7a56ef16ea19d4c06eff707fd501e56859f04a449e685c6ffbeda40217b4839b40ed28
SSDEEP 12288:SAwSfxL/2Dc3xDLLmt0LDQewsAjv/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+T:XwewsAjXft9rAutNCirDNIo++/Foacs
TLSH
T10285E031FA74E036D3BF0DB61B3AC716147DB9604B611AC3E3A85E4D89702D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 749c0216e95a0b149fb6f3bea59d3827f7b583c10fc836ab391a8a019c037981
MD5 bd2ed9a2fd299885ade80bedf42a70b8
SHA1 6ad3a048d49d65a271b0107f01a33b65d584dcc2
SHA512 8227b6b7c1052ecb3bc5bc19171ef77ec6777795dfb01edbf1f9bf4bab3fee8bd3cce23ada9f32e34e86e6116782b6d09c37ca442339dbb9c3334973f5021c7c
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHVD++6:UUEtQevvqc2W1cpV29I32UN
TLSH
T1DF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5e9e572d6013bc3194a173b7bc0e723297d20d2abc640192268d4d64b49bc098
MD5 0674d64195584e56745ee27671ebb22c
SHA1 defcb380e31ccb28b0f99273429dd22dd34dee53
SHA512 3bae37a8a30503613f5d87944ad6de453a3380db1550400b659eb2b24b40ed5492f188ebfd454e0108ea36c1a8d3bf8cd086249a35956b0989533e1b137323e8
SSDEEP 49152:CCbRquA/m2yL5zifFiV+XenmE3/zvvtNZDNV++/9cs:HoqHVjnmKtNp++/9cs
TLSH
T18BD58D0976B8C2E4D1F6C37886A2C647F37178154B3597EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8bd76cdeb2f35f8bc3a70fdfcb2c76f10fd0964b87e9e94192afec1032275b50
MD5 b2d20f4d1282e6ebc649d1ed69ceca40
SHA1 cd100367d741260ee8be4feec5824e3bc53b16a7
SHA512 5b53b630694a67b0ee69c51e8894ae88a5bf40b31fc6eaa881db8b3c6737e2d23c0972074c42d85821033459e6712f3a396b8073f6594d2c85880be029290369
SSDEEP 24576:yAhGLmIFoiwtA5l7S53Kft9rAutNCirDNIo++/Foacs:yAM1Foiq5KvtNZDNV++/9cs
TLSH
T1FF359D81E7F955D4F5F3AAB899B68170EA76BCA95E31C20F2160D10F0E33A509D25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 61bc0b766d95e2ec66a2924d4643389eae7c78b23e7642d3300651c6573bb305
MD5 e8f56b07446ea2d6350ac9d650c5d0ae
SHA1 6510740d56f7319c8a5a378ef0537f501aea4ae6
SHA512 8bd0b1170eb53d74b8fed8920b5d2f1c77a01ec201884d60bb2936a008ea0b273a6bddcd77ba3ba11340506acc83955f8f368f119f7854198a67ca40dda76d8a
SSDEEP 12288:emw5HEjsChNOBFgl0WDm+Cy/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc4:3wuXOWbft9rAutNCirDNIo++/Foacs
TLSH
T1CB75F14A72944CF9F9A78139819BC536E7F2BC452A25C71F1364C61B9F37360AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 2dc63bc249c5cad6a8ff5464acda2f59c7a879aa0ffdc22271249d5c0811f5dd
MD5 d65a4a24951d1fa1171259237697db8a
SHA1 604430d2c4ad2b7b6aa25b93e59abbbae5b739ef
SHA512 cd8cc936fd0e35a6ae189d39d2f7bebee11361b4e5f9880b6d33e99ebfb0ac3046432adeb30b7fe880c32e70e6514d01777f580c3fac3f07592dcb9fa8d98af0
SSDEEP 12288:EbZ1Iyf/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyc:MZu8ft9rAutNCirDNIo++/Foacs
TLSH
T1BA65125F229461F9F2E7413E84F98708D3B27895277643CF126A52199E72AE09C3E733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 94d97f7ba80380df5d37d62f21ff10c8636fe9439ae28f321c7298dd0c9b0cd9
MD5 f130dbd5be290761809c0b694f586836
SHA1 1fd057ed511731442091c19b0072b32793298e1d
SHA512 4bbd758a154c5682a6dbd8322d9db3146e0d37b9e8bde865d10e118d3cfa4f6dd6ce425bbcbf339b5a1885e761bfbab2abbcc3a33aafafce127822d23a1a4c71
SSDEEP 98304:MQRQyi36YOcPuLvw2gAf+PN3htNp++/9cs:TQyiKakX+PNnD++6
TLSH
T1A4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fb566f78ae3444a0f5a03fcb4add0ed5670c5dec22156f2d72ca3a3e999c7019
MD5 1b07bd3d5c4a84125c6601ac4d8630f6
SHA1 fa684201b9327b22f4fa203fa682efc236bf9830
SHA512 ca900e7455a2d5e39a285fa6b0ac36903898a9f04f5819ff092c9202512e930481cf001d8df055a4fd797f752a474d9c2fdfc3ca6b115c21947d61fc8119357c
SSDEEP 98304:LQRQyi36YOcPuLvw2gAf+PN3htNp++/9cs:6QyiKakX+PNnD++6
TLSH
T11D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3bed2ef4405667b3d239c37b52227d387f1884d09a6346c55886a581d3f2778e
MD5 cec106426ffb03eb2848d27055da71b5
SHA1 1f1fdfce281685a26804166329f55f100daef81f
SHA512 3a43d9af786098e2ba1f0232b166a692ad6858f5b46559338ddbebaa0e6002a402b0f886327d48a617a5220978a71aa3cf80b4680d26272650c22b4464952e3b
SSDEEP 49152:/68Qg55nhxeWu7PNU3//vtNZDNV++/9cs:5thGRc/3tNp++/9cs
TLSH
T16EB55A33B2F20099D44DE1769F4A872196D27C758FE0E3DB8515720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 333f2a973e2d7c969a637078901ad66ff8c45a0fe76804ca18f56f486601dbab
MD5 afee647377bf6b10587edf5acc34d293
SHA1 c9945cc85a32c468dc810d547a97ffe49a9b4329
SHA512 aad734835fbb66f414bfc390811f640af4582b1b2da36fd07fdbf8313aeefb0d379be6d9adaf2984183894b14ed047e83939ccba6722caea2ad787a9077dd638
SSDEEP 98304:4y5112gYy5azzVvD69nLKnhZItNp++/9cs:RLIH+WhID++6
TLSH
T197167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ba2ffa1c96f72f3680fbea0ac5fd10b521f23b08e96cde2f5c893347fa9d4e99
MD5 f1fc2fc06a3b62b27013f107ff765896
SHA1 acac5dadadf76f9128cf31f6cdc72d6844932eb9
SHA512 2fef826b9d96053457b995c00e9f0d85466a42f68cbacae409faa9895bc2401458508438b3510fddcdfbc3b8262f58a8c52d95cd28ab8b9895c4e250e2720bfe
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glRvtNZDNV++/9cs:Nu6JmQxd2dptNp++/9cs
TLSH
T1B3D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7e7950326e149ba80894cd7f5bf0a5b5b3b4c60282c72a6c8f0e51fd3950af24
MD5 3d1354ecc71ddc4d9cbdbf36b62bad43
SHA1 4f98e013af594cb252941db6c45d90ec5c547bdd
SHA512 4fe58685b03203c5c409d59c5533fab60a0d79565f6a3cee1fbfc3fc519b33b6e97bfae0fd7f974f71f3beca647d94b7b58fd93a87a396df421a3e7ea4cda1b1
SSDEEP 49152:r1hpsNoJpF1A6yU44CwH7R4xNvtNZDNV++/9cs:rmifPVRKtNp++/9cs
TLSH
T125B5BE13F2D801E8D05ED178875A9232EA62BC450B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9c3af270e634b20d9bef368ee77040e0c647a84837fb13e1c478eb6cfee26a29
MD5 4cad26b22b28ffa4b4f1924dbe4b3323
SHA1 14ccb32549cc50d52db0a6e7f68421fc7aa8c28b
SHA512 29c33ddd4b062f4bf493e80bc69bae65e6bc936783133f05e3e66e9c08e0eb870190320bb945795fbf4a49b8fe3c966acda5a55dbe4ddfe9cb0f175ce66b0bd8
SSDEEP 49152:qSuZQIY0Be2KIRVtOnks6NMHqsvtNZDNV++/9cs:05dKOi610tNp++/9cs
TLSH
T1A9C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 86c167a1410a9f0cb71fbef8be9bc0fe05a3335bdb6ca030d38d87def4a3ad1c
MD5 c046d901374cb83ce73bbc9c45ff8053
SHA1 c0a7252607ae919f26f11cecf64ced5c50b09034
SHA512 89ea9fc59cfbc1e72ca9e3d685a9cf87989660c17f8b6b35f7fcaa3a09e0765fcad8a8d9f4051a565e1957a00f243996870af5693df0e49e9d232e62849d1d5b
SSDEEP 49152:VhtSn8EApI0figGgiDn0AP5whvtNZDNV++/9cs:kX2i/phetNp++/9cs
TLSH
T18895BE13F2D901E8D05ED178C7568632EA72BC150B39A6EF0A90B7161E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 3c4412ecdfa2d7f1807b0f1c3aad59e15637dfc385d20bacaea43197247eec64
MD5 ab8e304ab67528bb2fa70560ece092fa
SHA1 10f67a451279fbd526e91051cd84a06273aeb351
SHA512 32efb0755c613d45c44679c8a8dcdb61b02ec0321a03babdea5f6a7e8fa7ee2100648402fdf1e928b5576911b44afce9ebc3f6662fae96dd26fe34ccfd8b9593
SSDEEP 12288:KY/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:KYft9rAutNCirDNIo++/Foacs
TLSH
T1FF65235FD144C28AF6CA417B51FD970897B5BDCC6AAA019B336F2008C9B47B4902F6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 7f69e12340761c8e33ee753e7a2b6cc14e954125f6d24691ed2f28e4a7138ec8
MD5 f9d04a95132286f54f1d2bdc1878ccdb
SHA1 27c79940d723e4d1c89d0bb51daebd15ac9a7396
SHA512 b789b8bf82a05779aebd94051da66df5060301aa9fdb7506c725dc8a8061271e5321660412b6334ebf25bf9b3c1702d0d9e059f7b64150f61b0ebb1bd783adf6
SSDEEP 12288:oz/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:ozft9rAutNCirDNIo++/Foacs
TLSH
T1E965235FD144C28AF6CA417B51FD970887B5BDCC6AAA019B336F6008D9B47B4902F6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c151dd4aa1333fed1881ab87368378b661e0479e009bf762ef1dcf1518180678
MD5 95ecad91b39ecfb14a10067613fb6669
SHA1 0e3909eecc0bb57710090ee7b55690548f0ebcd1
SHA512 036cae16b7ca4e5a34b018bf42ef0cf2e787ff84b6b54c513046811a7442f27b882fbbaf8086a62c5256fe59612df0303e8378041712ed5ee8042bee88122548
SSDEEP 12288:gJ/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:g9ft9rAutNCirDNIo++/Foacs
TLSH
T1CE65235FD145C28AF6CA417B51FD970886B5B9CC6AAA019F336F6008D8B47B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 e4a55f058bfc0045e209525e9bff6dfea1d24cb13f504be3c1deacafd35e7d69
MD5 6ff27e429ab54d120408084f7d70b716
SHA1 fc3f8c9dee63839e530c3036b45edd9806ada6a9
SHA512 2cdf489570a4a23567d5d8f7e18bc88a9a42ae76b82e5e0d5a64d8a940d95e23eb2f9a579ba4dac5285279359dd29193542c3f421745c14143bb74a4a6a46f04
SSDEEP 12288:fVe/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:wft9rAutNCirDNIo++/Foacs
TLSH
T16865235FA24482C9F5DA817A81FD8708D3B5BCD8677642DF272A14098DB07B4943FBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 676770126abdaa7bd17a4cc3d9cd6a7a5da9e79177ee9ca2cfe5ced2f0947557
MD5 7d8205e24769d0814bb0a301e1a5b612
SHA1 3f433ad0845ca718eb38d385417ebf403bd6c436
SHA512 998e8d6ee185ed420142a2589da7eac810e778893b11f9c19efd7a9137313338dc825e45b89f9beea42644348c8d82151b1dd7465f2348279aa9559d41f2d03e
SSDEEP 12288:jm/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:jCft9rAutNCirDNIo++/Foacs
TLSH
T1BD65235FD145C28AF6DA417B51FD870896B5B9CC6AAA019F336F6008C8B47B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 286581ab3de10a5f772dd3b878fa7b74e00c64d75dc718895085bf61050bd79d
MD5 a3b7fe4f33eb06ac774a216ef741dad4
SHA1 66caced60f60f39dfe9939f6f56fc11f821eb3c3
SHA512 e363f18a0c9cb3b07d9290cd0b86bb1b65c055412b839fa72188a3e1979a5015efd26a9b7f1719b42ac9e265ac71ee960238d85364c7f765d9dc332d372bebb7
SSDEEP 12288:an/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:a/ft9rAutNCirDNIo++/Foacs
TLSH
T12C65235FD144C28AF6DA417B51FD970887B5BDCC6AAA019B336F6008D8B47B4902F6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 390d695426ebdd2ec91c7f43dc3ebb74c1d5f6070103cd11e60ac9214760e86e
MD5 3fde3407681e19b8367d485217912cbd
SHA1 d3142287bb918721b0959c29c44e3b26674ee2d4
SHA512 12dee41578b5e64fc8460bdfae5cc1a0a7a24dfa814147fa3b12a8e063a02862d8c53bc289c06ff6f8cbd7aebf0f734915d403f4d3bd8039d9881ddce843475a
SSDEEP 12288:07/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:0Lft9rAutNCirDNIo++/Foacs
TLSH
T14065235FD144C28AF6DA407B51ED970887B5BDCC6AAA019F336F6008D9B46B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 634a4ad7253a570a549cf851dfff246ac9871c49ef2c72608100b1fb9f6ea1f4
MD5 0b9d5665d7f6184b5c98898d22cda130
SHA1 f6d52828fccf21b3abb5b134ec18f224d6665378
SHA512 25dcbcb774f3aa91b6c0e60b57e9c29300fae9033b6b59e4b15ff294e563d97fb8a065d34c30aa91e0704459211cc3a1ff2e3e84e1f4ed97e0b768f783f727b0
SSDEEP 24576:cZMJzFVSOTft9rAutNCirDNIo++/Foacs:cZMJzfXvtNZDNV++/9cs
TLSH
T159850299B35048F8ECA7813EC9698905D2B27C590B70C65F13F9361A5F733A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b0b1bbf7094ef2f1adbedf35487a272389175ff0471f0b1ceed798680dc99f21
MD5 52df6384d9430d23cf7cd9cc37bab033
SHA1 f628a7e6a7170c207832b3b5e74eebf4a60f3670
SHA512 ab168f8989e5089e0d4843cd010d6ace9ce7420a0b4a2f9914bd4cc160ebe2fef5c2d6d44a04ef826c76ef92defefe9b5752bb368c78bb49be099266b4a1a71f
SSDEEP 12288:UE/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:UMft9rAutNCirDNIo++/Foacs
TLSH
T19C65235FD144C289F6DA417B51FD970887B5BDCC6AAA019B336F6008D8B46B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 d13a0719021aa86b5a8ed40686197fa8548801835a0b44c594a0c22bd1cc1775
MD5 d3cb6a489c7f317fe4476dc8707c975d
SHA1 7e3ae41cace816d3bfcda23e5b929c833aef02ac
SHA512 7fd853cfc45d1c982288819efb8e9e1634623dcb4fcdbc115b355a38c70429f37477911776765e29edbc4521cf70b025fc17642c3f4bcd01b954949f0678812f
SSDEEP 12288:GQ/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:GAft9rAutNCirDNIo++/Foacs
TLSH
T17F65235FD144C28AF6DA417B51FD970C87B5BDCC6AAA019B336F6008D8B46B4902F6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 60b24913b7eba75c4a5ade42b0c50dd7f100642e2b5ff2d92699be108d64eec2
MD5 510ecae2d0fc5e119e48ccc71e0eb988
SHA1 d8f7614e8c1f270a7cc78a7b662701879169ff90
SHA512 8fb34635cf504bf7b0b9c3aaec9bc179099b6abaf59ccb5a7b02649eb4b65becc41f1691dbe27e86caccdfce0116e811952e81d523b8e735b68cf283562431dd
SSDEEP 12288:syPz5L8f/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdD:1zynft9rAutNCirDNIo++/Foacs
TLSH
T13475121BB39171F9E167813984A65B05F372B87507648AAF13A8023A5E337E09D3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 4277ae570f58779261552a5262fa44573f648bed45f1d4d4f8bc3ac7b414eaa7
MD5 b2f0b774a2a17feb2d48cb9da88eebf9
SHA1 c88626bda7bf6fe98a1e447a66d2d29011835b7a
SHA512 1ce8e03d96026e839d84b62610be24c51f354a201c7af485f0d657339cf2e0ede8c022c65c5983d9d906a7c3f15a04a5ed01346eb914cfcfc8012861051d8201
SSDEEP 12288:ME/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:MMft9rAutNCirDNIo++/Foacs
TLSH
T1F165235FE144C289F6DA417B51ED970887B5BDCC6AAA019F336F2008D8B46B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 efc1bf6db244e00150d961173461a658b5fdc719a20e029bf7935eb58beb51e4
MD5 876b105453babffd7f1934b092101529
SHA1 5a498c5228f0bc61203ce4fbd435628ff9022129
SHA512 70de9bc06d11e0ad2be10aa5b440c08ebf182eddd31bce34882b9503c9da005ff13d9ecbe803909b248f43c2c4a31c5c32ff51ad9c704792cb015af97b15ba64
SSDEEP 12288:oE/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:oMft9rAutNCirDNIo++/Foacs
TLSH
T12465235FE144C289F6DA417B51ED970C86B5BDCC6AAA019F336F2008D8B46B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 5718970a8bfa7a10d5eae88a5ba5607e949aaffb59855f0e0598ffc4a8128ae2
MD5 497e4f676b3ce7b20410e284f3389399
SHA1 ea058f8cf95c922ca327689f54b554ae85a8b313
SHA512 5ceaadd070f8d14e28ebe9afcb61b9abf55e68e46cd14d27a2204f0e6be81397f745ec8a6075983a6b26bd5f943122dbde29858c73c9edb4d1b5307c61fc41e6
SSDEEP 12288:ZyPz5L8f/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdD:Yzynft9rAutNCirDNIo++/Foacs
TLSH
T1C175121BB39171F9E167813984A65B05F372B87507648AAF13A8023A5E337E09D3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 a525d487ff9fc2610cfc4a249e8687ff61e5ef3a69a3e3bb6cc310a18b0b40f5
MD5 140897c5d70e23dab3f3acd7d19f7037
SHA1 20827b5182394bf23b0a94823342a0b53a7eb459
SHA512 6155a2586f35b1a57e7d484cc17e8273aeb71d76786d15f83536f7c246c69bdad8d91515ee1ef88951fd6932893a93e6a65012e0ddccf8498196b76d53e36802
SSDEEP 24576:4TuaLl3z0zDtft9rAutNCirDNIo++/Foacs:4TdLljuvtNZDNV++/9cs
TLSH
T1B58502A9B35058F8ECA7813EC9658906D2B27C590770C65F13F9361A5F333A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 925aa17154714f8cb73de911e53fc875a51456d7df109d46254494944d7dd834
MD5 25be0c9d2e641b753b8a99efb2f16649
SHA1 14f7d68d9ff4359ea2754e6022155245faa49755
SHA512 bcdd8acd73922eb09384f662382c5e89dbfd522dc8878a94900648c96e4b45744d9ce429cf93509f99cc190f9400f8eae9565693d2ba0e8b4c87ab224d758f53
SSDEEP 24576:E3xd9CHKy7GZZft9rAutNCirDNIo++/Foacs:Oxd9CHKyaXvtNZDNV++/9cs
TLSH
T11995CF91F3E410E8F1B7963589768511DAB67C991B71CA8F03A8251A1F33BE18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 cc3f141d9577e5070ff5f6d2d34f6532ceb7b84cb7d64855014d7d90416f0e44
MD5 883374afc6a10af0460c7f467093fc68
SHA1 bc0077d7ce1503f344c34f35c5fbc6818b493c9a
SHA512 9221d15ee778ac2d8da234dd2a2523f958a0eb6a9fde976b1538a6dea4a2020ba165d30b7d5730cf3d0d5b3cbd14560d321cb8167a69bd2e13428847af409b48
SSDEEP 12288:/p/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:/dft9rAutNCirDNIo++/Foacs
TLSH
T1A465235FD145C28AF6CA417B51FD970886B5B9CC6AAA019F336F6008C9B46B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 ff94e9035fcfca7168c0cdb034d7399a77461a8e3caa1e8d7a9ad63846c2f1ab
MD5 1f421ebb6db8c96a9d1c650c66cae2ca
SHA1 7780b1b613e0594e753c7c6e9c6521faf33a8375
SHA512 eef94ee35663e649e1c544e61c651f464ff6153a366e44221bf937b93a63be1eb2b2f7665ae4f946e4c9f22473ef516b56fd507db62393fc70e6a0bf6e65615a
SSDEEP 12288:m//kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:mHft9rAutNCirDNIo++/Foacs
TLSH
T15F65235FD144C2DAF6DA41BB51FD870897B5BDCC6AAA019B336F2008C9B4674902F6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 e16360a129674a0669bdc44c63c3f8b638f695493317c4d109d96d0782bc2089
MD5 be56a1b51220b1df32721632d868cf36
SHA1 1e1e53dd7a7deac0ea79f9bea341ba8f186cc014
SHA512 27643e903afbf16c12478e964305941c3abd847f72eda44c8c2368c86900800271535a7472e54ba42057648339a764efd96d00227d4dc70caf4431d1a723b396
SSDEEP 12288:ma/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:muft9rAutNCirDNIo++/Foacs
TLSH
T17065235FE145C289F6DA417B51ED870887B5BDCC6AAA019F336F2008D8B46B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 0ff8f6b5ac6d31a0890eff309eca1ad245cae47460b21c002e9745fc2be9bfa2
MD5 90893781daaeb1bb807c24ea44239e88
SHA1 8d0050eff4501326c186e025ae0f6e7154ac13b8
SHA512 fc43cd3500aa824d55dfe827ae70457a2503a0a18c4d86c8b06236eb2eaaa501198037a23b504f676c10c617e175319ccaedd2659657d5876ca159045739e6dd
SSDEEP 12288:rE/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:rMft9rAutNCirDNIo++/Foacs
TLSH
T1F165235FE145C289F6DA417B51ED970887B5BDCC2AAA019F336F2008D8B46B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 b40ba2c570207d545b7cb2e51383f239bad97fc58b8633f9b52abdd3e05b2284
MD5 53fceb7665039907c80a7b839be6c31b
SHA1 010e4a36bd0071b6d289ac2937c558419a26982c
SHA512 703b43db4f7f4328c9c1291eb48193e1b705dac8d952f6c3f656c74cc4551ac5d260b6a2443edb858489ce07cddd820916e0d0656e314de977a9c7f193ceb50d
SSDEEP 12288:jp/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:jdft9rAutNCirDNIo++/Foacs
TLSH
T11C65235FD145C28AF6DA417B51FD970886B5BDCC6AAA019F336F2008C8B46B4902F6F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 3808543d012545b774e3a1b892a150bbb19ae2f27b0749f76627174b6349f8dc
MD5 e415415ee37acd8f36c809710ee7ffb3
SHA1 ea4cb457bb527f1551f05c4f39a1e6d7f053e20e
SHA512 0ee5d5b87277fe9e0fb182740d21bc38123c861cea9710c45ca44b30d109dd23574ee2e0ca690160195fbd8df70b5092e320d09a17d525019a176ae09e073d34
SSDEEP 12288:HksfU/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:T8ft9rAutNCirDNIo++/Foacs
TLSH
T1F475F11AD24842D8D0AE517AC3998A04B3737C6857E1D3CB23D5F53E0F756A09CEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a59644ffe1f4f0c15a12bd2196cb6cc0d6a131454a90000a3d1ed1583ffa0867
MD5 20833cc5d43adefc6bcbab341fcb4f60
SHA1 f277b8149661647d34e8e50ea3aab607b6d29ffa
SHA512 b104388c3be82357ef56e7a318f0eac66cd964af7df9d230fb2e78062612a10c2140ab2d3ecd6fc41df6b46c96f7ad539c2aa164168a73c254b6418a6406948d
SSDEEP 12288:h5/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:hNft9rAutNCirDNIo++/Foacs
TLSH
T1CC65232FD248C68AF6EA517610BDC728537AB99C1F65419B326F2108C874AB4D83F763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 42877709510228e6b0275700b949d997e48fb2d8f381dc6810cb1493a811478b
MD5 3767f7253a20cfc5274e6b80aa9e751e
SHA1 9fd69666a8a7c0bee914cc551318e5816d673182
SHA512 f4e60dc319ed253b11929f495bbef295f6c98d144f9404b1e3d3f168550b611e1c81576b63e738882cb105e6850fd7e8028d96d63d76dc4beea4f0b52afd466e
SSDEEP 49152:Va0h2GEkuAe73q3pp46zwwQPvtNZDNV++/9cs:Va0hNYG4JwqtNp++/9cs
TLSH
T10685AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 2b8c42e60a21e56f5c8b5ec0f8508472ac1ceef42ddc08215c276a0a89fd7bbd
MD5 4c9782050bfc7113dd0908c9ec2fe604
SHA1 816fd4fd6fc8a75ccdc5d382948cc6a3bb1c6045
SHA512 51b340fb9766880e721614bf93b6e27576b9b8a86c546f844b533b866e6fd652eee46a645e90448d3be12f8125ecc7c2dabbeb477e2943e9ecd8619d36712c88
SSDEEP 12288:uhbHjfXi/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdD:uhbHjPmft9rAutNCirDNIo++/Foacs
TLSH
T16765127E529C11C9F1B6917E81A9860AC371B868172153EF23D6813D8F37EE44C3AF92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6f7864ec88a197aa0f3d6a63edee02b9cb53def485662135bedfe5b84d55279d
MD5 5dd6f5f7c7796c128dc746fc08597750
SHA1 e6e2569da9587b1d88c8032a49b6bc8ccac62603
SHA512 c7345af70d6e791aa6f3e1297a7d2eb1d78c3a88dd7859e78a8419a50cd564e06ace0a4ecdd9ff49fe7c00764a6e854247bbadf2e7880a66454f5119f9d3dff7
SSDEEP 24576:13YgnJcRTk4yti+R5dpR/Oft9rAutNCirDNIo++/Foacs:1IgnaTk46ppR/2vtNZDNV++/9cs
TLSH
T19B45B02EF2B910F9D8AAD136410147B5FB71782D1F209ACB0174C538AF16EE85E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 1044865be72444430ebb9616acd4a473082f3a253d46db2da97f948c232b2da3
MD5 6833baf9b65b465d8f2dc4f9332b68de
SHA1 bd83e21f9ff03e0f714fbad3d0bfca1fa9c6323d
SHA512 1d5c7ff98825740d29ad8ba418fef6e3f5d5d5fbab547e2d4660474b019218d91d3efad735b4a59b568f772bdfa91f61d88148dc1bc7ae147c5c6d185a7b41e4
SSDEEP 12288:Bt/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:BZft9rAutNCirDNIo++/Foacs
TLSH
T14465235FD204C68AF6DA41BB11ED871C5375B9C82B6A02DB326F7108C9B46F4943F6A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 40627ba931f4e4f02d1212ad1334e60d103c273de8752a8ee6efa127ed36a3e3
MD5 5d13420a7db90e5ee592ae4c5f087df2
SHA1 56704d8907ce3d32b737fcad4afe86b829a1ac1c
SHA512 d497396459f04d94809de0e26ea10e5c843f046b59053fa515aead3014a9881510611379b8ecbf79458fcbfd352be9911693f60bccbbe6ba5637df729b974daa
SSDEEP 12288:EObZA4LWOsvAYFTg/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfr:ptL3UTwft9rAutNCirDNIo++/Foacs
TLSH
T1E4850119F39440F9E96B813DC5B68A16D272B89C0764E7DF03AD4A151E237F18E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 cd445e30b97850fd1e141a8e414d6bd89458871d2947810b95e62a6f6adb9fd3
MD5 155de68f7c2ea8eb1a5ae7208a3a81be
SHA1 c06d5a773710198d3e2a817e26be1777aef01882
SHA512 f5e59f797fc12a8e802d8030b53ee1a5ad7e9c1f96efe28de93e9acc354bb6c095f16c2d8c8ed55a0a6d36ff8188704fda2d32e5b71ea2371e2cd6e148a19a6c
SSDEEP 12288:8pFtUO0/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyc:XOcft9rAutNCirDNIo++/Foacs
TLSH
T1E865022E329C10E5F5BA917D8596830DD371B8A5172253DF02A5812D4FB3BF89C3BB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 817dbb218e7b6dca03b2e92b1957b2c4d660091ff5a6307120effdf1725633b5
MD5 2bbf68c06363975d4917c85a02d041bc
SHA1 ad2cd7570318478de611cc1f467e554eb726f6a9
SHA512 8b08bd0e20107d368a6cb14c8103bfe476886ac81e52140d417ed296dc047e1cd709cc54b47d68265c87e2d0ee820f8f1b1f0ac4adcf785c259f14917d55a1b1
SSDEEP 24576:V7NM9YmZqmWMUkPjZM48Mv6bEhs9ft9rAutNCirDNIo++/Foacs:V7cBWMpPjN8DbEh+vtNZDNV++/9cs
TLSH
T18D659E2E6BAC81D5D577D13DC5E28205F6B2B4611B318ACF1162833E6F37AE44E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2f87407e81051df7903e0eb26bad5b85b7d23636add96b89edf57bdb1e68e9b8
MD5 d2f66f0e39da9c7199ee5200b2166cfa
SHA1 8c5ca950efef9f4cb1eea43f07394283d28d2e79
SHA512 de3300bbac1afaf705d39d71b12b9bc0d2639b8e470e08cc62bfbb6b260e3c481eda8277d9328c0b7bf81fe4fa730ea7b1657158e80bf2468e1c10c758a1eb79
SSDEEP 49152:kF2YuHNETovcvNYf8kmFvtNZDNV++/9cs:x6tCf8kUtNp++/9cs
TLSH
T1F4858E2A27ED80A4E0BBD27D45B6D246FAB2B8551B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 dc96eb9c2b4d165a690fd81151da59be9579b82c1fce858023c085f2e2114fb7
MD5 0e5526d9b2fabc6de7a3e3bdd6ef3585
SHA1 ac6e640fed133054f7e5ee2daf2ae7241ff5029e
SHA512 b0710dff9843b6f10ff56cefdb4f8e1c1c507cda83c1ee1cbf8abd30f374ef563a6f21c6d9d98d7306f652b21cdaaacae1cddeadb6de747ee2a4311727aeb785
SSDEEP 24576:GAFs06+Omlf8NXEbToIft9rAutNCirDNIo++/Foacs:vFs060lYXuvvtNZDNV++/9cs
TLSH
T1C765AF2F62AC00D5D07ED17E8997C91AF2B1746707255ACB0260863E7F6BEF85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 1fec12b60dd83da64513ae792f479a67b8738d4491c5d5cdec99399b480c5c39
MD5 2e7b7a0a8e6583260a8b478494e594e5
SHA1 63188407bf54aac03d3cd260665d25cc80ed16ac
SHA512 06cfb04df1a2331f742fb27c2d55f39ad973fa8baf651fa7813b362be0c5f05d87089de665e69dbb80d314844d4b8d1f5e9df8224ab9e78aaf54c1c3c471e63c
SSDEEP 24576:LJnJ5D3Wt3ft9rAutNCirDNIo++/Foacs:LJnJ5DGtvvtNZDNV++/9cs
TLSH
T1ED85E02DD29810E8E4B7C274819A1745FF72386D2F226ACB24B8D5357F22FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c37bc1241b7d0282bce6dae37c1a9b18c90b5f0191cdcd80514c25423caa99b0
MD5 ed29e171ffeb6664bd2b49f0ed78714d
SHA1 91efa55037503d24fc48c661df7e9edc07a7be5d
SHA512 269bcb665388997c1613065760cd014cb53f69533f4b9b8c53bb979d6a31bed5ac9012a45fe97f2681d56484c744dbc4a7e68e59b6c9ddad39cdab856cc08071
SSDEEP 49152:do06DIKdwc+eQnSt65aVhvtNZDNV++/9cs:K7tNp++/9cs
TLSH
T136956C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 73b98956bb463c6970507db28d1b3f0c11ad88a4f8ae74e3bbfed2e57c39c31f
MD5 2fe6d2fdd0661ac59b863753cb05773a
SHA1 96adf79eef51e8a17ce5cd7d41c3af0478c31631
SHA512 5256969d85f6a11c77383628569635de902f094b6eef6cddd65c587d1985890571e21be3fa8bec8190c10a28ca1f1f2e31d41352a1434b2d8c30481b1b776520
SSDEEP 12288:3EP3Rrw/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyc:8rgft9rAutNCirDNIo++/Foacs
TLSH
T19B65126E635CA0D9E16A903D41E5C608D372F0A42B5217EF12E6C13D8E77AF85C3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 95dafa10b96b50fa0f1eaeb04f4b814dd852fdac529e387506ab2f13e9ae686c
MD5 9213d8ee128fe34ed282d38fce26eea2
SHA1 6de30e34b1b899121b90e1196aeddb2cb67b10ae
SHA512 fd1353242a3acd97eec8d95e89646b5e810b7434f342bd330d83ae76889cc6c248aab538543adb1121f3ccf807b8294e88d04235442a185124623b77f6c37676
SSDEEP 12288:hjkyS/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:hIy2ft9rAutNCirDNIo++/Foacs
TLSH
T14375230EA38491C4F6FA013D91B782548B75FC641F2143DF2195F22E9E75BE4A83AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 81a31bbf55b5ec3b4e882acfdbf380098eb5ea06915da28d645245abc8266da6
MD5 aa3b9e1e164284260ece08cefe39a853
SHA1 9bef3cca6f080184ccefde2282a0d0c995bb0e67
SHA512 6d521e5e6689e19318d9a749174267167d287dcfb9ac21ddd356649d23b2ff198c8698b7e14663f79e207554ebcfbd863d9feff889f19afbe73afcb8076181d0
SSDEEP 12288:FFk/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9gzQkcdyZ3i:7sft9rAutNCirDNIo++/Foacs
TLSH
T11865231F9244D289F99A417A11FD8B08437579AC2B6511EF32FFB128C9B46F4903FA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6fcc48fec380dbbe602281e6a79fe55ecaf4ac97fc79844b8210338396b13f77
MD5 24408477725db1508628f359fd41d1c1
SHA1 638148e5a57c1a4092b13fc6758285882bedba7f
SHA512 2a6f70af2b0853a6eda503819ff37dc8b992039d7935fb527c7319052c09e2fccba555f6db0af87c3784c958e52b03b6058620a8cb6c607639072c0862cd5a4d
SSDEEP 24576:DQ9MxZKdcz97w3Vft9rAutNCirDNIo++/Foacs:DVKXNvtNZDNV++/9cs
TLSH
T1C9558D2DABE9058AE177D27594B250C3A673B4301B35D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 9d23f6ed9312bd6219b98a736f16927445c1e41d0aabd268354712cda308b91f
MD5 622be153835f198ed27cf049560cec58
SHA1 13549de4676f712ca8223618f02888ac4fe1522a
SHA512 f69596f6be7272bae9d6bd7f438a98b52dad6944fa4beb8d4f49952c8fd0e3683941f9910429ac58a218c35a093c5258fe34217cc6429a806edf0fc98b89f1e7
SSDEEP 12288:ryoKo2HRple9pm/kKth6HkIvOjwWRwulD/fVT+EBlVBtNzIo+WQeSc/keoGMfz9d:ryocxApCft9rAutNCirDNIo++/Foacs
TLSH
T1F175E01FB76940E2E176813C89858705E773B0741B6253CB6296C33D8E77AE8BC39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f96a864e98f381a5a03882ebd210fc6ff1e6cebc01bd41081a56aa98d7524d92
MD5 f7e8b6e96a19605375cd9735a1e28de1
SHA1 588864c6bac058d64db0bd5522cb9d2aa931b20a
SHA512 4b7a8e649ccaedbcf2ee6603e4c611ea5c49f8dd15cd8a9b8f61de31054320c7011e17992386ece9100868ad3fe82ad4f1c3bffa28f240c938249fa4f2a79cb2
SSDEEP 49152:rWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKCvtNZDNV++/9cs:b0zuNIetNp++/9cs
TLSH
T1B9A57B3DA2BC00A8D9AAC379C1451366EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-291-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/220-284-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/220-422-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/220-289-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/888-358-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/888-345-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/888-339-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1172-538-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-539-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-527-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-528-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-529-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-530-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-531-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-532-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-533-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-534-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-535-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-536-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-537-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1172-540-0x00000223B07B0000-0x00000223B07C0000-memory.dmp

Download

memory/1408-224-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1408-28-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1408-34-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1408-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1616-349-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1616-328-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1616-334-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1616-513-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1672-418-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1672-523-0x0000000140000000-0x0000000140265000-memory.dmp

Download

memory/1672-424-0x0000000140000000-0x0000000140265000-memory.dmp

Download

memory/1672-412-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1820-244-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1820-250-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1820-255-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1820-243-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1820-257-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2436-390-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2436-389-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2436-396-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2436-521-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2816-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2816-39-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2816-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2816-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2860-15-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2860-23-0x0000000140000000-0x0000000140249000-memory.dmp

Download

memory/2860-24-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2860-223-0x0000000140000000-0x0000000140249000-memory.dmp

Download

memory/2888-512-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/2888-323-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2888-326-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/2888-317-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3236-270-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3236-406-0x0000000140000000-0x000000014024A000-memory.dmp

Download

memory/3236-276-0x0000000140000000-0x000000014024A000-memory.dmp

Download

memory/3236-277-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3640-435-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3640-524-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3640-476-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/3640-432-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/3640-492-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/3640-518-0x000000000CD80000-0x000000000CD88000-memory.dmp

Download

memory/3640-508-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/3684-516-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3684-514-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3684-434-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3684-305-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3684-311-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3684-313-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3712-409-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3712-522-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3712-407-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3712-400-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3812-373-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3812-362-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3812-372-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3812-375-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3812-368-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3848-520-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3848-385-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3848-383-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/3848-377-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/3876-56-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3876-50-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3876-62-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/3876-60-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4112-13-0x0000000000400000-0x000000000068C000-memory.dmp

Download

memory/4112-0-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/4112-7-0x0000000000400000-0x000000000068C000-memory.dmp

Download

memory/4112-8-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/4316-258-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/4316-265-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4316-388-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/4316-259-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4796-356-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4796-517-0x0000000140000000-0x0000000140281000-memory.dmp

Download

memory/4796-350-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4796-360-0x0000000140000000-0x0000000140281000-memory.dmp

Download

memory/4932-64-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4932-137-0x0000000140000000-0x000000014026E000-memory.dmp

Download

memory/4932-70-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5048-238-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5048-240-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/5048-232-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5048-370-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/5108-300-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5108-302-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/5108-294-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5108-431-0x0000000140000000-0x0000000140234000-memory.dmp

Download