feb5610e157c0d41d083dd6651b35a9f5d2b24d33af0e9ec490838ec73de7cc7

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk.exe
Size 3.2MB
Sample260415-styq4aby4m
SHA256 feb5610e157c0d41d083dd6651b35a9f5d2b24d33af0e9ec490838ec73de7cc7
MD5 3705618fc536993ad8fa9825e0a8e430
SHA1 4f3646cfe80bf999945aeeedfebec0dc5400d3f4
SHA512 b625643d119d39a760ca4ff26f5cd21f270af5f92800efa5559c81d2ccdbd271bdd5239c694d24b8e7e3d0a8968cb9782ec2f219532ffab8a444a4d38ea7718d
SSDEEP 24576:Le5NgcWvaY+wXVoXoDyhRXJG+OAQWmOxm0qY0gQzUtcbV86Z/glD/dsa:K5ecG7V+dOAlmOA5Y0fzUtcR86had3
TLSH
T1B3F5C05AA76081F9D8678270C866C1B2E6F2BCCA96348B0F1650DF6B3F335614F2E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2968	alg.exe
4368	elevation_service.exe
2640	elevation_service.exe
1852	maintenanceservice.exe
4192	OSE.EXE
2144	DiagnosticsHub.StandardCollector.Service.exe
1732	fxssvc.exe
4668	msdtc.exe
4584	PerceptionSimulationService.exe
1200	perfhost.exe
4164	locator.exe
4524	SensorDataService.exe
1256	snmptrap.exe
4976	spectrum.exe
1512	ssh-agent.exe
4644	TieringEngineService.exe
4460	AgentService.exe
492	vds.exe
4648	vssvc.exe
4068	wbengine.exe
5052	WmiApSrv.exe
3940	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d2539ff414bf40d2.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e563b40f3ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065424740f3ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cd7583ff3ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfbdc13ff3ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029e7a93ff3ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040d4963ff3ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf02a940f3ccdc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
692	Process not Found
692	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3104	2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	2968	alg.exe
Token: SeDebugPrivilege	2968	alg.exe
Token: SeDebugPrivilege	2968	alg.exe
Token: SeTakeOwnershipPrivilege	4368	elevation_service.exe
Token: SeAuditPrivilege	1732	fxssvc.exe
Token: SeRestorePrivilege	4644	TieringEngineService.exe
Token: SeManageVolumePrivilege	4644	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4460	AgentService.exe
Token: SeBackupPrivilege	4648	vssvc.exe
Token: SeRestorePrivilege	4648	vssvc.exe
Token: SeAuditPrivilege	4648	vssvc.exe
Token: SeBackupPrivilege	4068	wbengine.exe
Token: SeRestorePrivilege	4068	wbengine.exe
Token: SeSecurityPrivilege	4068	wbengine.exe
Token: 33	3940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeDebugPrivilege	4368	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4696	3940	SearchIndexer.exe	105
PID 3940 wrote to memory of 3920	3940	SearchIndexer.exe	106
PID 3940 wrote to memory of 1940	3940	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_3705618fc536993ad8fa9825e0a8e430_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2640

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1852

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4192

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2912

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4584

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4524

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4976

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1180

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5052

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4696
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2816 2848 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3920
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2700 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 20564f88d7c7bd11f3207463e57b8940e94c173390080760bcfd86f11062e51b
MD5 d5b4e21c8e7cb1d349ac5fe32246c7ce
SHA1 bf98317a81f15920785cdcfe1b2c1f4301c1db61
SHA512 2690cfeb6516d410a3ed52bcfc5b7a76fd3df4c79342484c7c0c9cfeeab78e674e3dd2c955a2777b51e5348b2ad4896abc371cff5d36d9ab613b0e21489da51c
SSDEEP 49152:bb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJ0fzUtcR86had3:p3q6mjBqiUxd
TLSH
T120D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 95042e178b057db1f613c2dcc2203c7b4a4babc7a1101ca715091888fbaba699
MD5 c110cb3f4a6d6df43c2f8d8de96ff7e7
SHA1 e90067214b8f202fd65e6bd5cb6b4182ea741382
SHA512 2c4bb39c2f0dd55df736e19af35d2ac569a8569ec62efdf3e4023f29474b90dc6ef2d4250e1b1ed288286f1aba599df5583a994231429d7a4b8c9f2a4d8ecd21
SSDEEP 12288:P1XLsswWkxy2lRq2czAG0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:tXYfDtczAG0gQzUtcbV86Z/glD/dsa
TLSH
T16205F12973D409F8ED678238C8A28402EA33B8554764F7DF03A499665F337D89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0dd0db3c6332cbf4432a7c5a002660f3779f1f5f6081a8548e4d1c0dfb127835
MD5 9eee146dac3256328d0e43965f0fc5aa
SHA1 a4c8db2769ad292872e1227dcb51b7cf8af8936e
SHA512 4aced941b8b54771e125d73dfc8f345f6517510543b755530e9f2305c268f054914d44451c01a9a3972b3412e1eb342fe4c04baa43f40b8b223c4aec2b65aa0e
SSDEEP 24576:A0Le5ji0hmxhrMh0gQzUtcbV86Z/glD/dsa:APji0Azk0fzUtcR86had3
TLSH
T1DF359E16F6748331D073C0B9C5D2A68AED72308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8d7820527557c6f2d313fb0ac84c7bf8fd38c642fac9e64f356be5f956208c48
MD5 ccbeb7586e51b2085ab3cadd8b0be2cc
SHA1 fb184ecf43c9876c4c77df79fc9ff036f8051637
SHA512 bb35204a1a6d8f24ba3637675c4e245ffeeaa5fa37625a8d5ac1a823d189021f84740d66bbaa2accd6ce432fb39ff16a92c5292196a56ae5f4e4562594593576
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWj6q8wyuD0gQzUtcbV86Z/glD/dsa:x/ezSC6vUzPv+HjyQ0fzUtcR86had3
TLSH
T119755C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 30a35588eb31a8e86e335513e818b15694ae2cdab55c713a461a974301336afb
MD5 925ca73eb63521d4a04d5177e2f0f882
SHA1 87932a10f05b809bbec0ebb3f97b2e723936ede2
SHA512 a6845dd4165fcb2eb3e0e0860f9562b7d34704abcfc7b1115e704ee0e0f3ca4b146d6356f96e5db0756205a132f7d71f0659021339172ac3a4dcc8db79636bcb
SSDEEP 24576:nVbqPb88hv/l+B60gQzUtcbV86Z/glD/dsa:nVO88hXl+E0fzUtcR86had3
TLSH
T13D559E66F5748331D073C0BAC4D2AA9AEE3234415B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b49b852c458b9af690affb874b27f890f9d8144589406599420db094827dcfe1
MD5 cdd8521d738081818c839d7126217893
SHA1 f8b1fdb8a757773bfb47dbe2dcc9db63fc2b84a7
SHA512 827bb065864e0b8c31dd37092d97435fe6b60271adb2247b8c6bf20f853957c91b879d9bf514ce38d1b5908ba9ee1da9cd67a9aa60ee861fbf6ea0885543961f
SSDEEP 12288:xGF0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:xGF0gQzUtcbV86Z/glD/dsa
TLSH
T1C8C423E6A75861D0D737CB3050AA04825A07BF884598F96FF63C7CAB9DB8EE0DD1C142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 fb1b3ba98378814f70342cbc8e907dff2f7409134f9138be7b1c2b56916309fb
MD5 12bebd214b61174dea9b3e0da511d1e1
SHA1 59cb4ecd0e755cc7e68d3fc31996ee2e7f6ead66
SHA512 3f82744e07100c73db96e00e00c67618b79c5d144d213a22fbcd089ab441b906e8b62a6e4a60e0ea813405216bb5470beb15510b4a2cbfa3e0f3e98b9dc8963e
SSDEEP 12288:TeBNUbTVO86Uy0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:TJIUy0gQzUtcbV86Z/glD/dsa
TLSH
T1AD05CF7BEE28FCE1C27E8D7856918640E77278704B61A3CBE175820EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e89e6a56488952baf5605af205d864fc2b4407aa025527144dd5abe455ae1eb4
MD5 e862c5b2ad21679fa3ca7ddfd62fb9a0
SHA1 f4b15814947bb1508a2c44610f77d514fc6e289f
SHA512 3526860b25c8f9d3ef15a4d8eb14d416f51e0424a130250d44ad6a5baaa320b6f55f9e983ce858c2e6485b24de869cdfccdeaf86a92cabd9025068c169283f26
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THO:oQvGAdlCEL8c/WRNw5CTiUxd
TLSH
T104266C656BF880F5E1B7E138897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 aa2a30f60236f50bc072dd0e3b8e186229386f7856f32a52c64dac22bbfb124f
MD5 1d73a5365a0bf5cd09d8272e6007ea8e
SHA1 380ad30b7cd7a12f6f4a82e50711c91dc8edc8d2
SHA512 c48275ece4a068b44dccc790bc2f507a8c332487e04bf6b03a9a7574a4f71c92804b971a4fc9be8a7d63f94f206fadec1fbda39ef7526981a590ff0b6881a293
SSDEEP 12288:KAwSfxL/2Dc3mDLLmt0LDQewsAj00gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2Q:ffewsAj00gQzUtcbV86Z/glD/dsa
TLSH
T1E715E031FE74E032C37B0DB21B36C706582DBA204B5129C7F3A89D9E59742D2677AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8d366af1c995d6c55b54791edc664a1210c28c1d6e7027e852c76a4dea0700d0
MD5 6f8e1e4c77d52c2c2207621742acb35e
SHA1 e4c24c8f05a7ec7102bcb8c136081193cad1997e
SHA512 24ad8eb673b981c648404fc68df33078eb4fb55de44088e910ed5206eaf4d1896d14752638adc6983a968934850f12faea7e434421560f54d34e7d9a868c21cc
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHciS:iUEtQevvqc2W1cpV20I32ci
TLSH
T1EA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b75b23fe4fb067322edc54da60f78cbb05299bdcb927ef8adfef50a0384dfe02
MD5 4129071ae652030bb567b1ce0f8af90b
SHA1 1c8d923bab62fd54c802f728be3973ca44a50982
SHA512 f76f096b7e813a93b220bac9f9b84c01a862a33f918e65846717c9d96265469601b8263ff2837aaf473af2959f2525e01955e0d2d54d251965ed6e5c46a62a93
SSDEEP 49152:0CbRquA/m2yL5zTfFiV+XenmE3/zU0fzUtcR86had3:doquVjnmviUxd
TLSH
T167D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4884cf7aff92fa42c30442d9f8ec676676b1279bc6f00f0ce307c60c03b48a3b
MD5 9ac98972416b54bc61522a7fd54c2cf2
SHA1 d0fe1d05976d326aa4806724d148286dd69968c3
SHA512 e46ca05eeaf5a44098e37a27247ef0aeaa124c4f63849583f33bb31b6e06d3928c1c60dec96999e04509e3b46d8bb8b58e7ea4320ac2fc37677ba7d72eda7397
SSDEEP 24576:VAhGL6IFoiwtA5l7S53P0gQzUtcbV86Z/glD/dsa:VAM5Foiq5/0fzUtcR86had3
TLSH
T1D8359D81E7F955D4F5B3AA7899B68071EA76BCAA5E30D20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b7229bac818fcb3a2a8a5543872a71acb0c06f17f1e60b0d6b1b3e1e96f2a004
MD5 614ef75c28d10d8a1b55317683cc1394
SHA1 5e3b1e692b61b7b0a36073df3cc4331d8106dbae
SHA512 cf401a6da3242d6fc922a221360301b5673d75b32bc99ebc8f69c70650309b899d5e62492640411c2195e4b67f5cbb439e22f72811d382a354d95abe02dca485
SSDEEP 12288:Zmw5HEjsChNEBFgl0WDm+Cj0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsP:0wuROWw0gQzUtcbV86Z/glD/dsa
TLSH
T13705F14673A81CF8EA67863885978032F7B3BC052A25DB1F5760C65B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d876047dfdbdd4631a2f878169cfe39ff6270abae21b79db97510a65ad3cc846
MD5 3232189657dc47781a955c2421cf4dbe
SHA1 868a780bf10f1aa253ff27b2cc0d804cfc2c51e2
SHA512 dba4c78a1f02ac244753701dffbee208edc265b6ca26d711e2d4d515a65020aff678a01c4fa1771f0955f124bfc5cdbb52ed546b2da8bc38a60a0932f77dd1a9
SSDEEP 12288:ByZ1IyE0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:IZuZ0gQzUtcbV86Z/glD/dsa
TLSH
T150E4129A33E820F0E373823888E54542E763B856537593CF622855AA5F73FD19E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0171354922de6deaf9b3bd70a3491775481b441b702356cf2b5bb2a44b0fa7ed
MD5 c67c2e11b95e5bebb20bd5bc0c5cadfc
SHA1 74bcd61d5c29341584e80443c48e675c19fafc5c
SHA512 84a775ba594b6162441f0b0998381b53465b640ff833ace48f824436251cdc20bf040ec3ea580f365395fb07a143c58c6272bc10d7592d862152b319da0dfce3
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ua:PQRQyi36YOcPDLvw2gAf+PN3eiUxd
TLSH
T1DB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 55ba7be2ebe3ea40e79c0a49924f7e2a0b78ce0995ebbd75ce7c18dcdf232fbf
MD5 cc0a718a69096480535a8a115f899fdb
SHA1 43ab92d18e7b45254b3e5f932437eafc6c70f343
SHA512 12ac614b80ed42ab18537d2508cd4be7265fdf07b2b46e4ae29f9eaba3621d71d484d00a0e7722f3f7bd75079a3f73dfdcc6bb78c6fd51000eadceacefbf734f
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ua:NQRQyi36YOcPDLvw2gAf+PN3eiUxd
TLSH
T15F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f201271d69f59d4a59b2ff95f28d6cfcb02065da3090db168b0693e0fc11818e
MD5 34540be501054669699d4c5e1bdc7efe
SHA1 ce5f139169d2f031d3cea2f03aaf0a1264be7ebe
SHA512 a72c6bd2258fbe2bd90345813329716744194ed474968e8c96a3a4cbe64538fa8f57085d36892dd51e3fea86a8c7e978df14262a80224317eb1e51c2144ba78d
SSDEEP 49152:k68Qg55nhkeWu7PNU3/k0fzUtcR86had3:OthTRc/kiUxd
TLSH
T119B55A33B2F600A9C44DE1769F4A872196D27C758FE0E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9732ddc4c95e7bf867c787d717d49ed541d00c343e063c7dc66282814825399a
MD5 d03a8fcd3845681506d342d3317fe79e
SHA1 0b6a10fb676fd2aedc836a2dd0ca39fae30e82af
SHA512 6947e8e08ad59abe5215fcedab48dde1fc21b43da7893734cb8503e6a78d37a302aa5adae8b9ccffb69f821f4d3688fd2f4ca1d1da07060b53873f5eb0b2a347
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99g:8y5112gYy5azzVvU69nLKnhZFiUxd
TLSH
T17D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 340c96330433af4d283088d23331fa4e3b70490b8cb2af925ca55a40b054dbee
MD5 03bb576c03af16d2b6d3550aec0ef90a
SHA1 2a7e9dd6dd6e36210dbf0668bdaebdb0d6f77d3c
SHA512 9a752a7d3039931889664caf8829925891d6fc73a174eb64511311550da7dd3d76468c52684371e85a8e61af060c85c640bb403d28775c7ba4313b7d4f689897
SSDEEP 49152:FB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl20fzUtcR86had3:ru6JmIxd2d2iUxd
TLSH
T1E9D59D13F1D901E8D06ED578974A9233FA62BC490B34B6DF0A9072562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 542fcc02a843bd05bbf1847bf7665e62a7e0f5de1f1208a4d4c0d57326c13f64
MD5 a7bb4258bdf791b382942530d27418ca
SHA1 57e157d01e74a8a556b7f8f284a6a4c531001776
SHA512 40b085d1d14afb3b2b1ec50641adb79a5f620af5a6b62f302ad1aa6a84b5b5f1a07c25006a4932e4cea27f5d3508debc25643ab72663bcba15798c87f9f7da16
SSDEEP 49152:h1hpsNoJpF1A67U44CwH7R4xS0fzUtcR86had3:hmifPqRviUxd
TLSH
T105B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B6961F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d7d241246b47192ae3f6c74ace5dbdacaf2478829eea36c0dc12ef5c795f84f3
MD5 2bce7cc2d4c5cd84e400d339bfd2a07c
SHA1 9847caeddb3f6f420d5e678dc49390bddc6649a5
SHA512 e5d618c49056115d8dbad00ad003f09fe6d272ff1844bd0f36e0730b19a72be5c6ff17ac27c09c77d5bde8d12d33cf2a905562d0debfd82c037a56baa6feb9f3
SSDEEP 49152:qSuZQIY0Be2KkRVtOnks6NMHqZ0fzUtcR86had3:05dKqi61ZiUxd
TLSH
T1EAC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 608db70169fcd53c6bb3c8edc09fb58384dd10987736702a7c1eb94cc467aa3d
MD5 c2ede2e6a4427a3bb578df412049e2ad
SHA1 78c41760937d8f03876d89e2346508f3fa846fdc
SHA512 d5c98ed4797272ee41a6ef5528e9a3b196311f39af7664c3c8f9d9a9d768f9861ff2a4aa42bb901b2c1f1194d26b21d545825d2ffe66a4d7bb4fd7c566758a50
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wG0fzUtcR86had3:FX2iWphbiUxd
TLSH
T1AE95BE13F2D900E8D06ED174C7568632EA62BC150B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 8857b8af192fe1492dcc59641ff805ad1a9c123f76e6d9ce7f61836605ddd714
MD5 f94c76867961efe652c2014fe004b1df
SHA1 722626077851995999be712853f7b955c2e19d0a
SHA512 a3c84ae3e3b809c919224dead89323b1933d2ea7a9b047f9caab36698d8f7078b2c0c2c80613c2b7117ba377342346b6d43dc72712d492dc179cba3a96ba9999
SSDEEP 12288:ud0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:ud0gQzUtcbV86Z/glD/dsa
TLSH
T18EC423E6B58951D0D337CB3040A904829A0BBF8D8745B5AFF72D78279EB5EE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2d471230cc590684060bf5ddc982cc2badb768f84a1b771b880891349626963b
MD5 f1a5b845a5ba58b1cbdde449a7cdf8f2
SHA1 a5ffab268b51d16e7ae2cf44858df6da7d81ce3a
SHA512 5e716f68861a5ec2e185f77c2a0c63bad611b7fd9df3afd88bc43e5bace7ded0bf1316ed2d367be9991df38c5efe926915572145c1cd1ddca1fa178c9e6c312b
SSDEEP 12288:tY0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:tY0gQzUtcbV86Z/glD/dsa
TLSH
T12FC423A6B55951D0D337CB3040AA04829A0BBF8D8655B5AFF72CB8279EB5FE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 568a95d59b42f6c927a063d106c932b128f6b31ef3d02f94f2fa4181a29fbafc
MD5 afeb78b0277eebc8799feb2069c78ee4
SHA1 c80ff00f5d0202d2bb79dd0b20831b853b5cd7c6
SHA512 b53f155fc62683b4ff8df9e309c1dbd0424d17e5c9f6f76815762a0132c769d7e35b4fc98b612e24f2612e3d44de4de23d9a0bd88ce40481caa3e988582abf97
SSDEEP 12288:Xq0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:Xq0gQzUtcbV86Z/glD/dsa
TLSH
T1B7C423E6B55D51D0D337CB30409A04829A0BBF8D8689B5AFF62D78279EB5FE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 7d87be2b8d22384d2a4a094cf8b309962267eda0b2c01d56e00104e2ccb25c00
MD5 7df22a25e7cd6fde647eb02e89e73fed
SHA1 2b0433c4da86ebeae7cd04fd2c7f4a9024bdbd78
SHA512 1a8df468f852633f28197149fda4ae01a3fa039eb71b34ea79deb67cee078ef1529107c004f3bd794ea8bedb1b811332033826da890e8e0ebbe82a4f5b3ede5e
SSDEEP 12288:FVv0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:v0gQzUtcbV86Z/glD/dsa
TLSH
T11CD423A6779911D0D737C73080A60442E757BE898725B6EFE7282C5B4EB1BE0ED3CA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 60c1aba3bc2950a8409c76702ea57794247eb57a612608c6adfe51094b05c439
MD5 7e3eadc56c7db7ddc04099eba1322904
SHA1 909ad150780bd3a5ec259b957fe373316f3543ef
SHA512 27d878b8201aa5dc3747db4adbad31d7ab53dc48bf86bfd0ad3b5110078beeb0019fea002906d94c13834b2683512999f7a8d68fb9888164f3aad21cfc6da066
SSDEEP 12288:NX0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:NX0gQzUtcbV86Z/glD/dsa
TLSH
T16EC423E6B55D51D0D337CB30409A04829A0BBF8D8689B5AFF62D78279EB5FE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 df88bf55e5997bb0cf79996fdca53ef8a0df003f531b5a1e39eff49ae7fba361
MD5 f75f47ee14ea2ab3218ef3453bd35f98
SHA1 86f7468ecb9e67fa6eceeb80d9d5654a6b8f1573
SHA512 fbf151d0ec26f33e158ddadf127bc5f5a62baaa3268467433399a0bc5954d22b2677506545910a4eff9a0930f66ae5087533cdeef544ff2e341a4b11f8dad1e2
SSDEEP 12288:js0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:js0gQzUtcbV86Z/glD/dsa
TLSH
T1EBC423E6B59D51D0D337C73040AA04829A0BBF8D8655B5AFF62CB8279EB5FE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 daee174b5508ce77e3d900f31e3ac5bd0af1518077dc227e9d96cea18854222b
MD5 6ab4d6992041499f7efa5cb90309564c
SHA1 1ba309cf1ea03dc3f9bd3355a5941c1f4d01553f
SHA512 ec1c57632508fcf5e2b595a25336ff00f13ba64c1f2ec7db5162167427ad05cf76b0eaef3cb9b039ca32b2a33bfa0582db9d58cc9fa78df94af34526c178a27f
SSDEEP 12288:Fg0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:Fg0gQzUtcbV86Z/glD/dsa
TLSH
T186C423E6B58951D0D337C730409904829A0BBF8D8699B5AFF72CB8679EB5EF0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 05599ad486ee5fda346a77cf4b112dee9871a7cb1e028ed6cb7202c0aa8bb688
MD5 6260074a66d3b34e74d0f9b93c0616ef
SHA1 5c044f2e8b10d9d9f64a40f586b7d7972eb3e415
SHA512 ec16e13cf4c8f85c5160b198a940350f60acc4967a8cc3704e578111821ac89efb8b4828468a8689724a76f4895b7a94e37538e2facdd53568f5ffb6a7f78d79
SSDEEP 12288:+iZwbDzzFEoS2cPvy40gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:hZM3zFVSO40gQzUtcbV86Z/glD/dsa
TLSH
T1130501A5B39018F4ED77823EC8658802D6B2BC5A0B60C61F13B836675F737A15C3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 da7e2d3d757e51cd7ac35891ad19390300059762bff08e45fc7b29dc353c5a3e
MD5 0a777918d6907c34f5be5122d032b702
SHA1 dd5110204fe38acbe6789a0e04103ccad9bc0190
SHA512 de52a9fd33fec1799b61a26266b8daa31bbc9a93037cafd5f2d7fc58760c596e250bbe0efaa654d5feaa27ebf85200a8251e14abad0d715af9e6043d3f5cb63f
SSDEEP 12288:sp0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:sp0gQzUtcbV86Z/glD/dsa
TLSH
T109C423E6B54D51D0D337CB30409A04829A0BBF8D9789B5AFF62D78279EB5EE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1a8d5a66bdfbe4a9ec1d9b967070f0c9fbabb59a194bbc656fa07a60d285e6d2
MD5 84dbfd26773cd282d4b8b05789401b68
SHA1 bfcd2f01fb73fc5ed5b42f8396684b242acaa247
SHA512 103a1d1d227655d2c12a3312ea33bb2ebccece2531037263c0cba28e469d9b08da903be63c97eb290ba648e13140153dd6bf3458928b6ccdae0a418e63c5fda2
SSDEEP 12288:WV0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:WV0gQzUtcbV86Z/glD/dsa
TLSH
T141C423E6B58951D0D337C730409A04829A0BBF8D9685B5AFF62DB8279EB5FE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 67c5a9892298a485b5f2aa7a94a9688d21c0c35d42b1eef52470df80de40a5a6
MD5 9986c5ee81825c89d62c2ea21436cf47
SHA1 dc30a80b3cf83fe699ae5f3ba720da486da48f27
SHA512 1614e8de4740133d089d565ee02052786024a0f039d349cca6326553a51df39fc6f53a9da3c4c44651eec76a8b98dbc34e710311582b67709ef60373733b3a1e
SSDEEP 12288:UyPz5L8E0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:NzyE0gQzUtcbV86Z/glD/dsa
TLSH
T1E6F4025773A530F4D237823488A20902F776B83647249AAF636456772F777E09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 15e5ff3100e11cf2edf2283a441aafc6a7a44bdf0af06d2e171c9b34c3121f72
MD5 c60ee3f30702dcce41c07c4f25c57c81
SHA1 0aa7987acdfc82d11d53c37e45b66c95db05619b
SHA512 8fcf0d0c9307519918026fbe7f74cd1c35942bbfc52c4efab3fa3ca64ec83bab33d76382b36120f8387459e0af065548785be81a9598de318d2f8bd5131f7bcf
SSDEEP 12288:vp0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:vp0gQzUtcbV86Z/glD/dsa
TLSH
T1C5C423E6B54D51D0D337CB30409A04829A0BBF8D8689B5AFF62D78279EB5EE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 fbe00cab3fafdfbae26c60e8d0cc9e4abbb8ca31803cfe33bc438fc52a855533
MD5 6f9fc9449cbb5d7cfabdb8a5e2838ec2
SHA1 5c7b67235b77b31b87494ee1ce36af796873ec85
SHA512 fe2fcefff631a71209421563565da0ef3294e522b4ce8c34db50bbf482dfe591ad164c658c8a62dc293f607d6bb2f43c9fb2e2a82dc266bf788bb31241df201f
SSDEEP 12288:0p0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:0p0gQzUtcbV86Z/glD/dsa
TLSH
T1C5C423E6B55951D0D337CB30409A04829A0BBF8D8689B5AFF62D78279EB5EE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 34f0db27ea444e3772ea99d24b9f92d3829ee4f375858dec81b79f6730aab212
MD5 e87eaea556e9edfb8109ed30779fb1bc
SHA1 9f2fde138e5c30603bf39c299dabf68e97156f6d
SHA512 d81288f26ac0a108b204c371173b4d864540e8770bc494852d34b1afe474411bfb5bcbc249eb2d247721deb8baaf066374f651c9a4c007a2125d2282642d1a15
SSDEEP 12288:oyPz5L8E0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:pzyE0gQzUtcbV86Z/glD/dsa
TLSH
T1D3F4025773A530F4D237823488A20902F776B83647249AAF636456772F777E09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 5b443d258c7f4151c17aad16da7bef57637c9b3d5023c142821dbca7f184635d
MD5 b1eb19393245f4bd1969c0387c91712a
SHA1 7b2301c9ce10bbc1d667e8a011da87cb68d21e35
SHA512 2f66f5da3c0de31e01e5a60aa1b28fc4c404ee340bf69a815a7187a36bbf8312ff9801a8c9f797065fa96b380eaa283d2e079f9dd0f6f17bc1b0df3470276b53
SSDEEP 24576:jT8aLl3z0zDa0gQzUtcbV86Z/glD/dsa:jT7LljD0fzUtcR86had3
TLSH
T1540501A5B39018F4ED77823EC8664802D6B3BC5A0760C65F13B8366B5F733A05D2DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3a5b709861563cb0870cbe17c34ce97dac7ea40129f9ecb6d8e86059c0423ade
MD5 4aaba56393ba48d6596a7419d9e2bf07
SHA1 3955789970378a734f011e7aa8766c83bac45a21
SHA512 9bba1467f8991247734f0aa084082e2fc240de643249dd45c243e1a821cd0134e18f4dfcb662077e7328ae67539e01b28b5a74b0089d98157c5145ee3bc1a4a5
SSDEEP 24576:K3rd9CHKy7GZ+0gQzUtcbV86Z/glD/dsa:srd9CHKya80fzUtcR86had3
TLSH
T19C25CF90F3E810E4F1B7DA3589764502DA767C9A1B31DA8F13A8655A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 2630dde530a1906b13aecf5d4d94b6345315698557e11f76c9a5f843be7f0c35
MD5 50e6c4222ca7d27a7d076cb37ffa2bc2
SHA1 e8a367597ccee7be036b061e82314c0bebf349cd
SHA512 2865bc553afcf2daeff1cbb718308dcc5b3db0d8bad53864f3dacf39c794cd2f899bb1bd9f4075262391dc73eb00753213416d5dcbab436e62213d14a335c9f0
SSDEEP 12288:VK0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:VK0gQzUtcbV86Z/glD/dsa
TLSH
T1D2C423E6B55D51D0D337CB30409A04829A0BBF8D8689B5AFF62D78279EB5EE0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 aa2fc5e7322a854e5cec7391388aa57bbe86924dea4f7662351d88664b26240f
MD5 94acddd9581d269fda8bef13e49784a9
SHA1 30c95606b6e7e2538a8a52fa591b5baecde8e17c
SHA512 9d1c04b653d20778391d5c74b6d59bfcac1a6a49ccf6b5f20e858455044e8ec8b23c5891874e7b4a71c22217356092fadb50622f343c7dbffc6dfc27f8570757
SSDEEP 12288:Dk0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:Dk0gQzUtcbV86Z/glD/dsa
TLSH
T17DC423E6B65851E0D337C73040AA04829A0BBF8D8655B5AFF72C7C279EB5EE0ED1C581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 32696b941cb7ffee055cba038c018da938d34b2febee78eea044bb25a8d189e6
MD5 33faea9eb47bbf79787284322df77a30
SHA1 a53eb42d7d9545d45c391f6c55ee9c17f84eca68
SHA512 d89e59a29a8d6a3aec42ddf304e88603765e7fcf49c8e746d2dbb44cccdb8b5a7e14629324760dc3844794b211f647fe06f811dd0bc1780cfd0f87a3c8d0caaf
SSDEEP 12288:qr0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:qr0gQzUtcbV86Z/glD/dsa
TLSH
T166C423E6B55D51D0D337CB30409A04829A0BBF8D8689B5AFF62D78279EB5EF0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 fb3f3a411771f4ab95adf9bdd57af2a82e02495da594359b9d2b27ac479824d6
MD5 7e2308fdf7ccd72115af9728b4640dec
SHA1 1a7255f7920b16ee8bdf1b9af0b3b5952ba2b4b0
SHA512 c1819b6c53334592952ff24b64d213687ac88d62142fad1082164e9afe3c923fbc8a06f83f6af19e2f8d3b7210dc82ee4abf4f7ebd64dd5802fe8cb4a529901d
SSDEEP 12288:bp0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:bp0gQzUtcbV86Z/glD/dsa
TLSH
T109C423E6B55D51D0D337CB30409A04829A0BBF8D8689B5AFF62D78279EB5EF0ED1C580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f8b4022b15dda80a8b6a3a5ca1098c024d69f00839dd7bbce2704729eb3d78b1
MD5 5d4090654f4b0ffc2dc7ed54b95b86af
SHA1 837cecfafc588c02fc4cd8e6fd994ffd883216bc
SHA512 555d0129ab24172a5155c9d1ecd9c844854604e60e0bf394b31fcd74b086b6cf471f5a47aa1da0b16ad09a273fb51b1ee4ff288a8e81154e05455962546f27da
SSDEEP 12288:4psfZ0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:5Z0gQzUtcbV86Z/glD/dsa
TLSH
T1FFE4F05AE29802E4C12EA235C7564941B7237D6583E1E3CF62D0F83E1F76AD09DE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 bc9fd35118498533fe0ab7385d5a4ef0df4d3cde39e519d1a7218fbb3bfef982
MD5 e6f88163c4d00073425f8b426b5cb87c
SHA1 108bf534646df7f2b2b65f49296a9a2768add78a
SHA512 3d7e5a2f55e7a930e8d150a31393caa7ff2e8fd1de9e6be81612c4279c132daff0186c191e69324d1eb56d49275794b52e462fdd11a45b08501ce6e408ec542c
SSDEEP 12288:4T0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:4T0gQzUtcbV86Z/glD/dsa
TLSH
T1F3D423A6A35C51D0E73BDB3000AE4041660FBB988B54F5DFF618786A9DB5EE0ED3C642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e551ab5d25898a11cab3b8cc4db65308c41ebe9ec753d76f28cff93564107c89
MD5 a44c0bea9f7ef26f1b33294800bd594b
SHA1 c6b42d4a2089a1df84f274fce8550bc617e1ced8
SHA512 bc2b59bcc710600233dca05c8f8846d297e69cf01975ec0a437c9f8ae820643626bc5091f6cf2f07d06b300c8f7998c1a12e8cf27ed003847708eebd82109af7
SSDEEP 24576:D8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCB0gQzUtcbV86Z/glD/dsa:wRZwQCyiHiQEaiPnMw0fzUtcR86had3
TLSH
T11A85A01E62DC46A4E0BAD278CDA74407E6B278165731A7CF1190C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 28e9263c0c6d977269ce7ceef38f273406465bf55a1053c71570c9a7ebe13b67
MD5 e85dc9b58820d05ee38b57d0822c5a5a
SHA1 bfa5e87e1159d0241a8a4ba4b83f77a4a39921ad
SHA512 fb1728106573177973cab20a6ce1f51be9c72207a4c0db5f9ee35cd48d45e4911db48784b411142e46d36d53f303f368290da02c0269a1b980816497ebc2498e
SSDEEP 12288:6bxA1U7Kj0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:6bxA1UGj0gQzUtcbV86Z/glD/dsa
TLSH
T1D2E4126E629C20E0E276D63984D64002D732BD1A1721A7EF6194D17E4F3BFE49C39F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1f982d8faf89f521104beed3f80a5f9bc478bb2a86cf8163821e4818cad4774c
MD5 92acaf08cf2fd8ba4be4e92fb216b92c
SHA1 532bec1bc2fcd48f00cdaa4c738a0b9ca80a203b
SHA512 436f59a9bb0409f196fbe5ea0cae1161cd6784f2a105cc3d3fec7457d5f7b2c42ebcc04f3052d2b8ec921155d126cca7d09b73bbb911a3b3f624585aa3d6a6d3
SSDEEP 24576:rjsmP0yHaqrVqHra44KDzMsrn60gQzUtcbV86Z/glD/dsa:rjRP0yHfVqzlAsrn60fzUtcR86had3
TLSH
T18745AF2EF2B910F9D4AAD136454107B5BB71B42D1F209ACB0170C535AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 479acb6cf41621387141a0b21aff7159e5fb4eff48f9eda00b39ca1c766e5168
MD5 3c3415e4a73f39c728a53f260d84b983
SHA1 8fa66ed69ddedc0acfaac0b493b2b7077012450d
SHA512 dbda4263fc884e6acee817a6bff184d98dc8bac3160f1d74cf32fab3fcac2b83e3758c0c129c42cc5f13061c4afb0ba55e319036db8a4a63b1af5b6514f929c1
SSDEEP 12288:wZ0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:wZ0gQzUtcbV86Z/glD/dsa
TLSH
T119D423EAB24C51D0D737CB3040A904426A0BBF484759B6EFB52CB8679EB9EE1DD3C581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 1af5797635b3198579d87758c117a2d4bfe1d1b8e00f5ae6de501691d2a80ff8
MD5 dd1a4b363a1642edd786b70720f875fe
SHA1 17a5c588dd5c46857a900a972ab10fef200789df
SHA512 c1d275c3ef5ba068bad8f3b0398be8bc0f1027d2381d1f426942a2d8932be866392dc04a1b2eaa207c4a2ce4435e950c423cce78ad257010d5478ab61b6af287
SSDEEP 12288:4ObIA4LWO+vAYFT/0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:VALBUT/0gQzUtcbV86Z/glD/dsa
TLSH
T11E25F155F79400F4E97BC23CC9A68912E672B85D0764E7DF03A84A661F637E18E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 33ae3740940065cd7c2868c06bfe50ea5ef0c6fc1220212d8518274ebbcace90
MD5 b736ddd64fa9e87760a7caaab58b67e9
SHA1 88925d7e61905e68d5ba0e9b570cb13b82353fe4
SHA512 448462b252ca6985d26324e8c3a3e6b50bda29493bdfffa78939a0648ae7de35dee7dfa728b14e998ace1f753602e6cbd8ae4b157d45f2dfd0a03eede264de1f
SSDEEP 12288:Z70VmzIYNvUyBp80gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:WfYNHW0gQzUtcbV86Z/glD/dsa
TLSH
T1F705F12FA2AD18E4D63B91798AC38105F273B8561711A2DF15B0C27A1F27EE8BD3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2a9d1eb03bd18084448139469360de9fafead574a1f6761aecbb3dfb9bd35ffd
MD5 b351df2bd7c5a02f75c2d1378d22832f
SHA1 259f5cba0cb596f183d2714855e48bf213ff0dae
SHA512 4dfe5930f756adbf9c56d6f4b5c88706bda1d6ba6ef0c11cfb43c6857ffc83575b9794adde3047281c30f2c07e66c58d81715b5b4de7f08a813864d13373b5cb
SSDEEP 24576:qnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKV:qnXoJJYH84VVS6AmETJas+cHBjSSKHPl
TLSH
T10565BFAEA2BC04E8D5BBD17DC5C24506F5B278651331C6CF022181BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 31b2940d43d00fe6f0651bb8bd0a9b32a16931974fa59b2f663e6dbf5bfd99ad
MD5 252284ddcd48dde0cd607ea5e7afb318
SHA1 7a7e2e8a267824bfe25de6337a95cbe9ab07e5ad
SHA512 e48abd3cc182bb721e859e94656b9fe1ec4eac6a29508ff93182a63b00ca4e847ad5f767fe8e298683b5353f1e29a431c80b7b870011a811243d213ddf25ea6d
SSDEEP 24576:0v7Xbxd9Tuycf8M/TYlSuxrr2PC00gQzUtcbV86Z/glD/dsa:0DLL9TuJ0M/TYj2P50fzUtcR86had3
TLSH
T16F858C5EA2EC42D4E07BDABD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 9a3b33562cfcd275c7ab7a7ab953d300455c61c181a2854d99c06a7e8f274b07
MD5 f229515fbcf22b9718a231c9e8802fac
SHA1 88209317042464a126847c9513f40c80bef501a1
SHA512 3b11f28b9165439112988b0983c4c902bafb83cb95b4c4d45ed3f3ce57253f6b75d0455e3493190fd83c107f89863be3e8ed61e5cbb4a756e01f25e41375e5cb
SSDEEP 24576:cegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10w/0gQzUtcbV86Z/glD/dsa:cngOJOmPOHk/0fzUtcR86had3
TLSH
T1B455BF3FB7BC15D5E03EC17D8A968816F6B1782603255ACF0560827E5F2BEE46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 f8ad9d800735135204b2eca47caf331fa5f898f3bcb574ae8fb15261bca12aad
MD5 377ba147e4023a8b9f33b8a6b2acf5e0
SHA1 604ac99627ad54ec8d6aabdcfce6f237e18c9e58
SHA512 f8f57ed9528936368d21cfbd041096fb651553df278df7863a638158cf55824fa138bbdbd2fd0e53a0c586e38ffda446e6f7e68d3fd11fff22da3825851c9d5f
SSDEEP 24576:RLJnJiTk3R3waE4JrO50gQzUtcbV86Z/glD/dsa:RLJnJK8R304lq0fzUtcR86had3
TLSH
T10515E07DD2A810E8D4B7C2B4815A1A56FF32346C2B2579CB69B4D4353F12FE0AA79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5c26d7c8c061b7fb4798e7e72d8a5ea5ddbd653d79fe2a28414e376f6c727a25
MD5 ffa18ca7ff4d55adf317fa0fecd3a012
SHA1 204bf0b7ca260dba54259a1bf5760450a31b8716
SHA512 dd96ed76b2c589cd2b059e7160c46e2ab5a74d1750e44522f100db8dd4dbfcf92ecc390c62750d0fc2df9e0a9e50141a92ad9e5afcced62cef9d72e9e01718c9
SSDEEP 49152:59mqCzDScAZmlvTcFg8Ph6d0fzUtcR86had3:t2iUxd
TLSH
T1A7955C05F7EA5294E8B3CAF1C96694159B337C409B34F7EF4A80C96A1E32BD1D938B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 9c91cdd1c0fffef572e80b5551d71bc06a3cc2e0a6eed070dbd47ca92d1c54b8
MD5 620e64755cb1ddb85be37e067ee0a53b
SHA1 6d0caaf794da2c90ae505b9f94abe7b0e814ffeb
SHA512 474ea7444696317e4a6f2e2c498e669a925b7271ef763edcda01414c0d9d9d1ff74eee8ed2c95eee23f65c889a3571353dae702c6829ab9e55643f7b9d29fb74
SSDEEP 12288:jlYJeXm5nkEUuEQ0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:jlYJeXm5jUuEQ0gQzUtcbV86Z/glD/d3
TLSH
T1FAE412AD769C30E0D23BC13981A24441E372F5A5535167FFA1A4D47A8F76EE1AE3CE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 54cdde602cff7f664d1700ecaceaf2b321629660682b23ea6970537eaeccdb21
MD5 2b32e01fedc0afbb7b308aca6ef989a1
SHA1 40c149e36e2530113664c5005734642ba13121de
SHA512 7ec134e4bcafd921abe3c13ab41b82a485e2317eb27ddb98797b4927176a5fd481b1041159965ca5327865cab5c637b05e04bf2d629dc28f000c959c303adcee
SSDEEP 12288:lmu6kya0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:l7tya0gQzUtcbV86Z/glD/dsa
TLSH
T172F41255739861D0E7768A3485A34081DF36BD248B10A7EFA1A0F93F5E76BE0ED38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 2da2cada1c42fad83454a18743720ae7b0d0bbe19710cf32e1794f242501ffdc
MD5 43233f6deafa851a5630839046db24ae
SHA1 65bdab4d805afd762842169e1004f258a4564abe
SHA512 aa52339c371bb354dc024d6ecd38a2e9af55e71e02e976fbb5221e4ec70f3f68a2aee58968562d9e65cae51e36f33186138fa93b89ef66cad7cbd9722f149049
SSDEEP 12288:IP/0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:Y/0gQzUtcbV86Z/glD/dsa
TLSH
T129D423AD725861D0D737CA30406A0482960BBB584754B5FFB578F877CEB9AE0ED3C941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e1aff0cf21ff6f3674ad7eaeb8f42b7ad4f0832eaa8caea12881f70d6f592a82
MD5 6a1ad97252bfe87704041c2da3b6b12f
SHA1 922bccd746f0c624c6f4bdcfd687bd4683cf7502
SHA512 dac07442b66cdc19185ee74fdcd174b37b3da0ef3bc1607da31e271ca88215cbe222e4ddfd9137d01f2898ddb3a2e250a3ace8a84ee890d7218cbcb720a23b3e
SSDEEP 24576:9C+TyQIu93VAumZr7jmo0gQzUtcbV86Z/glD/dsa:9/TfIq+Yo0fzUtcR86had3
TLSH
T182558D1DA7E91DCAE276C675C8A34493EA33B872137196CF2044C07D499EEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 c26d7644bd1d9e8a17695b404e43f925522764fab8569d4bbc53a0958b8ff7a1
MD5 79ab456f15dc2ded8ad8b6f952414601
SHA1 fe89683e417ac0afb153da4b070c415da8f9e32e
SHA512 032dbe8525ba6bdcc37088093acd21cf50be12c2a28ed9ae970fa23e41033f9bee09ad0fc7ea6b0d15eb109362600107a8b3d550d7ae9d3be10112af78573a09
SSDEEP 12288:0cyrWOstaa3kcsr0gEdune2WfLXUa4nzcd5Vv9i6wm/guQlAB2DTbdsaSoU:hLQikZr0gQzUtcbV86Z/glD/dsa
TLSH
T1D5F4F10FB3AE10A1D177C23888954142FAB3B475471267DF52A0C67A4FB7AE9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f8717782fd59a35309d32f0129822643f7b59675a3f7950eaa3d02f1c7d1bbe3
MD5 ec08e22bdf7c5a3d03ea07924bf7c110
SHA1 7a91dc69f6c9b046f0db67201958a977a5a07ec6
SHA512 98074e144223cfab32a91a4fa6a26041426872f6ce3a890f6d38ded4f289f900d3e0f2fd8e37eced9705bcd5dd43a8f8d3112abf9533cfd1b365dd169d332863
SSDEEP 49152:2pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPa0fzUtcR8r:DpC7b4+80GTkliUxd
TLSH
T1EEA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/492-380-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/492-517-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/492-381-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/492-387-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1200-403-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1200-290-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1256-317-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1256-323-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1256-325-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/1256-511-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/1512-340-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1512-348-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1512-515-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1512-342-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1732-251-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/1732-265-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1732-250-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1732-257-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/1732-261-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/1852-56-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1852-58-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1852-63-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1852-69-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1852-71-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2144-360-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2144-246-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2144-240-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2144-239-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2640-53-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2640-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2640-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2640-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2968-28-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2968-215-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2968-20-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2968-26-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2968-27-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3104-0-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3104-17-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3104-18-0x0000000140000000-0x000000014033B000-memory.dmp

Download

memory/3104-8-0x0000000140000000-0x000000014033B000-memory.dmp

Download

memory/3104-9-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3920-524-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-523-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-530-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-536-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-527-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-532-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-528-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-531-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-533-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-518-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-529-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-519-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-526-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-535-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-520-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-521-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-525-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3920-522-0x00000231DC850000-0x00000231DC860000-memory.dmp

Download

memory/3940-428-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3940-437-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3940-434-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3940-493-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3940-606-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3940-477-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3940-509-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4068-410-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4068-412-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4068-404-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4068-601-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4164-415-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4164-294-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4164-300-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4164-302-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4192-232-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4192-78-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/4192-72-0x0000000000940000-0x00000000009A0000-memory.dmp

Download

memory/4192-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4368-39-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4368-33-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4368-230-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4368-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4460-364-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4460-370-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4460-374-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4460-376-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4460-372-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4524-311-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4524-305-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4524-604-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4524-313-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4524-436-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4584-278-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4584-277-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4584-399-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4584-284-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4644-352-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4644-358-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4644-516-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4644-361-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4648-400-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4648-534-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4648-397-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4668-266-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4668-272-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4668-379-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/4668-264-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/4976-514-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4976-336-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4976-334-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4976-328-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5052-422-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5052-424-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5052-605-0x0000000140000000-0x00000001400C2000-memory.dmp

Download