3cc5f3e493375a4d31a707b67b0dc06b50d57807cb06d6813da7f413b8773b93

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_db38912f554edcffd5a5359d21ccc93c_icedid_njrat_ryuk.exe
Size 1.3MB
Sample260424-24xffsfs2p
SHA256 3cc5f3e493375a4d31a707b67b0dc06b50d57807cb06d6813da7f413b8773b93
MD5 db38912f554edcffd5a5359d21ccc93c
SHA1 e73a7aa80718a254ba7ada3e54d5654301c15c62
SHA512 291c184ea4b1bd4ebd0c1f02587578cc38f647aafd4eb174bf56e1b83993f3d7d40451d891d8d88b3e0f004cad26e8d8051817b227f07eebd1f0c6e357fe1c0d
SSDEEP 12288:5D6b3hm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:5D6bxm1PEJL+RwxhHxXWN/eL7
TLSH
T133550247B36870F8F1678239C9921619EB76B8750B70978F0674433A2F276D19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2876	alg.exe
5040	elevation_service.exe
4616	elevation_service.exe
3704	maintenanceservice.exe
2548	OSE.EXE
1688	DiagnosticsHub.StandardCollector.Service.exe
1720	fxssvc.exe
676	msdtc.exe
4800	PerceptionSimulationService.exe
4744	perfhost.exe
5032	locator.exe
5116	SensorDataService.exe
1320	snmptrap.exe
3432	spectrum.exe
1672	ssh-agent.exe
2152	TieringEngineService.exe
2112	AgentService.exe
2396	vds.exe
1644	vssvc.exe
3688	wbengine.exe
2520	WmiApSrv.exe
4088	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-04-24_db38912f554edcffd5a5359d21ccc93c_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ce8073db14bf40d2.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1a464a13fd4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058ccd3a23fd4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a83adea13fd4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f02c6ea13fd4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf62e5a13fd4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3988	2026-04-24_db38912f554edcffd5a5359d21ccc93c_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2876	alg.exe
Token: SeDebugPrivilege	2876	alg.exe
Token: SeDebugPrivilege	2876	alg.exe
Token: SeTakeOwnershipPrivilege	5040	elevation_service.exe
Token: SeAuditPrivilege	1720	fxssvc.exe
Token: SeRestorePrivilege	2152	TieringEngineService.exe
Token: SeManageVolumePrivilege	2152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2112	AgentService.exe
Token: SeBackupPrivilege	1644	vssvc.exe
Token: SeRestorePrivilege	1644	vssvc.exe
Token: SeAuditPrivilege	1644	vssvc.exe
Token: SeBackupPrivilege	3688	wbengine.exe
Token: SeRestorePrivilege	3688	wbengine.exe
Token: SeSecurityPrivilege	3688	wbengine.exe
Token: 33	4088	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeDebugPrivilege	5040	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2156	4088	SearchIndexer.exe	106
PID 4088 wrote to memory of 772	4088	SearchIndexer.exe	107
PID 4088 wrote to memory of 4836	4088	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-24_db38912f554edcffd5a5359d21ccc93c_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_db38912f554edcffd5a5359d21ccc93c_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4616

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1964

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:676

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4744

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5032

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1320

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1544

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2156
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2952 2932 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:772
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2924 2876 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 367dffb229da5c3527a3fca55be22a8cff79442c27b9e3131567d61461f825c2
MD5 f02b9c9bcd06f6e51727b9e021643bd8
SHA1 18883926667a1bdb0f36c3c1ef267f01252ff28c
SHA512 d7055338604d41e1c56dc00735fb5531b5e90cf82a5365276bf86ea18fd3e671d9dace767859f3c00daf38e06afa1c9c45519df42f81b2055caf76d349bff332
SSDEEP 49152:Ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxn11MV+RSJWp:O3q6sjBomV2SJW
TLSH
T1C1D58D03F29901E8E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 0e0d65e51208d45241be497b368922ec2f0f84fc3cd1a0fd23b030a2e324c40a
MD5 918d1e59a648104fa3287f51c71d4fc3
SHA1 16a0259da28111297110d0f534fcc2e4cc3a5c95
SHA512 3cec4cb3e907e776e1bd4183a145607f9cacffa79d2af5d6307babb1a4c4c335dce7bb833e16a4253eb4a84aa61ce9d344d56fbec79441add313151254537654
SSDEEP 12288:+1XLsswWkxy2lRq2czA9m1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JP:MXYfDtczA9m1PEJL+RwxhHxXWN/eL7
TLSH
T1F165F12973E509F8FD57813DC8A28515DA73B88147A4E79B03B48A2A1F337C45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8a1c9c1cd4a572ffa4bb32c3953915425af6354f5766e4054bea7a4f8c7d8d49
MD5 522ccfeb3962f9ea9e8bd137a90dd383
SHA1 a70ef75f6a98e13c3330a77ef68a53aaeaafa535
SHA512 9cbb2a4baae506d3cb857783a1c7ff9acc294823806019c84a56ea110947aed7952b6ecc0388be9ed5d7c5b3f5a744c2e2b23f26432723d5c3265b98241e337e
SSDEEP 24576:T0Le5ji0hmxxrMym1PEJL+RwxhHxXWN/eL7:TPji0Ajy1MV+RSJWp
TLSH
T159859E16F6748335D073C0B9C5D2A69EED7130825B308ACB4296D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ee0ffb306b661617f48e94853355cec8e3b1a0a708a89ee04da0a60a11221fde
MD5 edb29af9f1498e6ba541840c3d9d4940
SHA1 c064fa66b4c3e7d8e0319873c19354aead9478a2
SHA512 9902922ee857d7cab194f713c235b38ebdd9f8ef0a132ee852711e362678c14c571b81ee22377aacfa1bfe52c5c15a8753e64c907601740853e50fed21bd8840
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWn6q8wyucm1PEJL+RwxhHxXWN/eL7:Q/ezSC6vUzPveHjy+1MV+RSJWp
TLSH
T12A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 300e51564b70f2edcb98e575714cde692224cfeaa459ff404dd71aa8e112b765
MD5 eaaca1c2d001e6a187c4361869e769d8
SHA1 6ba937e1e90a31b0a8323c954d8b8996f802a74c
SHA512 8fc74e9e90b7a5d16fa997274200d17efeb82de936b72c693b7f6fe1eb8c4a6d092c440be98c9dd88777b755e5f28c4f97f83f1ba816b0251df6609bc33761c4
SSDEEP 24576:mVbqPb88hv/l+Ypm1PEJL+RwxhHxXWN/eL7:mVO88hXl+/1MV+RSJWp
TLSH
T10D559E66F6748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ef0c0fa03e9ddefd24638a348238ae8f7bb1cf52af9edc0cbdfbe8d38164b366
MD5 6fb8644d999c5d3146feebb67f7170b7
SHA1 5dd43d600be90b63b86174c70a5c4965d588f30d
SHA512 c34408f299d8763152cd4c61ffccb112ff1278a6979f97f637f1e225467744d9660a5abe8623ccc84c77d165555a73bfddd4565442a0986dda714b54eeb29544
SSDEEP 12288:FLem1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:FLem1PEJL+RwxhHxXWN/eL7
TLSH
T165452353B37DB264FB8E023965A2767CC9A9DC8059ECA9130E725F0F1A7D9C3D91804B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 71eb799040b6c589e1d3009c16ad3316d9891985e9ad8296dc4e358ae8c77f48
MD5 2755851427a6a2025fa896ff30e74f20
SHA1 ea023e6f70d4e23fbb3f40161a69fedf4dff2e7a
SHA512 f34d701ed39c5445913508b4d364e58f4afb080a57cfe4201a782ecba142073b59ca447ed2d092517459d33880c6b2146a738f4bb590b96d80ff6c93a6b79eaa
SSDEEP 12288:ieBNUbTVO86UBm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuQ:iJIUBm1PEJL+RwxhHxXWN/eL7
TLSH
T1FE65CE3BAE28FCE1C27E4D795A918600D7B2B8704F62A3CBD175830E9E235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c295e1632538329ad9a2da5c9ff74d0497b97a5094545dbb98b5eb76d41fa291
MD5 22b0ef30151c413c0297e840fb970ac9
SHA1 f6f4b1fee770867047c798c6a221c6691e361789
SHA512 75372366a8d6fc109b74d4fbed033936e1bdb93113184769e4eca123fd7c723514c139f47f5a57728b4312ebf696c66c3e7887eae2b4150399b9b35d8c1290d1
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH:QQvGAdlCEL8c/DRNw5CnmV2SJW
TLSH
T1B7267D656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7c1073547658f2b3deefb90f7424fc0860f1c8845575a3bdad42b5327359f5f4
MD5 11b35348678be4e124b189b7cf375ec3
SHA1 b00beb4f8436a92331a0afcbc57855e93696f531
SHA512 76decd6eceaca6d9dc47c46cabbfeb17cdd879c50c5750f472f6b2a91bb0160f204e8aed424e6057ca15661349a4503e8e678da8b7118a71c01faf89f6221dad
SSDEEP 12288:LAwSfxL/2Dc3RDLLmt0LDQewsAjrm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3q:00ewsAjrm1PEJL+RwxhHxXWN/eL7
TLSH
T18C75E031FA74E036D3BF0DB61B26D716587CB9504BA119C3E3B88E8E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0629ad880ec60d6fd552cc4c1c17a115aee86cf0559b2dcb899b0dd20b67a402
MD5 dac42b9f1875115b61fdf96175d9c50b
SHA1 4ae3d92cbf5075d560e5c164a6a71dda86b4aff9
SHA512 2609f7301e341aeaa747a3b971be456a4df0c9d9de3b9a69b2acc4c2684a36cb3b5465e382a9ae4aeedb3f28968880fe01abfed08fd64b139b30f642b317782a
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHdZ:hUEtQevvqc2W1cpV2tI32dZ
TLSH
T10A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 64c1ce2489c130f9bd2c4b8a108f47c946c60c5ad202742801a1f402f814018e
MD5 762aa2ca0d857a3f3ede7f4b5d063b2d
SHA1 ccc1073ec2624b27538a719707228b25171da5d4
SHA512 5b609264a15c1d7cca5d7e559a707aabba95b39cc01c1432255e4e40ac6e20324719438197d476394916e59a5cf1e51f70ecd5a300ca8a0342f8a1c7f6324efb
SSDEEP 49152:TCbRquA/m2yL5zifFiV+XenmE3/zC1MV+RSJWp:soqHVjnmjmV2SJW
TLSH
T1DDD58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9d7e5f89ad6dc45d4fd2d9686813a92f1552aa124686cd3a55068192374901f2
MD5 bb88dc58f07f9305d965a96bd802fe2d
SHA1 0771ebc3afd6bb9f6f2e6057bde1e8dd02a2d945
SHA512 ec4014b1a42ad271c3bd9e5b36e5b2c4b918c6c32bbe8b4e111d7709095da4297cd5b84f282d65cbd74c347c40c68507be8d5a065f497fca8371afb2f06c49e9
SSDEEP 24576:4AhGL3IFoiwtA5l7S53gm1PEJL+RwxhHxXWN/eL7:4AMUFoiq5T1MV+RSJWp
TLSH
T10E359D81E7F955D4F5B3AA7899B69171EA76BCA65E31D20F2160C20F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 40169a76db233fe48a32fc07b55297c08b279b7c594393d2183e86161de38349
MD5 47eb96e16aaa6c9bf9f20e034eded528
SHA1 d7784d2148cc4686bcd7c69577f7b9f0466651b1
SHA512 3e1fcacf3d47e6899e5e8caa6800af340978cbf9c40770b8b75a98c9c413126dd7a4c418d19991f272cfc89cd50733a183ad9805a951d29bd318d6bc6f48e58b
SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+C8m1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39C:Dwu4OW/m1PEJL+RwxhHxXWN/eL7
TLSH
T10F65F14673A81CF8FAA7423985939136E7F2BC412A65DB1F0770C61B6F37251AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7788658559944fe06ab912e804204837af6c30f4d3bf0d8325f8afb910a13db0
MD5 e006499e22db3e1330ea2bd66f69e083
SHA1 b1e659a1151bfcaa30376c5ec46b74c1cccd8e59
SHA512 0496c713e441b40f269b8957bbca07f018f477161c63f87be8e724e95cf6eb325dbd0e13774c365abdeaf6f87122a0faf87cf597d36a4e9638d6b891a6d156a0
SSDEEP 12288:feZ1Iy7m1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:GZuKm1PEJL+RwxhHxXWN/eL7
TLSH
T19F55125A33A871F8F297023D99E16619C7B5B88227B593CF0A31475E1F37AC25D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0cb19b4c874ffa374494472300a885e3cb6774fd5d2c1e9fa6cd8526a68916b6
MD5 ef0e976708de6f4f553fe2280b72cbc6
SHA1 eadbc000e8100ada9234cca9ed944ecb049ddd1d
SHA512 08be4020ae800ebef1b682b4618a8b0215e7599c068961250de46bfc05eacac630c522bab3309f3f1f053c1f496eea240fa405ac95a1db514fce905ffda783a8
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UM:tQRQyi36YOcPbLvw2gAf+PN3cmV2SJW
TLSH
T13B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e456e0d43563b4a3ad52449048be270c764518b07ab6726a9be9a500c40f709d
MD5 a20078f9e49212dc98c6a945f4f5d22a
SHA1 4f4c1fb6d91247edd838b020917fae1d7e2a76a4
SHA512 6e373d03177c0d68fea68d6121110a954041fccc382b99e05db3e1aedc07745aafd2630f48756a94d06cd8b236ce2a5d317249243847996a44678c31ad7250aa
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UM:MQRQyi36YOcPbLvw2gAf+PN3cmV2SJW
TLSH
T1E2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 eab9bf87864f0d1af830fbe0c324914d03625180d705f44bbfa5d68f5ca48d6b
MD5 627da653479ba49566590f3423d98dd8
SHA1 60821f3851d77e33f6ee9b81cba484d4e6f59d51
SHA512 f95d21ee06d3bc077e20fa53ba894d326d7045c38fa1b519adfa1a96d2aaf94e9f5c7663da9e8352a33eb8e908300149a0c89f19bf46c41d8b5a9f3197ea5408
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL06m1PEJL+RwxhHxR:d68Qg55nhceWu7PNU3/y1MV+RSJWp
TLSH
T12DB55933B2F600A9D44DD1769F4A973196D27C718FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5f84a660fe474e6dc009c2eaddd7454c7d358e74fe7fa81015f1a8053952c340
MD5 70d6bdf8a888ee4892d5a207d547ad73
SHA1 d8d5e788cf5dbcef6bceae0f56506e9f3cbc3026
SHA512 ec20d777316e373a05692eaa69396cce36aaf205b1cabe8edd3a3e7d7815fccc2362dd7ca5f63ed6692e81e05e0b9ed757110a9f66bdb4f33fe116dd81ac2e8d
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk992:Ay5112gYy5azzVvt69nLKnhZhmV2SJW
TLSH
T103167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d9d2bf6a90dfc85b158718be8ce877174b120dbb0feb4785901afa659cf7c87
MD5 bdc9e571c2c4786ee0433378f4426925
SHA1 49e151fa188de1665f546ec8b8f5ba3055aa4c64
SHA512 ee14e9d86603a190de3410ffdd940eaef904e74d65d3a945d94c1be28ad1c11a6d858ac9b300d9c46aa59abbe1c650afa898ae497de8348957685e655164aa6e
SSDEEP 49152:2B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glU1MV+RSJWp:Eu6Jmdxd2dUmV2SJW
TLSH
T1D4D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3212bafb3edd1cf7148e29bbffcb892421bdd4756eaf4960c0c1c7a73bcd0f05
MD5 eec17260c68ac2a1bd312af07e3ee45b
SHA1 37298800a9586f2d595664ab5a7082779805ea01
SHA512 5570d4dc14cd13dbc0170e5fbeb044e4990550b8f43b620052544244444d2b1aeb159cbcc460fc1250ee0316f9835d86b53fa89f164df37e406dba569863857e
SSDEEP 49152:h1hpsNoJpF1A63U44CwH7R4xw1MV+RSJWp:hmifPWRjmV2SJW
TLSH
T13FB5AE13F2D901E8D05EC17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bdf1bdb9656b4b4a4da1caab51725779ebfd4962a630c3b6c901955d9674b2c6
MD5 3e0af3d08c498f0e840a2674536b1052
SHA1 f2588f57098469f818cc5d3d62b479b5a5654357
SHA512 ec9e375a797511e60bfdede28b6542f41a61f156fa9259685b8465e46bc9ba6688dc2694f9d949f1e2ea600e472d827cb0cf0a22f719ab2c4332f18848755eb4
SSDEEP 49152:4SuZQIY0Be2KcRVtOnks6NMHql1MV+RSJWp:i5dKii61lmV2SJW
TLSH
T1D2C5BE03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7df6026a7093a76dd4dcce16399f463ba7885765789b76f998411422cab90706
MD5 54e589e52b5ee93db7a24f2bf3996b04
SHA1 11548ac0b23397a3cbcccdc5d3d493b917d7b12d
SHA512 b335e5d41d533e643f2c65a240418ed4ea336a7b68b3dea568fa44e80cdf69ba2fbfea302b575b2efa5355ca221f53656d33232dd10eb5eb55eaa8f154b29a60
SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5wE1MV+RSJWp:eX2imphvmV2SJW
TLSH
T1BC95BE13F2D901E8D05ED178C7568632E962BC050B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c4f590313d06bd50d24b0c988e55615cba2ff5a2af8635e5c9c4e3a02f4aba02
MD5 6e60ad39e7ce79e016268f7c5f23bcb8
SHA1 991a0ca56d54fd5918aab20a2d2b59eb3c342862
SHA512 c5c69bd04c81181a25c1fb59a6a949ebde8cd037f5e23129d6a5517aa4194f9cc62cf81806b46d83b0fd37ef03d228fdc71686a057b381b6aca86a3fdd1f6acf
SSDEEP 12288:RWm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:RWm1PEJL+RwxhHxXWN/eL7
TLSH
T16A452346777EA368F78A02355592326CC8ACDCC66AEDA5131F374A0F1F7E9C35D18049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7399ceb21e10a23a214440d723032775853454347b24f19ed0b2ab3612325e55
MD5 2e34a264124086a58f06081d7f94d77e
SHA1 79494e960fd9c9d460ab840deb00f7e2fcf8ccc7
SHA512 8b3e3bf4736ad3141c7e17c0eeb6e72694931e99947fc41f75ab0c8ab88f795b2df886a21ce1a1e630edf371f7ada43b4d67379a80d8b124173af75777fe4377
SSDEEP 12288:lHm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:lHm1PEJL+RwxhHxXWN/eL7
TLSH
T1D3452356777EA264F78A01356592326CC8ACDCC66EEDA5131F374E0F1B3DAC35D1804A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1383dfca428b469dcf85721e943185c73c4d36e39dcf48193c86340a695b935b
MD5 f33a0246cdadbe6028b9fb47b68f02d9
SHA1 ec4a115250deb42f87a7e8af6acaae3c83300807
SHA512 9c67dd97e12973c0f6cfcd020a40e75c4f3f9f74689abec51af4bde5dc232b5d644f983924a5255360c257ea42e9a3df227a209e9af96c9bfea36da11e348b81
SSDEEP 12288:/Zm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:/Zm1PEJL+RwxhHxXWN/eL7
TLSH
T127452356777EA264F78A01396592326CC8ACDCC66EEDA5131F374E0F1B3E9C39D18089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 dcc997f91d0880588ec2ab26fece0e039ba577039cf1d239334fec694ce101be
MD5 e0fd98d84960093fb1c4c94f8cf3c48d
SHA1 02217ef6cdf6b640913c74fdfc67e45c7116b4c2
SHA512 294219a4583cd059e5698363c1f217fe4e397f0fa102aacbb7b0608833b7cebe0e25af8a7e093b304c602d3c5f28268af2b722ab56907cb6f9f3a1060be18069
SSDEEP 12288:yVAm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:/m1PEJL+RwxhHxXWN/eL7
TLSH
T17A452352337D92E4F68A4239D9A26128C9F9FCC15BB9A6570F320E0F0F76BC29D38545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7c3631a5477f71de78d49c03912e4911cad7a2e76426e3c588b62ad6e033986a
MD5 ffe251105796c58517bc3145c02fb2a5
SHA1 83a9882c72b60fb8f5e443b55725173617e0f881
SHA512 6f0cc94686852257e5489179d09baffa3d979fb230471aa655bb3f4360373910b7a38ae30bd5d74da3ac0634949bb4b49729e4f0c0192aba9e3d0b11314cc8e1
SSDEEP 12288:uIm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:uIm1PEJL+RwxhHxXWN/eL7
TLSH
T138452356737EA264F78A01396592326CC8ACDCC66EEDA5131F374A0F1F7E9C35D18089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8175384f9be7616edc68070aefd83f2fc39bde47049a186039132df7149e468f
MD5 14048646b105ee6524b14366116b576c
SHA1 c1ab47a4406262a7727fbe02e2948a1434e69a06
SHA512 a38738dc92e562b2ae402ebf70dee8b4d096f66b56f696540678182f8fae38e527809cf979e84e26c9e4bff77b5e6ca51ed290e8202e3c9013a2b0c26e156ebf
SSDEEP 12288:vjm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:vjm1PEJL+RwxhHxXWN/eL7
TLSH
T1AE452356737EA264F78A01396592326CC8ACECC66EEDA1131F374E0F1B7D9C35D1804A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5db6fb5dece68fc855978d2d5b30635750fb95917fa08a1c6582e52a207ecc9b
MD5 647b2a5288fa992bc5ffe908756b8c12
SHA1 0ae7ee99c56d5ad3c4dac141773d2e8744ec3cf3
SHA512 afdce6ca57a1618b20ae20352f162eea73e2509ca11112a7029335e799f683a40ea22f0dbec91a2b8aefb7591f44c30b1668e10e9584a61172744b0c6d4df5af
SSDEEP 12288:nvm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:nvm1PEJL+RwxhHxXWN/eL7
TLSH
T1D5452356B37EA264F78A01396591327CC8ACECC66EEDA1131F374A0F1B7E9C35D1804A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d89dee755c4043d76c95080ad8417cf874c874aaaa642a165469bc00d05e77cd
MD5 b596ecd22cc9ad23dadeeb1a3b0da4da
SHA1 0257f7153f5775a2508aa105cf717637b030bc65
SHA512 8f0c9a2b15a146032b81ad81c33bc142ab382ac016c8fc37ede6f1abbbea46a99aa46ecd271c04a23e58c713d0f3051e82ce4b558fc586239fc6a664c788ae1e
SSDEEP 12288:miZwbVzzFEoS2cPvynm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeH:pZMRzFVSOnm1PEJL+RwxhHxXWN/eL7
TLSH
T19C650195B3A418F8EDA7423EC9519919C6B2BC5A0BB0C61F07B4361B1F373911C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b9179e565545faa92f13366d985573e2ab835bbb28715a078141a8f7dda2d53d
MD5 65f903faced27a3da8285418e9738a35
SHA1 d2f4ebe3f7601a93a1aa2a5694feee0bbfb38070
SHA512 6a36971171dd45808f3881b0e19334984fca4d3a7c82c1d2d7eac25d2d7245f8ef50723035f3e038a304436cc557e7a23720d76fdd861a4a2aeba5fa737f66f0
SSDEEP 12288:6am1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:6am1PEJL+RwxhHxXWN/eL7
TLSH
T1A0452356777EA268F78A01396592326CCCACECC66AEDA5131F374E0F1B3E9C35D18049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f0813b2c8c23bee37169f456f014d70f77ffc706f0ff49c1981b3ad6a314c186
MD5 22402fc1d77bd3605b741d5898235624
SHA1 dc877f2aba919ccd418d0fdaf565c66a08ba1c04
SHA512 2d913c0e92881426a045ea5779ead37d4d236427b10443ad1deb3a45402a77d9abefa79444dc38bf8685186c6c6ce92f6480ae9bcde02c788d14921dcff6f173
SSDEEP 12288:kum1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:kum1PEJL+RwxhHxXWN/eL7
TLSH
T1F0452357737EA264F78A01395592326CC8ACECC66AE9A5131F374E0F1B7D9C35D1804A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 cfd4df8dcdd1695d248d5759587200403167dc080cd1db6732b597660a111dde
MD5 34b87a484248d034f320a2fb714aba7c
SHA1 a6159150ef2b6eec482076963d1c04fec0b9cb41
SHA512 26ce7dac03b3a3fb89ab581b36dfcb48f909244629c8cd1c85d54c39215581a35ff5de1ca502667515fe54e4cdc94fabf5fe311a5681e2773d02c51d1ec8cdbc
SSDEEP 12288:ZyPz5L87m1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:Yzy7m1PEJL+RwxhHxXWN/eL7
TLSH
T19455020773A531F8E2674239C8A21A15E7B5B8720B649AAF1770473B1F376C19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c0b232887060ed7bf6e72a37008a6df588a531492c1f9794cf03fb6e50cba593
MD5 e4bb23e91e6e076cda2d26b4b925936d
SHA1 0bbde96b5b87f57d0facec3b24a8c966b84d85dd
SHA512 90490c1f9f22de791b39003fe24e812503f64609715539fb9687dfbed627bfc9900b7d5aa9181c0a3a001018db80af479a707c034063778d16a188fcaf4b2184
SSDEEP 12288:jam1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:jam1PEJL+RwxhHxXWN/eL7
TLSH
T1E2452356737EA268F78A01396592326CCCACECC66AE9A5131F374E0F1B7E9C35D18049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 010030738542bda493cb517e9d96b9af3527052fee01326e34531aae132feee0
MD5 14e3291b8a0b45f7ad2d62b312d86722
SHA1 99b92293b1081b484d5d0b74a9f5529ddd9e162f
SHA512 8ab107dda924e61fc9ddcfaa56ab4fe461206c4160b9fe4f2c0257d1d20894fac368b1bfe98b66ce9795804a7ac0cd1fd74da409f019f3ff80b7a72e0cccf560
SSDEEP 12288:ram1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:ram1PEJL+RwxhHxXWN/eL7
TLSH
T144452356777EA264F78A01396592326CCCACECC66AE9A5131F374E0F1F3E9C35D18049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 608a71753ef4f01fa362fa5ed2a48116b4ebc0a1dcabb4801f4783b297e07389
MD5 b825cf4cf9f0914eb5f7c689885256da
SHA1 ac6136f3d7132ad6c5d01756cefb4557089ceb15
SHA512 2110a8001f898521c833b22f1b91ade54b7a780e8f8e723945657d03e1118dc5441c8d041a10860f09aeb754352af0454ee3a1a52c8c0bf9f2b6b32fc979e65d
SSDEEP 12288:byPz5L87m1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:Wzy7m1PEJL+RwxhHxXWN/eL7
TLSH
T14655020773A531F8E2674239C8A21A15E7B5B8720B649AAF1770473B1F376C19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c2b86e202333ed67c77cae04ae37acb776c2d6a258aae1c273e94d4c544edd47
MD5 184c49d0308f9fa11e8f4ce4d6bf7efb
SHA1 26952a47729b0a2d03d4a99df18a3dedb036da2f
SHA512 a8e6dbd52933c599af4ad85902fa658e584ba84e45c1c68c7af4ac334d0389d7738034c610b810347bf3b294cdd947187845627846c139e5616d1b48f0e5b40e
SSDEEP 24576:STDaLl3z0zDJm1PEJL+RwxhHxXWN/eL7:STuLlj31MV+RSJWp
TLSH
T15B650195B36018F8ED67413EC962991AC6B2BC5A0BB0C61F07B4361B1F373915C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 cd92543f8efd22d09cfcf3de39aae27e5b46aaa3d43c10de947ba80cc59d9d3b
MD5 3932ff1d1fb98e63dfad136fb98d9ce9
SHA1 a1df0684d9110e33518a3fe597a0d223dfaee8bb
SHA512 671766de718563fba5122063b63dd7599204d1910a4f6448b682582c751efe8e2145f02510806115dd2be6733ca71fa3b117c5bf2aa2e1fa61dba00c175e58bc
SSDEEP 24576:W3vd9CHKy7GZVm1PEJL+RwxhHxXWN/eL7:4vd9CHKyaq1MV+RSJWp
TLSH
T19275CF90F3E810E8F1B78A3589725511DAB67C991B71DE8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 677444ecf541af4e67f464e1a9356b58f422e6674d4a32df3bef0a04554aa3bd
MD5 ff68cd5a1d91d2acc022d6e597df9125
SHA1 716d61c3a1b5dc2f740d7db98d2665b71b6d3270
SHA512 3fccf35a4e576a1988f001bbe0a5bede08cf4f17f132c9a640f7cb9f2444c725a239a0da6a5ebb2ac2e38679cc504314cb34aa8daa27b05f9db760f8c8379f48
SSDEEP 12288:L5m1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:L5m1PEJL+RwxhHxXWN/eL7
TLSH
T18E452356737EA268F78A01396592326CC8ACDCC66EEDA5131F374E0F1B7E9C35D18089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c522106d0031851b12ae343a9831bc672f25a1199b4d5d1221bbd6a54add1596
MD5 9ef7020a5eb71353754b637b3f8f0541
SHA1 16403e1339b1ccf24fe96877463e2b983459dd06
SHA512 114852b4d0ec18bdfebd6fd12792b06d791e00d8d4facb20f6cfd1aa9486db6f97f3c94bdd787a468f706b3b406b13d332aab3b03c607ddacb1a3055e9b90b5a
SSDEEP 12288:3bm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:3bm1PEJL+RwxhHxXWN/eL7
TLSH
T145452356777DA278F78E01396592326CC8ACECC56AE9A5131F374E0F1B7E9C38D1804A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b2feed4e1db7a2470050999d567b70ed2904e3293258e511cc1087c003d9bd9b
MD5 52cdb320cd07eb66095da059bcbe3659
SHA1 5b31c7acc0bad6c9cd8a823aa493aaeb0ed2b888
SHA512 f28552ead4095da600839c3cb227f3a1733add2be569e9875dc93c48f6d0bdb83be3de2e97ca7e4b0aebaa809e7ce75db55334ed45bd04ff1aeca48f9aa7d869
SSDEEP 12288:Ckm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:Ckm1PEJL+RwxhHxXWN/eL7
TLSH
T11F452356737EA264F78A01396592326CCCACECC66AE9A5131F374E0F1F7E9C35D1804A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c4edbea7b6ffd05742b79dc0479fd445039d770c07d8a4e1159ac7df9e1cdafb
MD5 65542832c583535fe116ff9457576bf1
SHA1 feefb5a386127a3dd19571f625dbb030b9443673
SHA512 41901bf9fb113148a8b391e557af23f93c8a7eafe39bf975fd721d7a383ea3449ece1be25fde3b710b86d2ba5a067edc1bae789476f3c14544256d38070336f5
SSDEEP 12288:zam1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:zam1PEJL+RwxhHxXWN/eL7
TLSH
T19F452356777EA264F78A01396592326CCCACECC66AE9A5131F374E0F1F3E9C35D18049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c980ede5e8cc702b639d1be6e25d3464e557f1d1f35df6ee6ac884839404210c
MD5 151740d8a84db962b9f7714eff116377
SHA1 45128b60a51fd839f601177fffda6c90d9837219
SHA512 1385da5a48907d47534a8b76a440e5428441c01b8235b81078b9067d7c0697fe1ffdcf1b85a2ba5b0bcbdb107845b556881495a700005bb00b4cb9165c804094
SSDEEP 12288:UbsfKm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:LKm1PEJL+RwxhHxXWN/eL7
TLSH
T18655F00AE2A852E8E19E1239C7525644F777BC5187E1D3CB17E0F93E0F3A6819DE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 813b11ab7767110c320a71beff903cf738c0eb5188f28428119b27e3c1f8aab8
MD5 54fe495a069a8dacaccfaac2134069e4
SHA1 aa292a546fd7994a0caefd723d34b2cd9a5a8fa6
SHA512 2843bf7bc57b6d1985b506490833d445089e0f4e1fe40ce11abb0a42c37b782cd1d2809e5629067dec8c709ae971843fb536391502643675e9ca7742c2e87342
SSDEEP 12288:v6m1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:v6m1PEJL+RwxhHxXWN/eL7
TLSH
T141452352B37DA264F79E023555A2723CC96DF8C55FA8E5D32E224B0F1A39DC29D3840B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 122c2efc9b8bab096479fb534bf8ac1d5e64b88155f44123ddc8314c062ed69b
MD5 15bcf023693a7f726c4ba787ad9313d2
SHA1 040ab3bcd7b3794fd2804a92ce9744f463a759c6
SHA512 26e6299aa3994b7ddfb78d3e274c235314067553e5500696cc905fd7f2a5db0bfd567616019b6f7f13277779b314d460fe324159888b5445a1dffacb0835ce66
SSDEEP 24576:u8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCUm1PEJL+RwxhHxXWN/eL7:3RZwQCyiHiQEaiPnMA1MV+RSJWp
TLSH
T19685AF1E63DC46A4E0BAD278CDA74407E6B27816573197CF0291C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 86309aca4ea069c4cbe9992b70707bc12bd6c5c93d97ce135296d02c39171762
MD5 b98ed457ff58d24014f5a2db31491af4
SHA1 9202eca5c9e64a170460e5f59e24a0a9cf89199b
SHA512 1c9be5eb2e881d054e665b620527e2c3b91b27d943557ff70149572c6f9e499fbd66f97d67d32182efa14972aef47b785368fd54c2c206d4d6a10910167a4350
SSDEEP 12288:tbxA1U7KKm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:tbxA1UGKm1PEJL+RwxhHxXWN/eL7
TLSH
T1D955122E63AC25F4F2AA813D99D29109C771BC461765A3EF15A1833E0F3BED19C35A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8baf6ac3153a10afe74ff65e556edecbaa3042f69dfe15df6c296f6c5e9a1cfb
MD5 c650e303061408711ad7ab2e55dbbeb6
SHA1 3f804a75d79bbe97fe20d7fe186b332f88c4efe5
SHA512 05ee4279743079b9122cbc6f0a2fd473ce103fc4586bc4e1d371b762bb3daa0cdafb0cc73c23f550b8cc2d772e2d28953c3864b752527aa3b6daaeb81e88d2d9
SSDEEP 24576:NjsmP0yHaqrVqHra44KDzMsrn/m1PEJL+RwxhHxXWN/eL7:NjRP0yHfVqzlAsrne1MV+RSJWp
TLSH
T1B545AF2EF2B910B9D4AAC136454107B5EB71B42D1F209AC70170C639AF0AEE99F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9d83f761827f4293f5db979350874dfe3b4f2a2c8d199c17f27aff1b895f9572
MD5 a357139658e86c28d99ba154018a7fa3
SHA1 bf87eb20c72e514cfc06d6edf9df2d8d3b66096f
SHA512 d2612642ed70d707bdf89f1806a927cf30cad584ddb0185d85a2f75ff71e92821dbf86039158ad6e8f0b98a24ee9d0496fc7e2657143e6c00f155d86698f5043
SSDEEP 12288:Mcm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:Mcm1PEJL+RwxhHxXWN/eL7
TLSH
T1E1452356736DA264F78A02395592627CC9ACEC811FF9A6931E734A0F1B7DEC38D38046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 b748d37e8e70bc8cc67fced4a87ba039d9eb8755fa2ccb397264db10ad9a41e1
MD5 ea4bf327a3379d2778a364b6a6756154
SHA1 9f9fb1b9893e74a13f69ae93e7f2ee12f826ee3d
SHA512 1a185c51bb201ca08e1a7f46a2909d6e59618ea3279e0319aed66eab64ac348f00ce23c564758e759eeb0f57c992eab0270b9539548b363d34713e9e06631184
SSDEEP 12288:YObfA4LWO+vAYFTGm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAi:1bLBUTGm1PEJL+RwxhHxXWN/eL7
TLSH
T101750255F7A800F8F96B813CC9A29616D672B88D0764E7DF07684B1A1F237E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e2628a566fcc6a27e37c7456fcf4238b3965effacc9cfad9f06c9f0955da994b
MD5 d1da6db70d3911971f940217a9be1c71
SHA1 19a122b719ab4fa073f18a08a612ff1a219ae2da
SHA512 6dd9207a5941242ff90c9f3380711d598474040483310e787d222ed52789b2a420fb1d19c87fe44ca5b2cf5f05686cdf0e19321cf9f7d4bc3ca27db37df699cf
SSDEEP 12288:+70Vm9IYNvUyBptm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAAH:vpYNHLm1PEJL+RwxhHxXWN/eL7
TLSH
T15265F12F62AD19E4E67B913D8AC38219E272B896175192CF05B0837E0F17ED9BC3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5f9190bf5d4d36ad642f921cc088864ba0565b2c7a134dc0c29b2575dc661eb0
MD5 d2d9612de0c7d743ff3b47f8652ac4cf
SHA1 9e19b01c1a7c55fed1d15c00cce8b1f09e487559
SHA512 6624630efc89512d67652fb86931dae50606f95015028f79baebc4e0da2228cd44add7b6226bc3136b855f097207b2bfe1b1e8903aaada6421f2123eb92e185b
SSDEEP 24576:tnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKq:tnXoJJYH84VVS6AmEOJas+cHBjSSKHPH
TLSH
T14165BFAEA2BC04E8D5BBC17DC5C25506F5B178621331C6CF026182BE7F27AE55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d48356f318c7e7e306267201c0b3c5b83f4d1f39d659d039bbe1bbd22e1ce21f
MD5 69a9806eb642d5143e74a03654bfc3f8
SHA1 19fe777412cd4b0cbc4ee693e417cfacd1b38716
SHA512 69517f4c7d9d16836c7cff7a0d300be294374ede5684c652109efc67d1edb7921b19bd8b38a234d9d3a8d0466efc77a5ae927093f658c0e71a2b96193e83bddc
SSDEEP 24576:sv7Xbxd9Tuycf8M/TYlSuxrr2PCVm1PEJL+RwxhHxXWN/eL7:sDLL9TuJ0M/TYj2PX1MV+RSJWp
TLSH
T13C858C5EA3EC42D8E0BBD6BD85A79146FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 779cb2023acfec88d458af376593b18657e01cd9d95aa8da2edbfbdb10ff9634
MD5 b1d7856d47b4403ec6808713d53727b4
SHA1 f30b83875a0927a0eef569a7b7b758cb9a1cc3f9
SHA512 3b2f9a7ebad7716011ce374bf310c792605c49ff3b0c37c57e3cad32ca79f1211a58ee44894f5383349b9bb38afe20d8ebc0d0cb2b36be842eb25112a203d4bc
SSDEEP 24576:gegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wGm1PEJL+RwxhHxXWN/eL7:gngOJOmPOHzJ1MV+RSJWp
TLSH
T1EE55BF3FB7BC15D4E07EC13D8A928916F6B1782613259ACF0560827E5F1BEE46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 6f9ad4168b4ff7ac586ddbeee9ab66cd6bc8ddb2df26eac96150423e39c74f53
MD5 9940801ca3d06e9e9b0390a6b0d5f388
SHA1 fc7b7f50d22ca4819163b9eb66b6de4324ccc5cb
SHA512 1b678067f0867436eba7abe7fc02cd508ea9bbd273a32ab400aa8ee72e14c50da842d2002234c77bbe6e2355de2b849a9cd0bcdb3304f9b6fae44ee812ae7d39
SSDEEP 24576:TLJnJiTk3R3waE4JrO8m1PEJL+RwxhHxXWN/eL7:TLJnJK8R304lu1MV+RSJWp
TLSH
T16075D03DD2A810E8E4B7C2B4825A2756FF71346C2B2569CB19B4D5353F12FD0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d2f4860b5930fbdf0a74721f157868c53ce0f835066501d6cff841130b7f4cb7
MD5 1a984c94027f869513c0649ba5db6745
SHA1 c05a7888ea614ad00d40b4bad0ad1e689db92f66
SHA512 8782ef8ae2b2e7e0af7d1cfbcf8e7c6d633c00894250286baa64bed11c2081cba2af08138724fd99eadf8bc2d32577a4c82ae60e8a0298cc5f52de627fb1304c
SSDEEP 49152:t9mqCzDScAZmlvTcFg8Ph6T1MV+RSJWp:himV2SJW
TLSH
T1B1954C15F7EB5298F8B3CAF1C96294159A327C409B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 7f032ddd0d5b7a308e6654c3048ef109810125d20008f6c90c274918a576d688
MD5 5b43cc765925cf8c7bbfb9eb66062554
SHA1 0230c801a463f7e21f4d91c62e0a237f41c8b73c
SHA512 a9ef30aae69db2432e2001af2797f8004e696e35533c02e72586a005b58dab23e8365340303ae71a5a8aac62b9be57e7fc7fb61f922b4e5a4bb592235b9e037e
SSDEEP 24576:PlYJeXm5jUuEBm1PEJL+RwxhHxXWN/eL7:PlYJeXmRUuEQ1MV+RSJWp
TLSH
T1E755125E36AC71F4F25E413995A24618C3B1F4A1179567EF06F0C63E4F2BED26E38A80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 95d1ae8c8821270df8a414e468bc2670e3ec3402a2f9bcf845c9f7550b748f8f
MD5 92815e09607022eb60aa1d300218ff02
SHA1 76e65273aa417be8946f906f724b1e13c5541bc9
SHA512 14f5fb516f8788670b7585ca0365a71905fa7c299efc370c1fde8cb97e7316e57c3b2ba908e26c57a35cc299061cc445a748746b1c41bab58cdbb63d84ae80c2
SSDEEP 12288:kmu6kyfm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:k7tyfm1PEJL+RwxhHxXWN/eL7
TLSH
T1AC55120573A8A1A4F6AA0638D9A35168CE78FC505F6493DF15B1DB2F1F36BC1AC34B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 4ef27399d945ca97959403204a459f61531a5309420b315148aea26c5742d36c
MD5 705f433da38b95bb33d17fcfd0197180
SHA1 f3b1dbed84f5dfce68d7eb2845eab3aa7be118d1
SHA512 cc72f949d3258bdef87954a3e032f05e9b84415df8264e129581fa544d0cbfdef640869751aee205ce38355ae4b05005758dc8e41168cf07a2276476e70d7af6
SSDEEP 12288:ePGm1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAALuat:qGm1PEJL+RwxhHxXWN/eL7
TLSH
T17845235A737DB274FB4A01395562226CC4BCF8801BA865B71EB2CA2F4F7E9C39D34845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 652c7fef549a4e8d39ea9fce6fa0a7b9aebabffcb923b4415f223d8bbd7b754f
MD5 3a409e3be3cbb1c6c022f0761993c049
SHA1 7b9c115b51c19baeccd1b66bb2838f9ab4d8d27e
SHA512 c61ab5348090be58089b20b3363fab87ef16adaa307c0c4159628ded9ac3f789cd0ddba36980cf409a3f1122f11de9ca2c8f98760954d55b6c1b45d6328bb930
SSDEEP 24576:zC+TyQIu93VAumZr7jm5m1PEJL+RwxhHxXWN/eL7:z/TfIq+YI1MV+RSJWp
TLSH
T110558D1DA7F919CAE276C675C8A34493EA33B872137186CF2044C07D499EEE9AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 caa3eb62a1c270696d56c9c30bf5a76fc395b653a010f5aef2eeaae1e501c146
MD5 2ba323419765c738ba2a058fabd9e2db
SHA1 230ad48ddec8c3db3e141e297b59520cabe45408
SHA512 c8080f3f8d42680c24271b1f987a7ccc9a56a09d2bf47e02e91efee3a0fa4927cc6b996188a8e10f61f96fc3df4c2614444fd125be325431fff53baf993cf2d4
SSDEEP 12288:VcyrWOstaa3kcsim1SP5iufVQp7krxHXkbAxOC+LTGQwxht9I3IXW39/+JmeRAAC:gLQikZim1PEJL+RwxhHxXWN/eL7i
TLSH
T11865F10FB3BE10A4E1AB813C88814155FAB3B461576267DF06A1C77E0F6B5E6BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d41fadc9ee7a05c7999bf23eae8b0f3aa1c8a8e6bdc2e00061f81c198e5de6eb
MD5 e07ac3714d0ca7962a3ea5addb5b5790
SHA1 b8fe9284daf140a772f41ddf30eae34cbb276278
SHA512 10fa11262bda23f42fee5b0551bd701c57a827b61d750eda44a4610a6d2e28cffaab435bc94ef2dcec33908b9a6b1b40cbd41afb4fb6c605cfd7e7dca2c8dd82
SSDEEP 49152:dpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP+1MV+RSJWp:epC7b4+80GTkLmV2SJW
TLSH
T181A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/676-276-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/676-272-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/676-282-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/676-543-0x00000000006C0000-0x000000000076E000-memory.dmp

Download

memory/676-403-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/772-555-0x00000271E0F00000-0x00000271E0F10000-memory.dmp

Download

memory/772-554-0x00000271E0F00000-0x00000271E0F10000-memory.dmp

Download

memory/1320-334-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1320-342-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1320-531-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1320-340-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1644-540-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1644-416-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1644-419-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1644-410-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1672-357-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1672-537-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1672-365-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1672-363-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1688-377-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1688-541-0x0000000000BE0000-0x0000000000C8E000-memory.dmp

Download

memory/1688-249-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1688-257-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1688-255-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1720-275-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1720-260-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1720-273-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1720-269-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1720-266-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1964-542-0x000001DB2DA60000-0x000001DB2DB0E000-memory.dmp

Download

memory/2112-389-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2112-387-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2112-393-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2112-390-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2112-381-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2152-378-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2152-374-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2152-368-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2152-538-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2396-553-0x0000000000650000-0x00000000006FE000-memory.dmp

Download

memory/2396-401-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2396-404-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2396-395-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2396-539-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2520-441-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2520-435-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2520-464-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2520-547-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2548-66-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2548-72-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2548-230-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2548-75-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2876-196-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2876-233-0x0000000000C50000-0x0000000000CFE000-memory.dmp

Download

memory/2876-25-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2876-23-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2876-228-0x0000000000C50000-0x0000000000CFE000-memory.dmp

Download

memory/2876-16-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3432-353-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3432-345-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3432-552-0x0000000000C50000-0x0000000000CFE000-memory.dmp

Download

memory/3432-351-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3432-536-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3688-432-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3688-546-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3688-423-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3688-429-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3704-53-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3704-74-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3704-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3704-63-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3704-59-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3988-0-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/3988-9-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/3988-1-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/3988-15-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/3988-13-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/4088-447-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4088-590-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4088-453-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4088-473-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4088-513-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4088-529-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4088-497-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4616-229-0x0000000000DE0000-0x0000000000E8E000-memory.dmp

Download

memory/4616-40-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4616-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4616-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4616-227-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4744-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4744-307-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/4744-301-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/4744-431-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4744-544-0x0000000000F30000-0x0000000000F7A000-memory.dmp

Download

memory/4800-287-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4800-293-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4800-418-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4800-297-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5032-311-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5032-545-0x0000000000C40000-0x0000000000CEE000-memory.dmp

Download

memory/5032-317-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5032-319-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5032-443-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5040-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5040-226-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5040-35-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5040-29-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5116-322-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5116-548-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/5116-551-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5116-550-0x0000000000CB0000-0x0000000000D5E000-memory.dmp

Download

memory/5116-329-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/5116-472-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5116-323-0x0000000000660000-0x00000000006C0000-memory.dmp

Download