13f5667a27e7f28c3f7ea1db16c7e7d8dc139b1068dbd5addea14c05a3f433a0

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Size 1.5MB
Sample260511-che7lsh15x
SHA256 13f5667a27e7f28c3f7ea1db16c7e7d8dc139b1068dbd5addea14c05a3f433a0
MD5 d7de67453cced34a85588cdb77aff673
SHA1 f2b53b9f3d6e86a9bf2ca29c93585bdad2e30b5c
SHA512 0fb84164fe609c8eeb9a7dc2b7b8c662824590795555f5911c0aebf678409648c425d9ca1fe56ccebc15e283e5046462b59a673f2edce5643f11416f3edeeae6
SSDEEP 24576:6iBE0LqwXeAVmYQsqjnhMgeiCl7G0nehbGZpbD:iG5Xe6XMDmg27RnWGj
TLSH
T14F75DF58A75841E0D1B2C27888539946E6727C018B71DBDF1298E73E6F77AE08D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
2104	alg.exe
4376	elevation_service.exe
5724	elevation_service.exe
5144	maintenanceservice.exe
4296	OSE.EXE
3840	DiagnosticsHub.StandardCollector.Service.exe
1168	fxssvc.exe
4364	msdtc.exe
1800	PerceptionSimulationService.exe
3040	perfhost.exe
5928	locator.exe
2812	SensorDataService.exe
1392	snmptrap.exe
1696	spectrum.exe
5400	ssh-agent.exe
3168	TieringEngineService.exe
3328	AgentService.exe
684	vds.exe
5160	vssvc.exe
3268	wbengine.exe
472	WmiApSrv.exe
4432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\82a3498db955e89e.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_165671\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c82b5b0eae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c49c2db0eae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f657bb1eae0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a8839b0eae0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030996bb0eae0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a93e7b0eae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000772275b0eae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047683db1eae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe\""	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5384	2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	2104	alg.exe
Token: SeDebugPrivilege	2104	alg.exe
Token: SeDebugPrivilege	2104	alg.exe
Token: SeTakeOwnershipPrivilege	4376	elevation_service.exe
Token: SeAuditPrivilege	1168	fxssvc.exe
Token: SeRestorePrivilege	3168	TieringEngineService.exe
Token: SeManageVolumePrivilege	3168	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3328	AgentService.exe
Token: SeBackupPrivilege	5160	vssvc.exe
Token: SeRestorePrivilege	5160	vssvc.exe
Token: SeAuditPrivilege	5160	vssvc.exe
Token: SeBackupPrivilege	3268	wbengine.exe
Token: SeRestorePrivilege	3268	wbengine.exe
Token: SeSecurityPrivilege	3268	wbengine.exe
Token: 33	4432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4432	SearchIndexer.exe
Token: SeDebugPrivilege	4376	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 1348	4432	SearchIndexer.exe	103
PID 4432 wrote to memory of 5776	4432	SearchIndexer.exe	104
PID 4432 wrote to memory of 2216	4432	SearchIndexer.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_d7de67453cced34a85588cdb77aff673_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5724

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5144

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2464

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4364

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3040

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2812

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2676

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:684

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5160

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:472

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1348
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2880 2892 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5776
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2864 2848 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d0b72666882d8253eca467769a9eccc3483aef221ac048739cce653e3ca48b59
MD5 83a6e46d36a6b6354cede2c39854cb32
SHA1 cbf7b8ce69b25f914c81b8409f872a320e9b0238
SHA512 292e395c64058d08cea601664780588bc6555a7053ce43163c702d251bdf10376c33dd0c80c77fe9264f0a109d1cb3847a84ae117244023b4081e32afbde242f
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxntDmg27RnWGj:v3q6sjBOD527BWG
TLSH
T1ABD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 03f3ca4b5b8dd4266af05166f6d0fbf431849697db29c5f0f526a3df19b7a23b
MD5 5e42cdb2c6f44023b178887d328e5409
SHA1 01c903f45862d9326b49bb6d5b4565839ce9df46
SHA512 c5121c7c70cd1b83068183f809901acd1cc7d39c09fb32ea366cb12352158c5678e00b657a5024bfae78b9db23ca29e1effe4660d26ae3896addf74eadf5eca3
SSDEEP 24576:HXYfDtczAusqjnhMgeiCl7G0nehbGZpbD:StcTDmg27RnWGj
TLSH
T184550129B3D408F9ED67817CC9A2C516EA337C514760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 e75e500bcb8d29748508c00116ea7a962b0ed1b8566a3091ff35fa1e441e8d6a
MD5 d45017d256ec23497134a01af01f8a17
SHA1 6454afbc69ae5ec6024c249e0949a631697ce1ab
SHA512 4a1d902154f7055de788e9cebd354c2107c0530c57b069da734c476e2295ad8945295e6fed707a4157700d11b1c2bd794f74476ffd4ce3456a795516661e8acf
SSDEEP 24576:L0Le5ji0hmxwrMRsqjnhMgeiCl7G0nehbGZpbD:LPji0A+0Dmg27RnWGj
TLSH
T159759E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0d856ec3b70a060496a0dd5fb7eef853e3572da06c7711d83c9f388fbe454ad6
MD5 82874628a16f0ac22d66047a080f3333
SHA1 a5d4c752e28ddcbdc318cbd430e6a4f5878acca9
SHA512 28ad3b8ce6565cd2c8cac7a8cd649b87058d1130c08f6e7830cb29d7243f707136ab2d7b8186424a1128948f54d9aabd435622ffb1824977df8b5eb9106ae62d
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWn6q8wyu/sqjnhMgeiCl7G0nehbGZpbD:k/ezSC6vUzPveHjyYDmg27RnWGj
TLSH
T1DA755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e4f47ee47722933bd3a86b61700933f9d02380fb3432aa2100dcded9f4e64e76
MD5 87cc8775d892ec8fc514d872c9a1b84a
SHA1 0c2d68a6f5b109e148355a1b99ffa14e21645897
SHA512 734ab68e1714d62fc797208c319c8529504eb87ea7e6944052ab4685f4d41de262873054faf8cec1415bd54dbac1e8eb5d7efe0db81d252e926f1b37bc0deaea
SSDEEP 24576:TVbqPb88hv/l+YKsqjnhMgeiCl7G0nehbGZpbD:TVO88hXl+LDmg27RnWGj
TLSH
T117559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 dd8781db7052995b3a37ce8a10d135f5b862e3391a5826a5350d499b8db52469
MD5 858872034caeb79a2524a396162d0d2a
SHA1 231bc4bd5ce9ba0e98cc583bb10f1577fbc8d272
SHA512 ec3307dc80efd41df697cb3b743d799417dbe31066855e4e3d554da9a585aaaa70f03a870e71dc78b80ef885d51dd05e2f6fe559bfb3e917fedcfb9c82487c3a
SSDEEP 12288:vDdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vDdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F3523BF864C50DAEB7609B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.3MB
SHA256 fc18eb44d7296779bc743d33636eef2a32c819cffa5975e1bcda6083d0f64558
MD5 49d024487ef377941035e23bc9765f90
SHA1 ca66e4e2736d42cf0aa251b2bba0b51733770a97
SHA512 57210a02031ff956528ad535d4bb8fc3c30d735f2da36a3b1f7ace21f9e70ebce229b9343c0d79a02e1029d578bfa49f103f59260e15e25d6641bf0dba7b13be
SSDEEP 12288:meBNUbTVO86USXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:mJIUSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E065CF7BEE28FCD2C27A4DB95791C600E76278314F21A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ca563a3331f19bf879dbe3a256d9e8cbebdd4d677cb97163bf644c62ee05896b
MD5 0367af019af66a789117bd9fcf23941d
SHA1 8cc2657115cf8ca3b1c87a4d18bfd2b8a9efa4cc
SHA512 795e0a07e882d0e25e3c54eed1739b0460461696e0da1b4004029a8dece92f85e60041cfc312a64f62853309a638b6fe100c76b7ab8bea9effb36fbd20e3a583
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THF:3QvGAdlCEL8c/DRNw5CzD527BWG
TLSH
T1CA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 fd201b7532f6d7e6355ed6924aac7a8ff00af9ce39cdf027a07147c96b18d1f5
MD5 513da3ad2358febd2bb4e053e7c5d879
SHA1 53946d613b0d46c50694b27b60442980d237224d
SHA512 51ba141af92756c91ffb4388a9182acd92cb3597e94fec0194ad8080dd9073136859ad043697a663044f2177bcfb638e80b49188a695e419dde313f841f1a0bd
SSDEEP 12288:zAwSfxL/2Dc3eDLLmt0LDQewsAjYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:sfewsAjYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16565E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 313c34ce081719c5dd336ac3ea186d57b37b6f81a4902070ce19bd8c4e3fe930
MD5 5430aa4e1a6858ab0cc71b4e4215ddb8
SHA1 0c271fe2dd3976e8066b79f401002e2bce369c36
SHA512 ba8b2c79e52a7d155064b15aa239b06fcef4b13ea285cd88116bf6eb298afb3b911e055be59059e10f98ed44e5ae8adbcfaf17954c3378e1175543e13f22ef75
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHsVQBWG:eUEtQevvqc2W1cpV2tI32zB
TLSH
T1CA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c2fcc1ec3d7367acbb8d99edad70e36e51585f7893aeb6eb1c1d7ee223a08d11
MD5 7233fd17893f03e39cbd4a109d20f8ae
SHA1 68a25f2de1b4356de8be7d1964e006061836eba4
SHA512 104fbd1bf5ec7f828093f357c3f3fd80ab9e53f7df6e21b298f5238752f1005310301435434a7748ac4827a1e716b486cfb9cbafeaf9b0935333a59af162a5aa
SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/zkDmg27RnWGj:2oquVjnmnD527BWG
TLSH
T1ECD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cfe1bfae8dd07f3d36c08a660097d0098d48fc935af28afa2ace37332e8acd48
MD5 7e73ecb1a8dfd73ef5e1fffa0cbd152f
SHA1 c4306ab249eaea31ba59eb03adea6cff6028a8bb
SHA512 1cf3a4a2b0e5d7511ce0377bc6ca4feb69140326a62d006a0c84d7299dbfc540c380a1c7bd0c722beb1f3983cf360aad8cb083e5bd684953891e3e2eb396b27c
SSDEEP 24576:oAhGL3IFoiwtA5l7S53DsqjnhMgeiCl7G0nehbGZpbD:oAMUFoiq53Dmg27RnWGj
TLSH
T136359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 00b0c3c86a1a5e8cbc58cd2a1ea56dee43eeb04bd58901c83a24ef8b91c60fe2
MD5 c7bab50289802df2bfcfe8351e551d2f
SHA1 22cba487d1776d35deee05daa64b4eb0d5d08987
SHA512 f578472ff019e3cc9fbf6cde4368a3ac48462f05b811ad026ebeee41ac43c206145fd616f8dadab85b83009f675bcaa365c74eec32f326c0142e9bc333db1b91
SSDEEP 12288:2mw5HEjsChNdBFgl0WDm+CfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:vwugOWMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18955F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 6ffaa8db94f43998a95940dd77f76dc176845cbbf488ca97a31e4ddfb5a49998
MD5 62c5c2e2508315bd900dfad24c683765
SHA1 f1d3d003bdfe4ea13e8a86e74a39ba2f5d668d53
SHA512 eb5e09ca5ed4375437985484d46fc0b7894a30e9d669e8434b3997bd1084465816397929cc1a1fd35800d20c9e0d03d538f61c82a5efc2a19f4c7cda8172ee92
SSDEEP 12288:4GZ1IyoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BZu5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fe06f4ea9115df128e5b7606ccda867ee3a15c9862dd445321fcb0a636f66bc2
MD5 46ec33d56d15c7d11aa0d7bdc2552b4a
SHA1 8fdcfc8c7a8b793faba02c9a3f380e313f0e812e
SHA512 d26e05ef92298114377790f148a716c28cca1a8c487148837f2050e765f5d127f97f694df13d0d94f6d50c1184a7d69e49f3facd67590a3f8ce28eae97d72e56
SSDEEP 98304:zQRQyi36YOcPbLvw2gAf+PN3aD527BWG:iQyiKa/X+PNKVQBWG
TLSH
T1A8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f8ed73f4f30d7013578ed2287755c9de0be06fe5249dfe5a11bc67331771af04
MD5 9242d8f6ed149f4c1f6056d5f43e6ada
SHA1 7ad1d372c7c4548ca9cc3fcc06c515a71d07bdcd
SHA512 273970218b9c60ca164030b1e22bb06ae822ade84a1f28b4982001987edb1a62d31f23230a3f9690613c0b0196dbd7cbfcb2d2919545b33671ee5ef2f0ca6461
SSDEEP 98304:FQRQyi36YOcPbLvw2gAf+PN3aD527BWG:8QyiKa/X+PNKVQBWG
TLSH
T1B5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 29b02cbdffd8b5dcc56772f8b8255d68e5ab0b92dae738c2086c4466610649c5
MD5 232d90c8727c2bfda9fa819fccfa1f51
SHA1 d8ab6e1a01a6c34b758349be40874f567f12dff6
SHA512 e5360825d02ef9439e86f38f3361e6f0b81282204c3075a9a67cabe89b75cfa912ec51e251f91c9bc21468ee0a8bb2d09d6aa753af7bd02fa85d776dd2c9287f
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0psqjnhMgeiCl7Ge:/68Qg55nhceWu7PNU3/0Dmg27RnWGj
TLSH
T11DB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fd503b2b54886f097fda9f4d546b928f48eebf343b4a3767558629b47f3c398b
MD5 65f58a1f1fdededf72f1deba61297969
SHA1 4796b55f75ea4b9f9053f41afe15a9f7161a8db3
SHA512 8b9af056cd3eeef73c700512510834d378bf0fa45394feaf31271e5a005dcbc89b69204ac5c2fe2e755cb4d10f704d6e3993f84914cfbf3441745c045679256b
SSDEEP 98304:Qy5112gYy5azzVvt69nLKnhZBD527BWG:pLIHEWhPVQBWG
TLSH
T12A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ff057d55b24e71c8e16e9c438ff9d0ed542e58eafc0f6863447c0eddd3b15de4
MD5 31d5a5525045dd883bc5cfec6297235f
SHA1 9e16269aef81ed5ea2a7f6a8e56f9e314ddf8bb8
SHA512 7ae349cc514edb87a438324a160b628b0459a932a95ef98efb38e0158d80b558c39ab21132c5b7a90c0b5ac0d83a2266d6edcca6c8e74a9f542b8bd6d1662cef
SSDEEP 49152:cB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glyDmg27RnWGj:2u6Jmdxd2dyD527BWG
TLSH
T1A7D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 979e2c5027c07a1ae2c19fe06189432b01ec01c5fe3b51f494ecfa39365b8807
MD5 fa421137047f8f9fde6fa987f768093c
SHA1 cdcd293613fdeb7c728f608b91c253902ef5ea87
SHA512 e13c04a8c1f0f081ba9505a4e52d01f3ed97192514b8d3fe31babcf024010f02554ffd5bfbe2275fe55e54fde1839bd2254bfd67ebc52ff6891eca3ba13c2db0
SSDEEP 49152:/1hpsNoJpF1A63U44CwH7R4x2Dmg27RnWGj:/mifPWRnD527BWG
TLSH
T174B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 954a24b45e893b008bb5278f39dbb3b6fc4fb3f019e79b3bee749c2a5dbf6fb4
MD5 ad2e4d675cb87df0143a17089d313f41
SHA1 137006015c48905daa0b48081fbafa2e3854fd73
SHA512 844ef0fdddf1c74c2e4c8c0949ee585293ae3f789e40025e43b056e477cda07502a6bd0444131d1a12cd2a1521cfb5e226730db0676faed15fc6966b2d6e3e46
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHq9Dmg27RnWGj:Z5dKii619D527BWG
TLSH
T15BC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 23adad39d91eaab1f7d6f6f2113e555a265e3b5726bd900e4dadf9b3535c5bfe
MD5 8af7793b7acc55a24daa1ddfe64538a2
SHA1 bed5eeebdb1098f9f8109e86ea1f652302ac241f
SHA512 18e6a91d8ed0e7400cdfcf24ac73b15fac95745d4bf4d95a5bc567fd55322988f4f5f93544d6bdd10d58aaf60988f49ae497df41fdb6a6c118225fb352c841f2
SSDEEP 49152:ehtSn8EApI0fig3giDn0AP5wCDmg27RnWGj:/X2imphbD527BWG
TLSH
T13895BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 97155e2944871fcbb6444eda18f6e88e739de89e83a39b28a97ab46d7fff68d7
MD5 e51cd9ca9a3e6228b8e1ac87026e3069
SHA1 486b5216117cf24828d9e757da2ee1771eddceef
SHA512 b6bc1127f0bb0b765bc8826b07ca24e4f8b76737254afa715f716731322e21ea655946f6cb9d1d33c5c3b5acf6f164283224c2a3a1564fe1c27e37035aa3de60
SSDEEP 12288:glXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:glsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E43523BF965C41CAE62249B5C3E5F10DAC073E57E92004937A977CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 c723e3de6148e90f7313c784e82377743117d9833e6756526352cd3bc2941f20
MD5 bf70e527bb4bb07931a2755b0b3ab6f2
SHA1 a804d5f18f42b6429a90ff48464e213ff316631b
SHA512 7776e5284f949b0050710f2fe2aa05afc97b38acf6d827bb6f3cb2150fb65eeb9942be7204bb6b165b09baa74733389eee94cc9f1f7bc913036feef6adfb643f
SSDEEP 12288:oEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B3523BFA65C41CAE62648B5C3E5F10DAC073E57E92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 c0e546294ba258bdc0e309537ba834539056498ea66a7894c12f0c34459b9734
MD5 d432bc5bc48d9a0d8e916425fac70fc0
SHA1 0177a9120282eb019d97ea38cb84a4300431bb49
SHA512 4540ba17861838f8c8b45bdf30ff0073e17c171d317bd6bac67cf25f263065d391f406b7294a48e23d4b2a7bb1945eee4e00a93262aec4b1b5ebf56ba31d0eb6
SSDEEP 12288:r6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB3523BE965C41CAE52608B5C3E6F14DAC073E57E9200493BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 0d473bba3ed0d4dfa11555ab65a9013ca1f2663b50c7f371b2cfba41a4b9dd5a
MD5 92273ae53dc069b96e4ac2d45b4fb3eb
SHA1 23f556078c723e0e89854abb4c29223491158e2d
SHA512 f45f6e6ed95bb2658329b66fb7c5ad83accbe4b51d9bf07b97cd22f6584afdc9a40475c6fe983baf631b135c097b7bad97f07fba8bf75c4ad6bde607909fb508
SSDEEP 12288:tVjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10645236B675C00C6D83285B4C2F6E11DE8237D96EB3005DB6B532CBD6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 60b7163367e1bf4d4efd3c1f47839807bc9aed9fd468afd185364f42f2a3338d
MD5 1740a2a2772c67ac4da9e8b02783d35f
SHA1 33ff0ded3d867b585fea3fdb77440e2323373712
SHA512 58abcc5ecd7fd5b6c36ecc8887f446892d4f9ee1fb784f1f3146863b1ef31048e4d89fddac4429688ef83a382af45e8a3a64549f1aa3f2a32e65b8f9a3bc3c24
SSDEEP 12288:S7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F33523BF965C41CBE52608B5C3E6F14DAC073E5BE92004937A9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 9c20706feef435f11adb3df1e96e434b76620c31a1f67ff241b417b43dbc93f8
MD5 c8c6a3eee23bf4a5e3ddbb758b1729a5
SHA1 3cbc955003336b3c1d971c0133ead1e8234160bc
SHA512 517bd9f3996833e7e1bc11d2ade4b56c5cd0082154871e64e89a79671bbb0e716b675a7ccfce30d2f1ffc06dfe9030c8c5f36124a04932dfaeab58eecd9c1361
SSDEEP 12288:CAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1943523BE965C41CBE52648B5C3E5F10DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 f0a835d5b28e4410fa588c64ba40426d95393660a52e9bd8b70da79bcc98e275
MD5 4a9bb9d2a5873f711663b688e0d0a51f
SHA1 33cccfea5d187dc29b3be3271c4345178ce3439b
SHA512 4be5fa089c5dfdd5cbffa4e512c074b2cd6c57017da1e9c243424b6aab4bbcaa348fed17c7fd06645ff81d30dac32e61db45629bacb4012195698a25c9260550
SSDEEP 12288:p8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:p8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1333523BE965C41CBE62604B5C3E5F11DAC073E6BE9200493BA57BCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.3MB
SHA256 f27097491842c63fac0173082677e8e9862949e6dd8f9ddf851b189634a7b98c
MD5 6696cb1165d4699f1eb37cb0c7cb9ab1
SHA1 fa3af7b6d12091c6cb8d81dc69b269bbcc9fa101
SHA512 84b2dcf6e718636acac085264e77eebee3f321f6c2161c3f6d6ddbdd0b1127f75d4c4c68b26913154ec7b799568d7b61a232d451de8a9386d874d70e1884a7ba
SSDEEP 24576:1ZM+zFVSOksqjnhMgeiCl7G0nehbGZpbD:1ZM+zfMDmg27RnWGj
TLSH
T1066501A9B39018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 4eb4c43f0c7a2d36231660e92dfa613899acbd3e2cef819abbf0342772337bc9
MD5 448a9ad9e0b6055e00513ae634becdae
SHA1 418a72bff17717a8efcfdf724b03996f10298830
SHA512 522bf425aebcdb4c6cc0b4288d18b406460c1cfd7a21e4c8d51010656af29e51e75cf5aac0b093dbb44cf290ae78811036fb49730482b5fc9365d4de8cdf19d2
SSDEEP 12288:UJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC3523BF965C41CAE62608B5C3E5F14DAC073E5BE9200493BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 823f3eec247f91b114d5ab8e4e23fbf50fad3e919d436bb25e483d558a20fca8
MD5 7dbb106ecd9aaaa7394ca79ab4a4ccf0
SHA1 32d8662765cc44a460f3e645720057563231e463
SHA512 682117af47fa1c97860c98033db8efa7fe4e397d63a6078fdf7a25388becb5093724ea0839b1f5fb73c94070ea740812012314153ec54d6cb90a42e6e6aed05c
SSDEEP 12288:EtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE3523BFA65C41CAE62608B5C3E5F10DAC073E5BE92004937A5B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 eec5639891f436c87c5b550086ae7f2780db1e9b14726a4721cbf170faa806a3
MD5 e51497c0a479bc2bb96ddc806f09e860
SHA1 270bb42b6964e2f509e15ac5c480ff7a00c79cbf
SHA512 fdc2e12729a5b412cfd6bf9425706b2a99fd2d5fb8844e31bbef997eb07364401fc4e8b6fdedb365ecb75fdcca05102a72bb432d8d5d699984438277efe7e637
SSDEEP 12288:QyPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hzyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F055125B73A530F9D1368178C5A29A06F7337C3647204AAF17A116BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 5ce85f26f23b0c98ad890ea3dfef287a3723ae714c4ea01b5a081cd64f68c0c7
MD5 890ca83c2fad540f1648dc1c4f55d5c0
SHA1 b63db4e356a69e89ba3dc2b677f491221913548b
SHA512 cfba23198d0e5618e96f14181d2ccd51d87fa2beec38fd463bd62ad685f3be0da5b20afd99e008377f5a0c2c2ec17349ce3ba6151b4799ff0b865646946fcee1
SSDEEP 12288:IJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1333523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 bb5ec51f3ad06c01b0f39b60a99bab611684993604426fd5a0529a7913c4dbc0
MD5 53a9ad22147a777d40294aaf558cfbd0
SHA1 c7f4ab844cffb5586ff950679bdbeb1fdf145a28
SHA512 a22834a0ba185b9030b632dc41800179dbf38134012c72271fe80893382fa71032a4ab58d0db649551d41561076c7ee5214e658e16127df1a204ce5b36fa97e7
SSDEEP 12288:UJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D83523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 e20c1451d447ff6d950fb1f6cdbe34d98295f9f3ed40454db29ca2307bfd56d0
MD5 74be655243c22d13bbe2ddec4a6237e5
SHA1 ec1e20c864c3e4d4fa03bc1e97addd4c33060ca8
SHA512 023710ab8b07d687a63f5734c325977b23c0d3b2ec85c251ba4e4a46c668085fdb0f1329433b660005588769f93480ef03f73c53805327537b7cfc90797e82a1
SSDEEP 12288:KyPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XzyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F955125B73A530F9D1368178C5A29A06F7337C3247204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.3MB
SHA256 9b1a3638f3112f75dadb391f3e44d6abd4de31819dc4e35a1094e2e0da671b80
MD5 314efcdef804658ca999cc7682982d66
SHA1 c0e485e30296e600f28e75f6b74779a3e128b924
SHA512 b4f3fccecf7499bab55dad5081e6eb64edbb1f58bc16d0975c1872206f9fbd301ac5c05dfa3c3331c1ca19961dd3e5dfe8045fdd8851576e1289b9b7b7bc32aa
SSDEEP 24576:TTYaLl3z0zDqsqjnhMgeiCl7G0nehbGZpbD:TTvLljjDmg27RnWGj
TLSH
T19C6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 f3c81a25421b9f2a739d21d88535a05c7de7ad22a08a6448654605cbe934628f
MD5 f07d952cc3ea515a4ee69a10043ead73
SHA1 66c696c1c2314ef6663cff2b2264b21a8c8adb22
SHA512 9271ef74ede1f5dd1083d602400024e789bedf96a195de346db92f29e0ae71d198c02a6bf1b642452686e6d192ed12c8e2048cb2252062f7fca156a6fbfb8847
SSDEEP 24576:83nd9CHKy7GZ2sqjnhMgeiCl7G0nehbGZpbD:mnd9CHKyaMDmg27RnWGj
TLSH
T12875CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 dcb3313c6757399ce7b2cdfb05b3ab6d6e3e196b0761a12456e75e9e909f12f0
MD5 6a4a0da9d6db0bab4f7534858f21bd7f
SHA1 5cc1163144de28a5a468b14e057164483206c864
SHA512 dbcf68bf8bfb3bf1741f5a5e2df6528da38767306a086764be0d3fa5ca7de6ef3a6432b7f86aa694b2e286b95251787ece18f7533eb1ec29cf0d4bba58a0b604
SSDEEP 12288:CaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A93523BE965C41CAE52608B5C3E6F14DAC073E57E92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 6e926b6a93909d140279dd0eac599ae5be0df2e9271275665d168beec8d4b0f6
MD5 902fee6fb6f0d3d12a59465a57537239
SHA1 56297b20fc463480e177b7b7266aee41c8be95a5
SHA512 83bbcb0c730a243d2aa382f1cd9dc02052113ccc935cc37d287373be9874528b0043b6fcf9f09a3c24780e5fe2d91454b801cfad7b698af19e55471eddc6c89f
SSDEEP 12288:OIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD3523BE965C41DBE52604F5C3EAE10DAC073E57E92004937B977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 673a551aded978bbc20322b97de9dc4482032dbb846c2d0f3c9b80fd7a46518e
MD5 a1de39f60819d0882e6178cf6157697c
SHA1 b0978b8cdddb87bc62ab185202abd62f95cc0b09
SHA512 f5b845c8f68e8724bc93c97cab5f4bbbab1f935fbc46811f3bddb9e3fcd2c1b31e12a6923280b211955b55e97d7c9e87d3aabb04470567733fbe9c229730dc90
SSDEEP 12288:TXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1133523BF965C41CAE52608B5C3E5E15DAC073E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 b0a82b3336d4e43d9a699503181de3a567e03a99e1e4a4a3a64d8dcc6090cfa2
MD5 f926542afca549589a4128bd7b6993f5
SHA1 56b928ebe19c45d7a2d591fa90b3bc33e9e129b6
SHA512 d7735b6bfb49dc74b9299458aa7dfea060242977ddd42779cfdd756338d8af7faf71954e50a23f0f3416eb1ad5c1696c1715038c10b8536d8eb3ff4f88492f3b
SSDEEP 12288:wJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1183523BF965C41CAE62608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 8dde64be34eb51b149acaa74f0b7dc48a43a28cc99f4e42be23c2fb90bcaca5b
MD5 42bc20eaa6784360198d500ed1350083
SHA1 435c4bfbf70491e7d1b7cb8b224542943919fd29
SHA512 caf21da267c48ca4d84e79106bdc7acb424caef544d3f38765dda35e39744d773d81c146fc69f760c00270cf0ec48c109749e451de132a8cc7b6f28f4537399a
SSDEEP 12288:zjsf5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19145011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 b54693bb9c301c80113db04f33f580417ed289f55bef968c9055d7fa12cb6959
MD5 c2529cb28f8b0b6fe85af8718483b543
SHA1 836b601a2d1b5a9e17988b8e8c55cd4b3c406fed
SHA512 f9b8dea71255c39365972c77f66c69909faf9e0a1f60fce01eb2fcce19ee135832d313b5844363b2312f98ffe2b4c49a126576cc887df2ec83c9fae1bb66d3bd
SSDEEP 12288:hbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10735237AD34C518AE57649B482EAF12D681B7E6A9F2004C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d265281e66b412e88c70f257e0344074a1659f4e57f0eb538759a2a810b2f2f1
MD5 d7523418e7b4dd621bd7664665f0e4e7
SHA1 b958cab2caec01e08a7b1ddb89f54384e57b573c
SHA512 a0b861664ca5f3102a32d8c16838227ea1f929b73ba9de7b3b5f26fea7e328e75ed986c832af5d6afe30f40e10bd94e5256a36372dd4b1c4dfb56bbd232ba3fb
SSDEEP 24576:88RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC9sqjnhMgeiCl7G0nehbGZpbD:1RZwQCyiHiQEaiPnMUDmg27RnWGj
TLSH
T14D85B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 ca7b4fb83f77fc0878c1548fb90771bd7bf3072ddfa0163258754acb1375844e
MD5 e7e24d5406321ce9d4cbde8ccac7323e
SHA1 595a332f964212b2caf98a670c808064b67ab3be
SHA512 0d99e0c38948d0a001379ae8b979a5d78d97f8a43e79fe67eebe95edb82d41f9cdcadbc5e59077cc077cfd221266d15f9df0b997864d45e280080f48d213ad58
SSDEEP 12288:ObxA1U7KrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ObxA1UGrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D45123E62AC20E5E176957D86D2C10AD6337C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f77dca9abe7dc7a5e2d9dae504f953dfcb43975a08409fc1b1d5f2753810b21e
MD5 9b49aaa0aa3382360c0411075eb47ee9
SHA1 43d5eccc1f4d8a909c3fa83ad3c6eee80b4ccf03
SHA512 7deafdb90854d9e998188b37f249418d1b62294b8897d4ed77918fd3dcc1240477ea0ec83fbe7a0b3fe95c9e451df0c85b852b3fcece6bbff8ef550418fb8dfb
SSDEEP 24576:HjsmP0yHaqrVqHra44KDzMsrnOsqjnhMgeiCl7G0nehbGZpbD:HjRP0yHfVqzlAsrniDmg27RnWGj
TLSH
T17445AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 d16769c7ccd97f401170d6059fc5eff4315190795bbdaedc87a156476f00812b
MD5 e94d4dc631074475b66c3cc62a43f1d1
SHA1 cb91b020d7f0864f78888d457c246f5ac02b1db0
SHA512 69a7c279ae19703392fdf36d4921274ea389d31e1f709b18e1150a8ebdf2b7b7e99e02cbb123e8ce108a1fc78a6385cd0f2715d897e3829ed7a3976f90d98b85
SSDEEP 12288:h1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A73523BE924C51CAE93649B5C3E5E11DA8073E269B2004D379A77CFEE7B54E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.4MB
SHA256 e33d7603819a48ee1a2b833ba40de34ea4f7d40a5d5a824446588d6e876a031b
MD5 1a426f999b3838f905fcfc329123b80f
SHA1 b4883669266a435ed2d88a2d24dcdf817fd24609
SHA512 ae5b48f0934a229f1202923a19c728d26ad89e5eb848f76426a5a06f8fe8d8f02f278d70be4584ba71ae1c63d37e65a25769aba7a31ab70300b8393f2692bf8f
SSDEEP 12288:RObHA4LWO+vAYFTHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:GjLBUTHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C3650159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 80b95becf7c59fdbc77697af24d8935eda6eca5a84691a56df2a6169d067f024
MD5 bed228bec6dfdb481e12c3e1a7177b3b
SHA1 0fdb316aded343f2ea345ab3ebdb98118f2e40a6
SHA512 cb80a5e849b0a8ee51016c1721293a8ef3c96d98bde4addeba8deeee61053181ce5626b7823bb7ac2a6ce197a6354c5af48319f911cac58a4474f1444969f583
SSDEEP 12288:s70VmWIYNvUyBp0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:5OYNHasqjnhMgeiCl7G0nehbGZpbD
TLSH
T17055E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9322f4750b8e4b683fe6b4744870115d50431ac242e799c6db732855ee021a33
MD5 04320fa5482d6123abaecdd7b2e736b8
SHA1 0ef6caffdb7bd15340e490995ccb94ab81c90b5a
SHA512 f97705ae0f282c081b364575a6b5fe0065fb91cac29d67898e16c3253050206f274447e64374b0a1d954ef6ef3416c15d01f76b83a2d80c794ebf1a76b556fcc
SSDEEP 24576:unXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKm:unXoJJYH84VVS6AmEOJas+cHBjSSKHP4
TLSH
T1D965BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4589d29a93b1ca0b5521847c37e97a1a8281c0ecd9eb9e05e6c6a610cb911339
MD5 15a5649c35251d01d66ff1616b3fe0ef
SHA1 d3e889b6ff4053135d578085fdf03aa8932c0b03
SHA512 2dd5ee5aa7db48e207255d8a3cbaef8388d26db1e7ee716b3faa45490adf1837073d418e4f2f6cadbac5c69734c89d8aab2224eb896bf85d3a45347eed8f5604
SSDEEP 24576:0v7Xbxd9Tuycf8M/TYlSuxrr2PCssqjnhMgeiCl7G0nehbGZpbD:0DLL9TuJ0M/TYj2PJDmg27RnWGj
TLSH
T167858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c9d3f0fc3a9f08812ea302e96121b3064c173ef0455636af30a2621e6e885b8e
MD5 3bd1331b3fca956f63a3bca84ad5ea8f
SHA1 fb5f68c78f2aac1c74337e644265d974396d4192
SHA512 ec9de87d69d4c029b970e3724d3032af1cf7efc7098d83e29936c5d64e4c588c9523f483326bc068b70573dbc51d4be1b2b8b60f1f593dd0f3ecf863c43e0b59
SSDEEP 24576:4egJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wHsqjnhMgeiCl7G0nehbGZpbD:4ngOJOmPOHzbDmg27RnWGj
TLSH
T17B55CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 7fb8aa703c11fe33c821f307c5fc5a981c1cd2e4ec0414bc460a362339f2e12c
MD5 fe943e051291355c0eeb3296c21023cf
SHA1 3e81e0b9b0e3dc84ac1591acbe7847e807e7938f
SHA512 08a50e7b6319ae0b7537d23f42f7b69ba635e942ad4eaa4119c4fdb736f9ac4e943fcac8e6cb81e7c76c5961d386b80e211fcdb31e9e4e9fe84cf6d72a11f5b2
SSDEEP 24576:oLJnJiTk3R3waE4JrOVsqjnhMgeiCl7G0nehbGZpbD:oLJnJK8R304lSDmg27RnWGj
TLSH
T13265E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2a5a984f8e641a5b2aa3ccbd1ff6d32aa863542f6ca756e3e04d973df97c655a
MD5 138cfa75557c9d92b806dd2d04889ff9
SHA1 a2ad8cff638c56145588224263cd028193a34e79
SHA512 c681e8bc5e922e08783e0e05ffd22e980d52604646d1881673dc10325560308a151fc7f06a0dbbd40bc699bf8447fc9162fede6d79e9086f3bd0e36bfeccc9f7
SSDEEP 49152:i9mqCzDScAZmlvTcFg8Ph6dDmg27RnWGj:kOD527BWG
TLSH
T17B955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 6937cf9ed6b5242286d968a09a2c95e741767a9f628931fbc9f8d9d216698d8c
MD5 ce3da95d1cc94b561f1e8d647111272d
SHA1 8740a17476a130cd2f97b0a0e914cce15d9182e2
SHA512 7b22cd39e7dc2eaa12aaae4d35fc8c0f5d6c809cd6b50373e2cc969058a9171c3285f2ab71dbd0c518d5ef56e972db6dd1fba7c23155b0beb8fda7629de90de4
SSDEEP 24576:MlYJeXm5jUuEBsqjnhMgeiCl7G0nehbGZpbD:MlYJeXmRUuEVDmg27RnWGj
TLSH
T1DA4512AE669C30E5E13A8079C2E2C508E633B876571017EF56E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 55d3f68a79f35a5d655c79d96e385e7a922b64e0f6ae97914a4107c483a4b8b1
MD5 9fd03ca15d10857fe88c9d6cbd01868d
SHA1 4bf01558b6756a1411a497d40b7242256cc7f743
SHA512 1f17555abdbb0c2f162855e5b0fbc6299c8e137a40b3b3b54fc7f3b001a608008e22c492e0b7ea7df533f360aca6d79077ef50537f669c749dc4042af275ac7a
SSDEEP 12288:NOu6kyuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NDtyusqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D552219639860D9EA760978C6B3C158DC367C219F2042DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 6ad8e8a881aec135f889ac82555d46f6f4739a0b006ad5d3f4303d70865ada44
MD5 02c6119bc9ffe959bf8dbbaacfcf3610
SHA1 b28e8c4c5de0b5898dba4555732fdea84f53c659
SHA512 8b6f216d4288c7f25c2a99f2d83d23554139f4235fd6dce5ea8efa3b914a6267414a110a216b3bccaead86789ec9727c8ac7ffc32691e33a1dcdc06ce8438a32
SSDEEP 12288:FmPHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FiHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B45237E525C60CAD93644B4C2A5E10DA8173E36AB2014E779E3FCFDEBB64D44B38812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ea2b4d6a744e500062d567000c7455a5e99a8b43455718319cf950f1abee794c
MD5 3024e4edb36f299b49a7a67b76674161
SHA1 6b09b3b4afb9afd8c15f7aeac2233648f4a2dce7
SHA512 14ef627ac8e810093cfbf745702c8b46506cc6f1589c7d23c3b4d0ce5edc82e58d5dd255c720904b132c6f95692c8a16c1f2e6f9e3a4238d99f29b60cf6e404a
SSDEEP 24576:1C+TyQIu93VAumZr7jmAsqjnhMgeiCl7G0nehbGZpbD:1/TfIq+Y8Dmg27RnWGj
TLSH
T12C558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 e35e615418410c4c6b02a7cfd626d0a4f908c316c31ef916d7f75681efccab8a
MD5 ebc377627e2b8323ef951dbcb76d6cfe
SHA1 b519c5131063002efd697594434184f2969e4cc0
SHA512 a8117292424681c6a7a627ac70eda8b1ecf1beae8c9cfb59984200571f0673181da145ecacea52fc6216c8542b6f081213abc183c4495a4a44c63784a12619b9
SSDEEP 12288:fcyrWOstaa3kcszXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:mLQikZzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F55F11FB3AE00A5E067817CC8858116FA737835571163DF06A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 779a8af387293fb35568b7ad3bf4d942082fee0882f17fdcc93bab9b3fc068da
MD5 fc4cbca0645bd0115fd57b7f1f772d5f
SHA1 7a849a47ec6e4c8f5067adb9a7ae5d7070e8dc34
SHA512 3ffdf77f9986c36f792d5531e215b9deef8d62b8416d5f64daa27886f8b7f6c6f79fd511c2a6f6ae2650c0fef92873bc1fa78c38d7fe7ea7022b6e5957bae65e
SSDEEP 49152:YpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPCDmg27RnWm:ppC7b4+80GTkVD527BWG
TLSH
T1D2A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-413-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/472-421-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/472-419-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/472-666-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/684-530-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/684-383-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/684-385-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/684-377-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1168-254-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/1168-247-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1168-270-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1168-260-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/1168-248-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/1392-508-0x0000000140000000-0x000000014011E000-memory.dmp

Download

memory/1392-320-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1392-322-0x0000000140000000-0x000000014011E000-memory.dmp

Download

memory/1392-314-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1696-333-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1696-331-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1696-511-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1696-325-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1800-280-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1800-388-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/1800-274-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1800-283-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/2104-226-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/2104-13-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2104-21-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2104-20-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2104-19-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/2812-311-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2812-301-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2812-425-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2812-665-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2812-307-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3040-400-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/3040-285-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/3168-513-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3168-349-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3168-355-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3168-358-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3268-401-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3268-662-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3268-408-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3268-409-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3328-362-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3328-368-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3328-370-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3328-373-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3328-371-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3840-236-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/3840-243-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3840-237-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3840-357-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/4296-68-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4296-74-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4296-229-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4296-76-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4364-376-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4364-268-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4364-262-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4364-259-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4376-227-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4376-36-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4376-30-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4376-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4432-426-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4432-434-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4432-432-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4432-474-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4432-506-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4432-490-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4432-667-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5144-63-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/5144-64-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5144-66-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/5144-59-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5144-53-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5160-661-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5160-391-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5160-396-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5160-389-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5384-9-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/5384-25-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/5384-1-0x00000000020D0000-0x0000000002130000-memory.dmp

Download

memory/5384-8-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/5384-27-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/5400-344-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5400-343-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/5400-337-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5400-512-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/5724-51-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5724-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5724-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5724-228-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5776-519-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-529-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-528-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-527-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-526-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-525-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-523-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-524-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-522-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-521-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-520-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-517-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-516-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-514-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-518-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5776-515-0x000001D3415D0000-0x000001D3415E0000-memory.dmp

Download

memory/5928-407-0x0000000140000000-0x000000014011C000-memory.dmp

Download

memory/5928-309-0x0000000140000000-0x000000014011C000-memory.dmp

Download

memory/5928-297-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/5928-291-0x0000000000590000-0x00000000005F0000-memory.dmp

Download