bc6b200f454826b04f7d197fa7d41ca2111b51857d65939c00a166de8d271d4c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_23e5ad019324765191780cbf810179ab_icedid_mespinoza_njrat_ryuk.exe
Size 3.2MB
Sample260511-mbr8psat3m
SHA256 bc6b200f454826b04f7d197fa7d41ca2111b51857d65939c00a166de8d271d4c
MD5 23e5ad019324765191780cbf810179ab
SHA1 7f2447adca426f2b87cd8ee962214a465d84cb10
SHA512 d76bb57e4cf515b98edb233a7e5a3970ca1a0f150e2be57dff093d10b71500c1f73ac7c6532e1460a4ea9fc40c975ddfedb7def1816dc4dbb5cd8337347f8a85
SSDEEP 24576:+e5NgcWva0+wXVoXoDyhRXJG+OAQWmOxm0qCNyBo4kx929bL3Hnx:b5ecq7V+dOAlmOA5BB+kn3Hnx
TLSH
T1C6F5C05AA76481F9D8678270C866C1B2E6F2BCCA56308B0F1650DF6B3F335624F2E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4956	alg.exe
3052	elevation_service.exe
784	elevation_service.exe
3088	maintenanceservice.exe
1704	OSE.EXE
1968	DiagnosticsHub.StandardCollector.Service.exe
3104	fxssvc.exe
2068	msdtc.exe
2744	PerceptionSimulationService.exe
1148	perfhost.exe
4920	locator.exe
3008	SensorDataService.exe
2560	snmptrap.exe
924	spectrum.exe
1608	ssh-agent.exe
3316	TieringEngineService.exe
3884	AgentService.exe
3152	vds.exe
5092	vssvc.exe
1596	wbengine.exe
1852	WmiApSrv.exe
3664	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cf663fa714bf40d2.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_23e5ad019324765191780cbf810179ab_icedid_mespinoza_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cce6aba02fe1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1a26aa12fe1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb9219a12fe1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1a26aa12fe1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007082fa12fe1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1540	2026-05-11_23e5ad019324765191780cbf810179ab_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4956	alg.exe
Token: SeDebugPrivilege	4956	alg.exe
Token: SeDebugPrivilege	4956	alg.exe
Token: SeTakeOwnershipPrivilege	3052	elevation_service.exe
Token: SeAuditPrivilege	3104	fxssvc.exe
Token: SeRestorePrivilege	3316	TieringEngineService.exe
Token: SeManageVolumePrivilege	3316	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3884	AgentService.exe
Token: SeBackupPrivilege	5092	vssvc.exe
Token: SeRestorePrivilege	5092	vssvc.exe
Token: SeAuditPrivilege	5092	vssvc.exe
Token: SeBackupPrivilege	1596	wbengine.exe
Token: SeRestorePrivilege	1596	wbengine.exe
Token: SeSecurityPrivilege	1596	wbengine.exe
Token: 33	3664	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3664	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3664	SearchIndexer.exe
Token: SeDebugPrivilege	3052	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1412	3664	SearchIndexer.exe	105
PID 3664 wrote to memory of 4136	3664	SearchIndexer.exe	106
PID 3664 wrote to memory of 4512	3664	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_23e5ad019324765191780cbf810179ab_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_23e5ad019324765191780cbf810179ab_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3088

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1704

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:996

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2068

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1148

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3008

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:924

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3716

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1852

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1412
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2828 2784 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4136
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2856 2852 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e3939eb924fa35de3fa8b43378397f649518a57055e9c4a3bc0970ce893ba9b3
MD5 79dd34c8fdb59f8561e1ab21278222b8
SHA1 81efbefe2714963da87f53c059cfdd617da9df21
SHA512 18ad1a79d3ebb95a5bd94fa10357e715ca9336103bfe8d0499c0396851b6365092da4c3980ca241f31b64d88e0bb2a1f6482e04ffb8163a2ca7c2e18451d0edb
SSDEEP 49152:Hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxngB+kn3Hnx:13q6sjBz+k
TLSH
T114D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f57ab5102354453e11ab2053c3560f0451cd66ad7a21a9c506c814ec20ff7280
MD5 b7efeaa1212ecaf9393e03ed8cc7c3cd
SHA1 27987daeb149bcdf63f9dd44ac4be46b21109cb0
SHA512 b0ee5e2f93c0c47f371c097f41005773b48fa1ad23be6ad6ebddb512756e12c3c3b029a7052ce91ff5132ae8bd3ddc11022328c0a3f4dc183fdedf27b0aa8447
SSDEEP 12288:71XLsswWkxy2lRq2czA1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:BXYfDtczAqNyBo4kx929bL3Hnx
TLSH
T1B265012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3650e5c2fb17bc42a6e3df163a43068667c49cf77280ae58b470674106dac51c
MD5 8255745489d431bd88583b02ae407a19
SHA1 45be93dca1ec18f7d1f2717c19e4f375aa712700
SHA512 8a4b28d4b216d3bf58ecd651e0f4fb4bcf5dcb93c4cc7e50dfce16bddb212ccfc70650f519381f29a04dd29673d46f4d7949e07924fd4ac903cad0785d2857a4
SSDEEP 12288:8XZNYVLeyUji0h90ZD0wxpGZIVuArHs4LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:s0Le5ji0hmxfrMnNyBo4kx929bL3Hnx
TLSH
T156859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ac68067a1244edf9db878b71b227b71b84c3c9045d82c810088487e4a90f3dda
MD5 080b2957385854e995d54a727296b4ed
SHA1 74097a91d80330c8fe066abb9e51e3e53e7bb5b0
SHA512 a1f945970495aad647facaf571cc4a9fdcc1e3596fe9d0383591cf09ebebb727cc299eb73896b1ebe7717b7c211fafc8cf31561ea2d20e3b6d4b6db41adc7c39
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWn6q8wyudNyBo4kx929bL3Hnx:o/ezSC6vUzPveHjyzB+kn3Hnx
TLSH
T1B3755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a29d61ccecaf892db028b4634247a931c009801ab6da0e01ae3e84958a0e10fa
MD5 461a9b375a0b5419c722e9186edbff65
SHA1 4407fc98ac9454869d763fc914c245d5068daf39
SHA512 0163630973a26a3dd024bd6c4ff482b125cb555277a3b5cb9551cb1406abc9e2fc14ec121f1eb3dd0d6c39fd863174aa8520ed79a33cd01b6e9fd5660aca2ddd
SSDEEP 12288:bVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98hLDAptNyvUgXZ32dT4ePc7N29CD:bVbqPb88hv/l+YeNyBo4kx929bL3Hnx
TLSH
T102559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e60ee8d0e3741ac19bc95bd3d9661579b5d4997a76c39675c6fb7c88eb013801
MD5 a0fac9846673ba46b3f1f9189da3f941
SHA1 f7f0af6076dda262cf88bed821cbac6aa80385ed
SHA512 03699d09a74a1e8ee2f7458d24b40487c57fe18e41f572c80747fb8a9fa6cd17f04b77ee5f631279d78319d5a441149b2aad9bafa7b075ce93bf693834eb1ea2
SSDEEP 12288:imELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:imbNyBo4kx929bL3Hnx
TLSH
T1AD4523124B0C627AFBBD3E70745E8454CC35BC8D0D95DB98DE62ACBB58BCDA2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 62f82781831fd2f2b2a956833b895add78160c6b1ede06b5006dc068a6ffae1d
MD5 f7a1808b30dd033db2f69c74160dcad4
SHA1 01834564874b2d6cc67730d349ceb9e620863796
SHA512 c354c03870c8ae6b6f4397730667b42082177bc255e650d86b3f64fca008962153291186416082a26a4a4cf7fb919d3ef4479861aca284d9524a12b74acd9490
SSDEEP 12288:AeBNUbTVO86UpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AJIU2NyBo4kx929bL3Hnx
TLSH
T14C65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dad32ec827f314347fc88057e61134a9708c40d254ae552244109448befcb69a
MD5 ce4198b5b9a800ec19ade348edc05b4b
SHA1 a02d794a99292f8d21ee99b03a3ba20e2de70dd8
SHA512 854a559d99fb7db91185d8508df77b00db1709f732a49ce111384df0fc289ca6a9cf65e014d896bc8d98593fd610d1b7506d61657355367fb19e2f386f151a95
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THb:JQvGAdlCEL8c/DRNw5CC+k
TLSH
T1F9266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0ee91a0a80aa0dc56f85752ba964b7d977e0f2f3a9638d54200e8b514c734f7f
MD5 881b1e88bacfb682b33e0f2f18499d28
SHA1 c8a45ba04eaf6740ebd23f8206c0ec56d4dde401
SHA512 d5679c1d7645bc2ee63b5a0a84dbd8074f2ff1e96d1467461812738fbed4491e4c15666ca55de07020cadc2eaf85140b7d64cff8f0f3cf6e284c768bbfdf409c
SSDEEP 12288:yAwSfxL/2Dc3XDLLmt0LDQewsAjPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:3OewsAj0NyBo4kx929bL3Hnx
TLSH
T1DA75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eb3bf7d6c2b4a3493488874026e2d245af3f82337cce6d25b062f3b2cd11530b
MD5 85c4a94a9f32d8a92639b199c15678bd
SHA1 0fe628a84e4be9d53531ddf4b89ae668df473345
SHA512 20d65d46a92dfe597a4442dda23a2e729159ae3da156f1664bc585f4f77d4798614d8f935f229777b154ed4e3e28e2770f9851e3f8685d3dddda74ed390af0d0
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHh+k:EUEtQevvqc2W1cpV2tI32h
TLSH
T13F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b266c2ab73d96d480709734544fdc92c19c20ac1aac5c320043af32ce980652e
MD5 379f7d02885c0f6ba92b203582ab5cdd
SHA1 e284e31363f0ff920616c0c0e67597d1b6e330c1
SHA512 71d5d99c63c3bfbafea33e4d76ba5b3325de02b104c8960f6da98842d58fa2bd521ddd14cced6fd067c0027b55e0417463a8185e4038d02fd9d86742d6aea075
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/zvB+kn3Hnx:loquVjnme+k
TLSH
T118D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 400a012768613afd6cef99b1a60016f0caf05855bb7538b3a503768b0a579d94
MD5 9921f1d7accaeca58790272c4cd551ba
SHA1 5d20d90417ea7e8e4648b07903464cfa95caa27f
SHA512 ca7137e468deb8407cddab0cefbd92901419c7ad11d604cb7728f08f6bc6ead8e9fa262d934af51204dd55452e38b9ab325b80c1d07cf0f46261abc436f1127f
SSDEEP 24576:bAhGL3IFoiwtA5l7S53ZNyBo4kx929bL3Hnx:bAMUFoiq5uB+kn3Hnx
TLSH
T1AA359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ad5a76b0e0fcf05d3399e24c69fb4434f2e16dfb6a9f6704d5f17cf53eb4b2b0
MD5 e1f288799c6327aea32c5a6b359e1dd2
SHA1 c1188872bb90a1345f78d1f3617fa98cea120f06
SHA512 020a4bb9fc415953dc76899b63c940ac047d7e55f9f219873557851ef014519e75c85e6c7d4861798aa90ad145e20dc4b991eef697685ba8f633863d8b8ba7f8
SSDEEP 12288:Jmw5HEjsChNzBFgl0WDm+COLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Ewu6OWgNyBo4kx929bL3Hnx
TLSH
T13865F10677A81CF9F9A756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 01a2a29c34e7d30fc864624d0d5300cfc696efa33b15cca999352a2cefcc3adb
MD5 b5ca5f01f3d8ba361f6e954d24061dec
SHA1 4ad268c6152dda52107dde4679d78c91a1203eef
SHA512 c6be2569389ea2f8b9111d724a677c700d356274d68269b5a79ec4b5404fce9c49f3e7ed909d57c1ea172fcefb251dde4492ab567d8b556235ffbbda73da3968
SSDEEP 12288:UgZ1Iy/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rZu/NyBo4kx929bL3Hnx
TLSH
T185551216239831FAF2AB2678D8E58544CB32BC461B7283CF5A2145BA1F76ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ee4eda1572cc6aea6df976cb57e7f774072ab0147d8ff784ed35e469078fd2ee
MD5 8f7f333fa91143b0946494d5cf641b67
SHA1 4695ffa8ae323467ff21e326f10ddd79b0035a32
SHA512 69ffca913e50641abb466c230ae79c2264ffc6e476bf085761f69f66ae9a913d60987b61bea1f4be6bdfec0831cd8f8f19d845b3ff9e9be245831bd9e30430c8
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UX:UQRQyi36YOcPbLvw2gAf+PN3n+k
TLSH
T1C9666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 495bd343982d93e03eed2f8f459c5289e9fa6211de2db4c1dd22688814d11007
MD5 325d422db4fe8731829ad17ad25c1b4f
SHA1 09e61484f0858def491ec8ac5f61c0ae5ba62feb
SHA512 857c2546965eb21d3057e15ae8e2701706908d151883222dbd192f1d0e3ed2f9d711575244d74ada6d093ea625a611cb956b716422d871062eb0c30b8533233f
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UX:9QRQyi36YOcPbLvw2gAf+PN3n+k
TLSH
T142666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3408ea7943ba39e140e2b884839447fa8aa2826ec2a1c2e7992458f573344f27
MD5 0bbb3f76164a9a7f61be204d69a4a41c
SHA1 09c99956a9af986deedca06fa55ea4ff244d8249
SHA512 62f60283ffeda64109c4e4c16c02d71ffa998bf766076ca1881570d58bc9eac37c6f7633c23a7ac888d0ec8aafe21a765b0a96f4a4bcf427b7dd8a0a35d99975
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0vNyBo4kx929bL3R:K68Qg55nhceWu7PNU3/fB+kn3Hnx
TLSH
T119B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c27eacd0cf1f3136d254ad7b5b19faf9f3f8f9855b1d48b75c75c9441bec3666
MD5 c267b2d09d26dc76f7b8cec36472e7e5
SHA1 f70e228e0266cd3cd0bebba3fcd87b98253259a0
SHA512 43dec6597b81ac2039baeba52cf13c48ec6b88d215a1b91f823a42050d9615680122c123b4dc0bd7dd29ef2de304b3b4ad7ff3d5ed58e5e45ee77591856b464f
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk999:ey5112gYy5azzVvt69nLKnhZI+k
TLSH
T12A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a07b9b68714feb07035e9eab595736de01c2e71919dd8a5894f761713b446697
MD5 110e29efa4bd5da1cdda66b29ff65c11
SHA1 cb875e9df07309e2deee2a32f1d3cd3dc3000a2b
SHA512 a88353d06f35daf15d6615624e32174699b056397f107ade4af957f197a5740bd9b7069ff1537afa7d2190dfedb2c6f56dc2f2c4c3a9a3f8a3d573fad4bec7b0
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJB+kn3Hnx:/u6Jmdxd2df+k
TLSH
T16CD5AD13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 00a3ebb92b42feead40485f4ff0d3e0ea691feb592bda1b544a314ec059cba84
MD5 e1398e743986ee8d5614fad6b227c5a0
SHA1 12d35d987bf258ce35baa47cb222ba3ce960afbf
SHA512 f681d2864eb78d74395f85e1a71dc9644fdd895b68e19a9c69d3dca93141b56dc2d0e69a61472825c4967af04ee8e972796f104d8de37af41ff87105f5c7d703
SSDEEP 49152:R1hpsNoJpF1A63U44CwH7R4xdB+kn3Hnx:RmifPWRe+k
TLSH
T1FCB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 40e094b9744aa9f1a3a47384074afb14a20df2f1d2f41f2218166dae54df4bbd
MD5 f97d46f434cce52a77b51d64c3ea4cc6
SHA1 2c3cc84f08e39fd3a9429353d52f696902818b28
SHA512 b8ed5a595765d12c4faa9453f78dc2e0b43431f8fad1c79dcd0b4e5db6573a7d5820acc96d8e9ab1b72d2e075b1211b1aa26f346f5fa45647f20e11a723c5665
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHqQB+kn3Hnx:D5dKii61s+k
TLSH
T1D0C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2308ced9e563988d4fba9c704ea63570b32464ea15b0963e2492ff898948a67b
MD5 fb0aca4b57a21182f926c3aadf03e33d
SHA1 b7c957c558a769b8f7c47a9b890a91bdcc0fb3af
SHA512 27315cbcf44029d26ba52488344bdc50d2f9e3f7405941d8128d2964932c7c1f96a01b766c8e24f5ae0cc859d535ba9b154c9bdc32c5d475eb9ff26fea6bfbc1
SSDEEP 49152:bhtSn8EApI0fig3giDn0AP5w5B+kn3Hnx:6X2imphK+k
TLSH
T18195BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 775849894b7fc61d70cb08b10eca02f6bb950bfdd59e591691819a5b199e5ca0
MD5 f2dbb6734587c682000c4fcf877f47f2
SHA1 72166a020f9fd9018cf7774766aee139c0d3913d
SHA512 9ad84461fc06a62668dbd06f897d002bb1c8747eb8070f194853a3443256d29e0cb9c6a54470c5e6b9d4a58b9e4f1b674c1ef97e9111d23a90ae4a2d25d6b5c6
SSDEEP 12288:kMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kTNyBo4kx929bL3Hnx
TLSH
T12B4523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f7d4db4a830435a4f86331df9a8ed47dcfc02ab7eb5f199e85722d1fdcdfab12
MD5 92ecf7c12c3b7c5fd126cead89e6a486
SHA1 db15fefd5f2bbfda1fa1aaf6bab371821979c3db
SHA512 6cf25ef426275b7a4448ad0f3ad1e324694ee986ab98b2870558fd4d1cf9f31b9aa074dc0e6b3f1731e6e805146508ec080273659eccd97a4cdfa30510db4117
SSDEEP 12288:xLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xINyBo4kx929bL3Hnx
TLSH
T1AB4523125A0C227AF76D3FB0654A8098CC34BC8F1E9597D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 43fefd55ec90b9d6a11247cdcd41b278aaa448e148a1ca1fd12292454198bae5
MD5 cdb6a31099d366eace606b091ad1ccac
SHA1 c361ef8b552412acc101f0f6739872b37d1b9a5c
SHA512 3d7d60f49315eea975220af79b34b2acb9f65263a0140d7eccc6deac530ab0ac6a9a2315503f972d2681ab64374bb5f949d255d0079130ac0c09a096c55550cb
SSDEEP 12288:YxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YONyBo4kx929bL3Hnx
TLSH
T1B14523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2d8421cbdba731aff8207cbe1946275a8e88a89bf32e54606192dae2734e5090
MD5 eab7b9caeebefea810ea6f124844fbc1
SHA1 f533aec66de98fe2269766472e1807e60b898e06
SHA512 c16dfd6364513a7af95e87aa52e5e010775621697ea6506ff7107d05414f188568b096db3c17b20991506e13e15bb6bda507f22dc3acd7a3a940b12aca070657
SSDEEP 12288:8VSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qNyBo4kx929bL3Hnx
TLSH
T1994523125B5C12BAFA7A7BB098568054C835BC8A5B7297DFDF124C7B0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 db678b9b79d275f62f47d876699e30203a13e9dd898706e2f207f2372b719d5e
MD5 e1d7f8f45e766064c3b88a2a9fba8af1
SHA1 f7baab07c41823b4ff34ab86e717135a16e056b1
SHA512 6ce547d90bb77ebeaf870f7317e9c2e64af73ded2e842b9bbda22b4fc87544ed60a9f8ba0dad5d4d4e4ef3b689533d46d85fa833463a66a76ffbf0f13313ba73
SSDEEP 12288:0KLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0BNyBo4kx929bL3Hnx
TLSH
T1BD4523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 897b1e0b56fc5ce3ff58ecea8f687151324161f8f518e937c9f9dee0872aa5bb
MD5 dd40e24f5255832fb36bec80f62355de
SHA1 dab5a046fc0402a5eb1982384887e3da0ff7dc15
SHA512 a463afb189bf30102ddaa85a9b321fac631f69a974cbbb1612cf8b1278f3049294d084a305b36d84d9bbfcbb8b5e3c0a0e754d332762541601efdc0cbdb1d221
SSDEEP 12288:IXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IsNyBo4kx929bL3Hnx
TLSH
T15C4523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF67987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 06422a049d33ee42157e84251a6aab763835298c48782af1a48cea124aec80a4
MD5 eaa72eaf0aff3864a37c926d907317e8
SHA1 dde2e1a63c3c68435ce2a2f58c178937c71ef66a
SHA512 60335c913ee3c17bb27d618cb02f6fbbb473e8247b6a807e6e2c3c02051c2e6bb44cd43e5b7456c976fc697d0ae951ef858ee19ccad86442ff03754c2546b05c
SSDEEP 12288:ADLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AQNyBo4kx929bL3Hnx
TLSH
T10A4523129A0C227AF76D3FB065498498CC34BC8F1E95D7D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 042613cc0ae281461ce38daca4010eb0528fd4764987eb98c0d6567fd55c20d5
MD5 9af9e201c42bc30ad7a70d07c84ff335
SHA1 2866a2b73da626cef8473a1034e80824ca974894
SHA512 28c7080157f311b0b790649cc6e2c04290b61d799495e636ece33348a9039fa30973b3d5e3152cadf9e5f3e584fb495fcec48b89535a94ba5210c5e53d594d6a
SSDEEP 12288:8iZwbjzzFEoS2cPvyrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:fZMXzFVSOoNyBo4kx929bL3Hnx
TLSH
T1D5650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 17f5d875ebadc30b8b6e5ee8ad9a85adee79dea1ddf3bd586cdeae79bef02d8d
MD5 bb85d87daca336b4409280a23d73d78a
SHA1 36556ee887a9ee301cf29c080484031765e4cae0
SHA512 b2b7d5c16dcdbdbe4c21f43032401f50d7615a26d1697cb065d77a8be2497c9356a7461acbf96674217086e17dfaa1783794529a70b678704b8065ee20680107
SSDEEP 12288:ywLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yPNyBo4kx929bL3Hnx
TLSH
T18D4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 20aa7553442a20517f380e8f6af5a9feb910fad2311a14545506c441a870568f
MD5 906a128d80bf25debc970f974f69cc85
SHA1 11e64ff28d507d6a0b1509472a663485cbbf2934
SHA512 dc403b083b303461fbdb02da4c71679249838175eb08c5c9c0e5ed9268db6b94976a3247fb746ea82bd14f667bac2ae879580bbd42087ffa2da5f3b06332d74d
SSDEEP 12288:Q0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QrNyBo4kx929bL3Hnx
TLSH
T1C24523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF279C7759BCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f6faa4b8518649442fa3d12f4080373138cc1360b29896f73857966a8dcc3249
MD5 e62e79ddd3873f72e0a8a0d8207eace9
SHA1 29b4015914c6f328591c7e31dc3ba0c9b322a267
SHA512 767eb111e237faaa095ff4fd38dbede84346542c39241ed7570a948c1a12e1b2fd506eeaede0e4c98b1b75e47f401d11f0355220649a3f6236157c5721ba4fdc
SSDEEP 12288:+yPz5L8/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jzyENyBo4kx929bL3Hnx
TLSH
T1E655120777A431F9E17A6234C8960A05E731BC360B608BEF576046772F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4fc787b3a7c2414344709a6a63cf6f216c744f4d062a92ad5d8955508832b5cd
MD5 e1ee907913cbdfae31cf489d3d672b84
SHA1 a4565fc88202118cea88f68964be354f9795c9ef
SHA512 efdf1ada9b5c474887b08f33f60f11ddb87c3c82de9694353d86eb0e655a492fee3b4173cc452fdbdf87ebb628cea6cf6b048bcd88996d7a0d2cf5d626fab91d
SSDEEP 12288:pwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pPNyBo4kx929bL3Hnx
TLSH
T1954523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1bd779d8abeac56f0126eca768e0f09447b6db335719f4f18922c87249e84320
MD5 3ced3d2361b4d8b12c73db2d928d0dad
SHA1 7908106695b3aa2ed96eaca3b0402870d6dca66d
SHA512 bacb3a896fa968f39482e7dfdafaab1a59d738e8f3fe33504517c84228f74adccea49735678699525ec34a107b1fc3987a1e777cf94d2c6b1066282f1caba97a
SSDEEP 12288:IwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IPNyBo4kx929bL3Hnx
TLSH
T1C84523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF279C7759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 65501bfb49b9627d2ec0c11e27127af49623f366285730501b28f12f46105fe2
MD5 03e29201c972589db813040eb6e29456
SHA1 869ea66f8ee0e9ce8cd5a831d775f72ccfc4064a
SHA512 0dd96dbf36529251a740cb49c4d410170735d288191021173ceb7e39d4eca802793823b365da36ee16d88312344cd55a94eda3404e2d5476bb8337ae7435717b
SSDEEP 12288:2yPz5L8/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LzyENyBo4kx929bL3Hnx
TLSH
T1AB55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 86e8ee0c9f05158acc6021117626ab29facd10bfaeff3524a77c9c9d06ebb429
MD5 b3f477a83cc03c43a6fa08d8df84269b
SHA1 58e05c222e5d782cf99692ec2c3d7deaee0d91a5
SHA512 74783b6a373098152b66344155c66032e52428cc2746d8a1553036f5dc5dea3d0c6775f676eae8a5fd110979378ed6452d29808c1e1892b80c6c289670a9036c
SSDEEP 12288:ACd98WYoaLHF3z0z04PDvhBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:ZTtaLl3z0zD+NyBo4kx929bL3Hnx
TLSH
T17B6501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0885c35bcd235aba9b98ec0b1bd72010cdc1894b59e7db67929e9d7d19b578fa
MD5 ab31ff4c7052785039171d79386da5b7
SHA1 c36730e497d8606853c850695778747d01be03a2
SHA512 50dd80e5f3db0a5445f29fcc03e317db8343bb42cb013954868c3a8e316d0040ede6a7a35169d7ee270f209ea2a5c47d864e21cfdd74625445445cf6f0ac40a7
SSDEEP 12288:0i4e7ARdTfgwCHKy7GLbbdIvmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:03ld9CHKy7GZiNyBo4kx929bL3Hnx
TLSH
T1D175CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1af9f81adc030da5d0d22def2f85f0b6b83cee8572878bf7fe586f3d696ac10f
MD5 1d2ed676a9a13bebe8cd2ad5c6ba3347
SHA1 caeade1f26f7d3e2a7f8c910b31223091faeaafe
SHA512 3b880c0d6eb5c8d735f9f9a6aa889a39f3da48e8aec6626510c094da27cef4c980c7897f3adffbec3b2bbe12424f791152ecb7ba29ee0d7c66759e1552526374
SSDEEP 12288:ARLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AuNyBo4kx929bL3Hnx
TLSH
T16C4523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d7898e1250aed5890dc298a81675ece72603493fb9d462038dc51c01847c5f12
MD5 b5d0c4a85ddbe252b554e6c003d3f7bf
SHA1 9506fce0c0918b37ff6248229804c9caa2d616b3
SHA512 b900fbb921325ad9f7967f0aab218bd057cdca67454f5b532be5de00a25ae5614a21854e67cb947dc00ad7c54fc0fb39a44ed8778d12fba03f95d9447df87823
SSDEEP 12288:7fLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:7kNyBo4kx929bL3Hnx
TLSH
T1544523125A0C227AF66D3FB0644A8598CC34BC8F1E9597D8EF679C7759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 15996a25b04cd8c84b2f050be34b30657f9ec99f30ae17c53d8b0a1ce1a9ab8a
MD5 b7f0c335c6ca72fc62be7e5ec3a1d510
SHA1 5716aa57b1d956d0ee826ba1caee3885d615a69d
SHA512 382b8c3a368da41aabe1a5f6d934cb292dba1f12d0562a86a9ef6153ba7dda7467a8553afbe916d42692b2bc04443f6a3c3939ca8284a350163356ca6286a46f
SSDEEP 12288:+mLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+lNyBo4kx929bL3Hnx
TLSH
T16C4523125A0C227AF76C3FB0654A8598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ac25a7c306fcb0dfcf721e12ae91c36a4c995bd05d0d5463d645880859f3f409
MD5 9d82b6e553cd0e83f455426b005277a0
SHA1 c38d68ed2465ba86f03c616772d72c27a48029d1
SHA512 4228692732e2f7e01670f080d622629cae39daae8f283111871813977f6107f6f0127b78a0e12b18b0794223de65f69b5d855ee0752ae3042183efbff0d0187b
SSDEEP 12288:JwLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:JPNyBo4kx929bL3Hnx
TLSH
T1074523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF679C7759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bd2bffae65f74caa618cdcc914a7e2b4249a2b97aa27eeb4caf559d1c52ac6f7
MD5 1d2a249988d21dc011405d8f2e5418a0
SHA1 22a845ba1a65f15ef634a0d714eae5d4f5114d34
SHA512 2429af6fa0c963129e51fd5da8d07b6493b1bce06d8feec4e6e703d8fdf36417b50c0e5055cf38664887452f925ccf3f682cbab39196e452e82665a6a7b373e5
SSDEEP 12288:+psfALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:P/NyBo4kx929bL3Hnx
TLSH
T14C55F00AD25812E8D16E6274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b47b7bf561379d617203c7ea7bc032c506d76df495ae41cc26eb0c70c3accae8
MD5 43eb5af5f5db1bb9b85a7ac062420fea
SHA1 abce1f9082cc7d9bae0d2517f44dd3cf57aead72
SHA512 d156f23f9a816b9fa8690b8c0b651b2b13cc4b18cd8f2b8c1f5fafbc94e96d57cdf845f16f982a525be0636aa983b4ddb68329afa7222070534415aa3cf2b120
SSDEEP 12288:q3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qMNyBo4kx929bL3Hnx
TLSH
T1BC452312974C623AF67D3BB0645EC124C839BC8D0F51D6DBEE1258BA55BCED29E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 632320af2e0b837cedb53c82fde5bc6d65b7442fa52ced7c5afb6040b8f82983
MD5 115fc174c3dbaa90a7ddf261d21c5bfa
SHA1 6e72761bea001d70177a8e7f8b7963067bb0a139
SHA512 283d283cee24a5ca30c8e319d060bf8a8dbf0be0335483dc57a1db032f9a2a2831f09ed0d78fc561884b2018cca29f79dc1882ef100486af9ad8f08cd298865a
SSDEEP 24576:A8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCyNyBo4kx929bL3Hnx:hRZwQCyiHiQEaiPnMaB+kn3Hnx
TLSH
T13B85AF1E62DC42A5E0BAD278CDA74407E6B27816473197CF1291C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 791fa4edf8937c9b2d1849cfa848dfbcbfb993f72181e6529b1dd6ba7543f88c
MD5 d08e95de2afd63696a7e2c2655655eab
SHA1 c334fa70497a8626afcd52d27053fb409a2ff84d
SHA512 d242f2b08c57cae1a370b6edc075884eaf41a50a43c1d5e3398e9d7f7f7e8fa0039538521d173e68faae87f24aa538a7418b0d000a0174600197d46c5cc64fa9
SSDEEP 12288:pbxA1U7KnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pbxA1UGcNyBo4kx929bL3Hnx
TLSH
T1DE55122E569C20F5F27AB67898C68105C731BC0A1B2193EF6592C27E0F3BEE55D35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b2428f5940644b3969a2f36e7b3e7eec1914727584942acedc90b625f3363236
MD5 e8ebaeeedb79f45190f11196d0a636d9
SHA1 0ce7b33c44f9ca5df71ec0568df113bf8674fdd4
SHA512 51b275116667186da4f37eaa2e6a421505835c319e711775975ba5fe4b4afca0215993cc108d38a429c51120095d38cb18d78389ff6bd5cef30a2dd9fabc63ec
SSDEEP 24576:2jsmP0yHaqrVqHra44KDzMsrnXNyBo4kx929bL3Hnx:2jRP0yHfVqzlAsrnYB+kn3Hnx
TLSH
T1F345AF2EF2B910B9D4AAD136454507B5EB71B82D1F209BC70170C635AF0AEE89F35F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0a8fa19131ff98631424695b32e4d491bd6fa843824843b8a7b2245308d0dba3
MD5 8e11b02caa3b909f27527e5fbe52a00d
SHA1 baabc6becb07c75bb3541757470b16aa6e9f354b
SHA512 87c2fe2c8fa6b72a7f4eefaea4254d671e7fbb847e34af0abd0e78044a0684459c9945f567eab31492cee23d254df31ec857525beafe8832afba8a372f76cfc8
SSDEEP 12288:QFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QaNyBo4kx929bL3Hnx
TLSH
T165452312560C627AFA7D3FB0654A8554CC34BC4A0FA597DBEE2698B749BCEE34E31103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 cf896126a37d7396e4220accdbaeabb0cdea55684381d9f7b7b1633db90fad3b
MD5 1416004911af54f244c19f446bf9b826
SHA1 70619d76b62f7d0b58719309ef0cf6b87b4067b7
SHA512 d61351c817a733a482bea56c38c1507fb14c9444f7075a257304613aa5b47e11e6a4e0927d829ea06f93e257254f6a61c6f411bf81aceb54e7ca156f450e23fa
SSDEEP 12288:iObFA4LWO+vAYFTbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:TxLBUT4NyBo4kx929bL3Hnx
TLSH
T171750115F79800F9E97B923CC8A68916D672B84D0764E7DF03A84A661F637E24E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 529e940690efe07e07f881f8bbbab581f6ed7fd1a1dce9c44d0376d7051736c2
MD5 bf3867ee18205e0ee40406a92c26a714
SHA1 ce8cf287903cfd8dc9eaf02341b17c4a26696e80
SHA512 dd15c41a55929030d6699b309053f1046bb3d45fcfe23f2b0eb32eafb3dfcbf6cc7df499a6da148b80c158501bd4425f181f78ab99c0a3810cc20d8748c5a4d9
SSDEEP 12288:L70VmrIYNvUyBpSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0jYNHjNyBo4kx929bL3Hnx
TLSH
T1F665F12F52AC19E5E57FA1798AC38209F172B856171193CF05B0C27E0E27EE9BD3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2225735d100fb2749ff583e07fbb3da67f758bdc65c7acaa15368e508d78e866
MD5 8966257659cbd08bd70084e6a9dd72be
SHA1 4fb82736436abf6ed5f25d21b6e9cc0382daf240
SHA512 8820f9db319b64a58c627ae732220b7c1f09ccd4fed3dc3ab74c53a5d130e21a070f37694309072dad06b6381e71243d5eef5fd4e8fcfa8af9dff000e0dd92b3
SSDEEP 24576:jnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKj:jnXoJJYH84VVS6AmEOJas+cHBjSSKHPT
TLSH
T19365BF6EA2BC04E8D5BBD17CC5C24506F5B178661331CACF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 13755dcc46c09af2fd2aef44a6d8473a59c898321a7d22ff5fcf8679d4cebd92
MD5 52df71ed11f7630377ae8a77b78a10a3
SHA1 f81b83fa6f961f551db8c574e5cd8040744dc532
SHA512 6845034966f18911fc5b5a7e0bdfe65a272b302f744057a2583f51a64ad6eee53e12cdfbab06ac03ad5816d4909fb9405627563480b50791b775bc321503e0f7
SSDEEP 24576:Pv7Xbxd9Tuycf8M/TYlSuxrr2PChNyBo4kx929bL3Hnx:PDLL9TuJ0M/TYj2PpB+kn3Hnx
TLSH
T16F858D1EA3EC42D8E4BBDABD85A79146FAB2B855173081CF0251856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 2deb07cd52775a0888d990235f01fe9d574febcf884480d74fbeea5bb14000f9
MD5 3ec46c2bcca56bdb3c92e64d3de2f2dc
SHA1 f7054c241141810e24875f537b909f24eedc477a
SHA512 ba89a694f13b8dc3f2b0fdb7e7c8648941dcac020a323e829f0b75789d6b6a1e4611c4788e64f7bf19e4456ef80b01bea032519cbb040309b7f0204e0f86d455
SSDEEP 24576:qegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w4NyBo4kx929bL3Hnx:qngOJOmPOHz7B+kn3Hnx
TLSH
T16C55CF3FA7BC15D5E03ED17D8A978816F6B1782603255ACF0560827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 12f8ec3b7b9b9d5c5fed95f438a3f748e54b0cafde1b184e05b2e228ce10a0cc
MD5 e703521ca67e630a085b4e0fdd3a52e9
SHA1 9a398e0b87af35652f89d5e16ace47bef13084d2
SHA512 826b21b92800b8dcf7ef45376bdae81556c9b8807e11050a91415be0508ba6583d4683eb744887d7fd3ccda179c2555b6506107e6eabfdfc415c3f81ba24d49a
SSDEEP 24576:tLJnJiTk3R3waE4JrO6NyBo4kx929bL3Hnx:tLJnJK8R304loB+kn3Hnx
TLSH
T11675D02DD2A810E8E4B7D2B4815A1756FF31386D2F2169CB59B4D4353F12FE0AA39F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ea551817922f93c5f68419c574db49803e87e567647936ced5b15838f95e7eab
MD5 055c8bf20cd460a087c5fc8b89476257
SHA1 981be77fdd9d495c42ded32fa42c99de0646b745
SHA512 e1764c65d6c1973b430d66ec0261210bc94a10f5afd995a4a0eed942ef5ac54e0b515669b0f4b26b25a2c820c5587f232a123f12e773e216f5172e9a2437c4a3
SSDEEP 24576:KA9mqCceDQncA/BmlvLto8cFVr9og9P/Z6pANyBo4kx929bL3Hnx:V9mqCzDScAZmlvTcFg8Ph61B+kn3Hnx
TLSH
T116955C05F7EA5298E8B3CAF1C96694159B327C409B34F7EF4A80C97A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 0377c4657a4502d8d12efcaa00fc44772f9b7b78aed7e8646140a92a9284a563
MD5 ecdf399a1ed8fd37d6027eb87fe18ae1
SHA1 dd9358eb6a25e262b28365c871e89cd50e9f086a
SHA512 6fdc7a1837e56663375084d0477f00c88b8ef72b403f9a6aed24da19b19e5bcb93753bb9bd1e80749c0401b133f0d55fa0420c373de69a655f22704c61684992
SSDEEP 12288:ulYJeXm5nkEUuEzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ulYJeXm5jUuEgNyBo4kx929bL3Hnx
TLSH
T12655121E265C30F5F23E657894928504C731F8A6175163FF96E0C5BE8EBAEE21E38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 29af9f7e99b5d2af052f192f9a103bc9a867cc1604fd9827f6903036fbb41b30
MD5 e3d7661e94d4a94f24ae76a3b72224b7
SHA1 0e47d917fdc09104c78672d9e880e614f3446422
SHA512 e759a455ebd450bebbff2cc704a5574b570ccf1fad3039cf39de37761536d273d82176e4088e63a5d5dbf0e8d94152da2290336ba9d9bf98acb866c553d620ca
SSDEEP 12288:EIu6kyoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Etty3NyBo4kx929bL3Hnx
TLSH
T16B552201639861B8FABD2A74D9638194CD34BC150F2193DF95A1EA3F5E7ABD1AD30B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e7734721bedb6bc309ebce94040e57f447137a564e5e6be9e2f1bf37af169304
MD5 a59dfb4126a484562deed3e9e8ea4ce7
SHA1 c3fed58c6045d7f3116023dd58eaace36c033e31
SHA512 605a2d0f16d12d9acfa99e264018a102a26a663b1149b45e97f211a059125855715240a50973dea635c5ab99124e6f53aac8d1cf19e2d66532f2da35d0912363
SSDEEP 12288:oPbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:44NyBo4kx929bL3Hnx
TLSH
T184452316461C3279FA7D3FB0645A8554C834BC490F51A6FFEEA2D8778ABDAD34A30903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 678f35f1f0c189d12e783f6291db50b650912d265fb4de8c0ea73641bbc15101
MD5 20bc810f8e379e67c4185b5a2ace2399
SHA1 9762a22ca4b10c0b1baa4ad571e91ce5ed739c69
SHA512 243b0d4ed27a422c4275b53458efe559ffbcebf4d09c47e664f3374ecd50565848f366a80b09335ac074a1902e08f05defb11ab9985326f3f690dfc0888c1b92
SSDEEP 24576:QC+TyQIu93VAumZr7jmlNyBo4kx929bL3Hnx:Q/TfIq+YyB+kn3Hnx
TLSH
T1A6558D1DA7E91DCAE276C675C8A34493EA33B872137186CF2044C07D499EEE9AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 7f400e8b20da2979349f560bf1d73d48963ebd1c12c602e9dd1c19301ad8b9c8
MD5 cb5fee16e42d4f1c8e5ed9403245269e
SHA1 7121631846b8b19bcbde216747c4eb1c2cf88734
SHA512 a17e10969d4fdb72a72ec817344c5ed29e8ed9638c0cfca5d63741b0ff18de492633211df8d9a14ec3d06a8b7abb4508c7be4b561028ce014d2b99d97880cf6f
SSDEEP 12288:TcyrWOstaa3kcsvLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SLQikZUNyBo4kx929bL3Hnx
TLSH
T1AF65F10FB36E10A5E1AB923C88854115FA737875071263DF46A0C77E4FAB5EA7D38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1c6f48bad77778156e00ed42a445bd37518ead2d30389f865da19d30d2c02063
MD5 2d1f8dbd42171bcf9048fb60bbca1c51
SHA1 09d1df6696139bb1f592e7ac4ba2def57ad2377a
SHA512 cec330785909ad960fc80d558351d6d8e1be4ddfe7271f839a6fa76a27417ca76020e472859d937ec20598705e1d8e7889ecd73ea41110c3a63b63897bc8c19e
SSDEEP 49152:spJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP4B+kn3Hnx:tpC7b4+80GTkb+k
TLSH
T1EDA57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/784-231-0x0000000000DE0000-0x0000000000E8E000-memory.dmp

Download

memory/784-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/784-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/784-229-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/784-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/924-348-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/924-522-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/924-539-0x0000000000CC0000-0x0000000000D6E000-memory.dmp

Download

memory/924-343-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/924-337-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/996-531-0x0000022F25740000-0x0000022F257EE000-memory.dmp

Download

memory/1148-313-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1148-434-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/1540-0-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/1540-19-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/1540-9-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/1540-8-0x0000000140000000-0x000000014033B000-memory.dmp

Download

memory/1540-28-0x0000000140000000-0x000000014033B000-memory.dmp

Download

memory/1596-413-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1596-422-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1596-419-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1596-540-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1608-527-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1608-359-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1608-353-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1608-361-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1704-76-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1704-69-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1704-232-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1704-70-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1852-425-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1852-435-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/1852-576-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/1852-431-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1968-398-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/1968-258-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1968-530-0x0000000000C60000-0x0000000000D0E000-memory.dmp

Download

memory/1968-251-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/1968-252-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2068-274-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/2068-421-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/2068-537-0x00000000007B0000-0x000000000085E000-memory.dmp

Download

memory/2068-278-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2068-284-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2560-347-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2560-327-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2560-333-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2744-433-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2744-295-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2744-289-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2744-297-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3008-535-0x0000000000CF0000-0x0000000000D9E000-memory.dmp

Download

memory/3008-316-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3008-322-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3008-349-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3008-534-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3008-536-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3052-32-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3052-228-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3052-38-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3052-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3088-62-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3088-59-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3088-67-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3088-65-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3088-53-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3104-277-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3104-275-0x0000000000A70000-0x0000000000AD0000-memory.dmp

Download

memory/3104-262-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3104-263-0x0000000000A70000-0x0000000000AD0000-memory.dmp

Download

memory/3104-269-0x0000000000A70000-0x0000000000AD0000-memory.dmp

Download

memory/3152-529-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3152-390-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3152-399-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3152-396-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3316-364-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3316-372-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/3316-370-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3316-528-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/3664-439-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3664-488-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3664-625-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3664-445-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3664-520-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3664-504-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3664-448-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3884-375-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3884-383-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3884-388-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3884-381-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3884-386-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4136-545-0x000002A1962C0000-0x000002A1962D0000-memory.dmp

Download

memory/4136-541-0x000002A1962C0000-0x000002A1962D0000-memory.dmp

Download

memory/4136-542-0x000002A1962C0000-0x000002A1962D0000-memory.dmp

Download

memory/4136-543-0x000002A1962C0000-0x000002A1962D0000-memory.dmp

Download

memory/4136-544-0x000002A1962C0000-0x000002A1962D0000-memory.dmp

Download

memory/4920-447-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/4920-305-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4920-346-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/4920-311-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4920-538-0x0000000000CF0000-0x0000000000D9E000-memory.dmp

Download

memory/4956-20-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4956-26-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4956-235-0x0000000000D00000-0x0000000000DAE000-memory.dmp

Download

memory/4956-230-0x0000000000D00000-0x0000000000DAE000-memory.dmp

Download

memory/4956-16-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4956-227-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/5092-532-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5092-410-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5092-408-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5092-402-0x00000000006A0000-0x0000000000700000-memory.dmp

Download