ac93ec0001f343887d13b75529f5bc432a0433cf86c8dacd2ba7ff194131a046

Analysis

max time kernel
149s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk.exe
Size 1.3MB
Sample260601-redlyaez4s
SHA256 ac93ec0001f343887d13b75529f5bc432a0433cf86c8dacd2ba7ff194131a046
MD5 e4dab63ebf0619e5a3642cc913c5effa
SHA1 f5d24b4c9cac88190206b497885e4a684105ba13
SHA512 267117d7cda752032b43984554eeec7fef9ba9b427872280972c85c9bee1396fa3a1132374ad395bb389c1b52d1934310bbc96359ba101f4be8c80dc6af53c66
SSDEEP 24576:kTUeMkjw36RcO87p3E4Tcc7sqjnhMgeiCl7G0nehbGZpbD:kTBjLcndEeVDmg27RnWGj
TLSH
T1F855CF167BA414E4E067C53AC9A2D115F772B8125B318BDF02A1876F2F37AE44E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3592	alg.exe
5804	elevation_service.exe
3368	elevation_service.exe
1792	maintenanceservice.exe
3784	OSE.EXE
6136	DiagnosticsHub.StandardCollector.Service.exe
2720	fxssvc.exe
2208	msdtc.exe
5988	PerceptionSimulationService.exe
4572	perfhost.exe
1320	locator.exe
244	SensorDataService.exe
4464	snmptrap.exe
4832	spectrum.exe
468	ssh-agent.exe
4956	TieringEngineService.exe
3380	AgentService.exe
4620	vds.exe
5536	vssvc.exe
5012	wbengine.exe
4888	WmiApSrv.exe
4408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\572df8c7396076bf.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047909cfdcff1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e3cebfdcff1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec7d10ffcff1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f7c2fffcff1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfc5f4fdcff1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092f144ffcff1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5804	elevation_service.exe
5804	elevation_service.exe
5804	elevation_service.exe
5804	elevation_service.exe
5804	elevation_service.exe
5804	elevation_service.exe
5804	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5444	2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	3592	alg.exe
Token: SeDebugPrivilege	3592	alg.exe
Token: SeDebugPrivilege	3592	alg.exe
Token: SeTakeOwnershipPrivilege	5804	elevation_service.exe
Token: SeAuditPrivilege	2720	fxssvc.exe
Token: SeRestorePrivilege	4956	TieringEngineService.exe
Token: SeManageVolumePrivilege	4956	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3380	AgentService.exe
Token: SeBackupPrivilege	5536	vssvc.exe
Token: SeRestorePrivilege	5536	vssvc.exe
Token: SeAuditPrivilege	5536	vssvc.exe
Token: SeBackupPrivilege	5012	wbengine.exe
Token: SeRestorePrivilege	5012	wbengine.exe
Token: SeSecurityPrivilege	5012	wbengine.exe
Token: 33	4408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4408	SearchIndexer.exe
Token: SeDebugPrivilege	5804	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5444 wrote to memory of 3308	5444	2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk.exe	81
PID 4408 wrote to memory of 4916	4408	SearchIndexer.exe	106
PID 4408 wrote to memory of 3092	4408	SearchIndexer.exe	107
PID 4408 wrote to memory of 2984	4408	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Users\Admin\AppData\Local\Temp\2026-06-01_e4dab63ebf0619e5a3642cc913c5effa_icedid_mespinoza_njrat_ryuk.exe
  /desktopicon /platui
  2⤵
  PID:3308

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3784

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:6136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3924

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1320

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:244

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4464

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1176

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5536

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4916
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2040 2688 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3092
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2860 2856 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 15de155a2211951cef20d66bf13853a453d9a480f3f3c4e3b5e609fcf90e6f1d
MD5 e5b7d498e7204f317604ebcb0be29c11
SHA1 40098ac8f1ccf49eed8ab5ca8de9528de11114ff
SHA512 34b392e2fa87d2bf4985ddbd21361742c3b80b0244efa035d4abf6ca0e078362b2916bd6548240dd182a30f1c945fb702a35450b20caeaa2e7c2f564df41e2c6
SSDEEP 49152:Cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnwDmg27RnWGj:k3q6sjBLD527BWG
TLSH
T14ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9a5ec4357b543f463b78c6a4d29e3e2141b1db3142f75736991df3e49bdd9ea5
MD5 a13defa9e4cabe51efe357099655556c
SHA1 6f9455382ed02ccd615ae7d3c5c3b61a1ec9f543
SHA512 85395e29f6a0449c143278f71e2a72bcbc944602416ec9541c037de45c828232328d3b517c1f046543e144d89bc52465e39910cc826e474884cf64dd7464fd15
SSDEEP 24576:VXYfDtczAjsqjnhMgeiCl7G0nehbGZpbD:AtcmDmg27RnWGj
TLSH
T15765F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4709b2e478d92e4e6e10c1c256c4788f72c190954b0894a9e18b51901caf5872
MD5 a05656dc05e233f631d1d705f91a5def
SHA1 1e279e24bab56892d5810b9f28cbedf23b2b8e78
SHA512 233a8dc4bf6685e41ebf6df56a32dd8e37838a9081e769347cc31dfa49acb2a482c130bcaeb438584d16d09ef9a7fd4ac6d0f5ad6c3222d1fa5ba0650550b2b1
SSDEEP 24576:V0Le5ji0hmxxrMssqjnhMgeiCl7G0nehbGZpbD:VPji0AjxDmg27RnWGj
TLSH
T13D859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2f03ea99c7ba20b4a163201e58968de025d0dce233414e3366b2fd4063f6aec3
MD5 3dd4cc9bca74cdeae5859c85d674772e
SHA1 727ecc9fb95585e886eedd6f04bbcd43cc0c36f7
SHA512 23f070b1a0bf7904fa425ddce442b1ed102a378672e8f320b7da202dcf61a6694b7cd5648415dd3f8b05646f79d0f32db2608f7e809a9c90b6be5191ab1b9346
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyuysqjnhMgeiCl7G0nehbGZpbD:U/ezSC6vUzPveHjy9Dmg27RnWGj
TLSH
T158755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e25946a428bd4da5ceeb0f852ea0db8ac4cee8a78203aaf8df1faa925addac7a
MD5 b50f1df5f8f3fe7ab26d26b7a3e63068
SHA1 f726160468d28703bf565726e6713c614a554d7d
SHA512 9d3086b47842d4f493581e5a901e22d41cd6c25d7c966489cae8d4a65d082d83584933a4d86ce5183024a876429dc54ed46a825677262a96750bdb008704368a
SSDEEP 24576:5VbqPb88hv/l+YHsqjnhMgeiCl7G0nehbGZpbD:5VO88hXl+uDmg27RnWGj
TLSH
T1CA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6502b7f38fc8c1b3d088ea339b202bb6afc87df1926de6020264198bc7333d3e
MD5 d6e25b56ac42cee122a0a8706da9537a
SHA1 f41da030e1acf1d9bcf61cbd35725c6ccfc07c7a
SHA512 250e29fc1c649feb97d0815f7cbae93f3a4c8e1e66fa4e99e43c9663ea7b8d2ae2cf2e4cd4420d7252bfb5a553f8688f021aafd68d169a9c81ffe46d1d530337
SSDEEP 12288:LLwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LLwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE4523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 874c1de2671a70c26d36d60aa7e13ebc1c473f61171a055fa10696b458a0ea9c
MD5 65f6f9a9883d87a0344fec95c699772c
SHA1 41a638fdc94a04aeb681f9133ae2ffd79728df50
SHA512 07f3ca9e7b0c7ecec8d2778b63c655955ce98661f957bf2e3329aee318344f405d4de25b65ac16fb248778fa495b834fbe28878e1dd02aa095d16bee7ffeef2f
SSDEEP 12288:OeBNUbTVO86UfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:OJIUfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E65CF7BEE28FCD2C27A4DB95791C600E76278314F21A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c1fdb169479aa25da61f54684ce1a90c224626dfa32930926702ba81f9d70944
MD5 d57d14912de9161422d1c032214f68c8
SHA1 aa057f88cbd519cb87d6bb19ebccbe8aed921473
SHA512 4c31f6464dd248509b355d0bd6976220c77fafab0ad8a28cb508c55b37538d2c6f9a47b64c2d36e79ffe4e0dbd09bd87d07b186d868dbb740465b6adaa5c02b8
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:+QvGAdlCEL8c/DRNw5CGD527BWG
TLSH
T1D3266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 42d245bc4810602cf516cfa63737baf5f66086aa52b14a02fb60ca8b5c3f6911
MD5 c1d06a4c449f52ba374dad371613745c
SHA1 afd590bfa0c22c13f3dd3256fc1a0d7db3254be3
SHA512 324d5c22d24f4b1650921516b62c68cebdd3fc2f77ad003333d69a829213da98845caf622284be3c695e1f41370c945cbb3bcec065bb7c0e8aef26841e6be4a0
SSDEEP 12288:BAwSfxL/2Dc3RDLLmt0LDQewsAjdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:i0ewsAjdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12075E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0422f16a4ee61cabf99fed1e006edb345699d69261def5692f753f49f242abc8
MD5 268e9dd63788c52d1e88058ec026302d
SHA1 1d2e0e5705906397a7056d3709abdf3268b20124
SHA512 6e60e50499529529038ff98fbe1712ac4e30c83fe7848ab7a49e0c5a0373cd3989a273e2970262c11c29679e605dfae76909f0c26d065de8557150c7c8fba826
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH5VQBWG:oUEtQevvqc2W1cpV2tI32EB
TLSH
T1DD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8254c408812a7ea9f71ffd358e54f55f5994b5068ec95ab995f63f7b21d88234
MD5 b982626457e72d9b7ad9f25adc4ad8e8
SHA1 54b5831474921ca7b0f897c0ec8c23f24288eb5f
SHA512 2080eb1b95440f595d4e0dd8f48baf6ee1ddbdf3b44e891bc4ff85bcedec46162d3e6e39defde0b956b01bc4f33997b6a3268ff817e98de3e44545ccaba87835
SSDEEP 49152:HCbRquA/m2yL5zTfFiV+XenmE3/zhDmg27RnWGj:QoquVjnmiD527BWG
TLSH
T108D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 eafcf5642c0be4653a0a98518ed5c98bb9bd29158f8794ea64a9b238aba3eea4
MD5 8327e0877cfc3be53a00cf2d4e24eede
SHA1 854eb0da6dba151d84ae6bfe87fdc4afb93d1a8e
SHA512 cf8a8427f0644af46be73b07e883c59e800f3f7a3e3057de65832efc1757196b337340a281256981db38828fd54a351d853ae9d93bb35ac5483f36d81b7ff1cf
SSDEEP 24576:uAhGL3IFoiwtA5l7S53usqjnhMgeiCl7G0nehbGZpbD:uAMUFoiq5yDmg27RnWGj
TLSH
T155359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8f24518c49ac3472f7a7c721c608ea065ccb7f18969020d6cef5ac0bda1dc376
MD5 fd51f41a556c169e08ba208d6faa53c7
SHA1 6ec6ce8602b1d8764c31c7de494f57a63eb98d12
SHA512 b9ebbe9bced92a4838755a79bf5117852e5ab433ffbde103ba18940d9b5a6d3c1b015cb69e3179de381c1209edbd93bb62cd7488a0aff2569d7965ad7a1eff7d
SSDEEP 12288:xmw5HEjsChNVBFgl0WDm+CSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:swu4OWZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f09f7acf30dac27420ea234a3cc379d64c7a548f81ebaea69a5dcdb2a581858f
MD5 cc0bc29f0d65417a07bf26a0ec7e308f
SHA1 40c85cd22bf6f1611aea153fe73147e35f79ef6e
SHA512 c0a05b80575bc7a7745b51d8cdebc109e13101c6ba99042a3bb314de407355f1cb53a96c2b1d64ba704c8fa0bdb47ce118bccfa06ab919ae49442d0d21d40de5
SSDEEP 12288:FeZ1IytXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wZuksqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F5512AE239820FAE163417CC5E5D609E7337C62673043CF166256AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 845917f9f5ac5555119bdaec0a2fbc437f835611e0373bbc8c8df4908c1c110b
MD5 c3470936dfb768da13d98405d6062716
SHA1 1eb72bcf213bef35987ba920f82da1266fa4bf5e
SHA512 885a0f25bb4efc99b21cdf526a505a1490830be3cf3f066db166caa00215353bf9e7244790ccb010747c372f5078cb48242794db0bb589eb2664c6b6b9b72e17
SSDEEP 98304:jQRQyi36YOcPbLvw2gAf+PN3vD527BWG:yQyiKa/X+PNfVQBWG
TLSH
T181667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a1990f0364997955d26637063cbdb9d58456bdd08d02d015b47ebd9801059812
MD5 479582c0bb0d73102927c892c293d097
SHA1 d10fe07b5bd18cfb65c57268b6aa009d5e7026a0
SHA512 9eb8e8a09641b967c3d925315960276d7a10b7ce2f83f5add365695e52a30cc76c3d778b84d92d869ff0971d62254752c17cc8bdc41d6d0d95c70fe88434f8ea
SSDEEP 98304:dQRQyi36YOcPbLvw2gAf+PN3vD527BWG:UQyiKa/X+PNfVQBWG
TLSH
T11D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bb4948be93ca50d45610e13eb3d9f5cbd87183d016a75e77dd6a747201857dc9
MD5 47c4715a8619f431dbe76ba206363d76
SHA1 04db28a0312826ed0716453982356e18b1486573
SHA512 3aca5af26c809d8740f3ec6046eec3ef5924db6c1a9ea4d74120ebcc6614962c15a5901b109e844b8ec56828954f031869781855fb0d5f6a601635250524b81b
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0UsqjnhMgeiCl7Ge:r68Qg55nhceWu7PNU3/xDmg27RnWGj
TLSH
T197B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f1b3ef4e7c779862589f6856b2643626a54d5927ae3afd81845c2568ea7df1f5
MD5 25d11e64300cde7a42c29a856454c11a
SHA1 b204e75747244a16a3707d90cbc6073a88a53341
SHA512 652744bf46a1849c6a025483fdf036c4c281fddb6f5ef85e9c666bdf7e253cf3a8d470d7a4f680c3787a275c9c76cd74dbb43ab59b6f31062def122d48bbd744
SSDEEP 98304:ey5112gYy5azzVvt69nLKnhZsD527BWG:PLIHEWhaVQBWG
TLSH
T1AC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dacc8eb55a46cab756f3ab4ddc7795715adcc4dbcb3d911811ad3d8b02e31595
MD5 25d0d86836b9b28555473f4b03e15b89
SHA1 ca826670efa9be5437594b0963454bdcab339df0
SHA512 a09687d1c97c4a80faa832b6034084bc0e38a2849447be7cfabda42b8ca8295ae09cb17b3f3c5a9fc453ac3c36fdea46cea94965503fd84efa6986bf9804e4ee
SSDEEP 49152:TB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glXDmg27RnWGj:lu6Jmdxd2dXD527BWG
TLSH
T1CED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0e0333fea740c87e432be5f8493e81adf82106533cca0154c6e4c06d201c2c40
MD5 a3097c3b18e7dafd4bc080ca2b6dfad6
SHA1 b2c5fc407052e8a62d07017d96f8219f40f9547e
SHA512 78f7b376a6ba829334bbc7fbc1e31893e9f46ae0f3935087b15c04c953112ce95364ed26d3c6b1cae62f397c0d7361347cd70306f12ae0af5f98a0825244aed6
SSDEEP 49152:q1hpsNoJpF1A63U44CwH7R4xjDmg27RnWGj:qmifPWRiD527BWG
TLSH
T18CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f907c7cf3409bccc6908f178f0faa21097a8ef4b17aee647f0df2f8203dbbd9b
MD5 b703a40374d6dfd421c85efa3136224a
SHA1 8b77076ec699b48e1e6024174cba01b472e4498d
SHA512 132f9ac448915313da03377c8b717009a8e031b3a9fcc7b786a5ca49efffe8569ad9ca5324adb78967dd01f6320c6f15c3927e44808dad1dbe47182477fa28b0
SSDEEP 49152:4SuZQIY0Be2KcRVtOnks6NMHqADmg27RnWGj:i5dKii61AD527BWG
TLSH
T1CCC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4578f16951f25ac74946d2df88664eafc2c294db58d2d3a53f04021ab1e892e4
MD5 0917323ff7aaab42f8045fef322bdaeb
SHA1 694d3c39f26c4e0add0eab31132f818f71f92b8c
SHA512 c2266a0fa5572e5b502e689c8136ae51b8dda3f81e42e4a11da7bfdb04391af905a5d1d92cd74933158c96ac8c68534cfd3625f1941a4e1d0108946dcdf6c53a
SSDEEP 49152:thtSn8EApI0fig3giDn0AP5wnDmg27RnWGj:8X2imph+D527BWG
TLSH
T1EB95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f56506965e9c82e23901f18342c465b200ba6775ed906e5842e8f3caf6ce873b
MD5 049fa305100d39249338d965541ea29d
SHA1 446cb1b2b778814ec8946fa547d538020cab033f
SHA512 43061e9d03462ead37c96e928fadf43c62c58255f4e295c6ca7d36855c09382cce7ece75b62b104b44b7f2618510f366b77e474735b3698c6d32ba5a9cd24e49
SSDEEP 12288:koXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kosqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BF965C41CBE52248B5C3E5F10DAC073E5BE92004937A677CB9FBB24984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 60122532b65b52537198078571abe895f296a89f2930df477fb68fc685f60ccf
MD5 39b3e6f3844cf1f250026e94212a3908
SHA1 ac9a4e1b1d26e55a37eb498a6e8766ab8328d494
SHA512 aad85a2fd459a71edad0924729eb0d6ffa99c76ca623493a6a6647e5a3e77ff9767b4a10ce7dac8efebf9cee7023822ff15c602c76158336609f4a67f263acb4
SSDEEP 12288:1hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0104a0ce169bc31544d781007736012152388e2d5282401defb47a1c7b76a880
MD5 9db2251bf30439b60e9130cb90470030
SHA1 0d4df1e143725d77c43a6cd6211586c9dc4c51b7
SHA512 2e40ad0ab3d8c4f8fa7016033920c340704eca22f6656c708cded42443c379f8d1547e8d122d62bf55ce10960fecfdfa0e5da4e982ba606a275f91cc1f1897ef
SSDEEP 12288:/3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1524523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 51409a160c411ef2b7f91c112bc51c9c56b2feea334fc33703542c78060cba41
MD5 8bd741907441524ac2926e5589067cfd
SHA1 c635b63b98cb02206a9dfdfbeb0513755da3c473
SHA512 14f0f4a68fd1956a8472d2c6e4c38b3c7312c051b267d3b61cb3445c5697c38b0c39d299f932e70e8d985cfc9ee4c89902bbe5609d137d24bdbe97f05ebcfe9e
SSDEEP 12288:nVOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19745236B675C00CAD83285B5C2F5E11DE8237D56EA3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e262abd4edcba5fbbbe1719b2ae4a1152986d4a3a5551fa603c7d1276a736095
MD5 b0b1d69228a69b39248b7cde646baa70
SHA1 223f452331e390f734905f6294cf692645527fe1
SHA512 337de0800ae16e944e62c61af55d620a9911f0b5af0a4bc3cefe3e0feb145c1090fcc8c4b903eefc95d02f651b9eb304b312d0aa75e87e87102d18ebd272c230
SSDEEP 12288:w2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:w2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BF965C41CBE52608B5C3E5F14DAC073E5BE9200493BA977CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c9dbd37317808dee94b9672b4371fc7f1e1a1fc20d82252e32021ab99241dc48
MD5 9af2335842475414c80af9aa5a96b1ed
SHA1 7412f07fff10b1de6207d5e1131fd7b8cc93ee47
SHA512 cb1ed5add0c66617ab197610fb8c3de7983543e818332d697a5a93a7631cdca2646446f7ed9681858119c451a4e5d4f15b09eaac101fd094d93d5c7cd26fa7e2
SSDEEP 12288:KAVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KAVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 823fa3b1980461818f95b713f141816ec8be857796387f05420e97b260e9c9fb
MD5 0c6f5d1183d1fe34c3374c391ef60917
SHA1 4f5ed441937964f1e47fa1ecd5a8ff688220091a
SHA512 82830abf19b9aa945d5c1b6546da38219c2a31f08be32d2a6a37f69c3c17266aec21a1a08a0c56ae49086f34909a267bff1d1a809141ffb2150ffe62d1e68dfb
SSDEEP 12288:XJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BF965C41CAE52604B5C3E5F11DAC073E5BE9200493BA67BCB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a7b26b50ac497e48c4f36a48f827b142d926ba2d223e27f55c4fdc844da50342
MD5 0b181c5842f4ed6d42f378c2319073f9
SHA1 fc99c10f37d5aaaed9918eda046c39327a7f519e
SHA512 4c65568c5fa035a9741f7a3b44e753dd21be3619507b5c64f17dbdfbd520dfe501b0afb0b33835828386b0c364f26d847398cd9431f13fc312be41706a65d004
SSDEEP 24576:FZMRzFVSOBsqjnhMgeiCl7G0nehbGZpbD:FZMRzfZDmg27RnWGj
TLSH
T16E6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b9866a564f501c07f3e2c7b2a5a0ebccb5d5b3f7c44744c5546133d899cda194
MD5 edeaa3c65f15260f66fdc205348a5f84
SHA1 c3aa74107e5712714486449dca552fd25f1eed8e
SHA512 030a0f6415c96bc5f83e6936604d9a0e32f3c63d847e24578701bfe2246b87ef54b4a4c0f85884ad07dcf8d61470c56577a20f43fc3e07df1cb7689622b8fa89
SSDEEP 12288:m0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:m0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 592013f1500f5560ce29c98937f7dcb49e409c6ee299a085eefb588b5633a36b
MD5 80708e70c913d84c4b79843ebaf72632
SHA1 7169274e70792ca2f2938d745ba97514265ee959
SHA512 60d854cebded652881fc1cee07814c711de9702eec7183c2f009e56babee9e7bf7f24a68def1f8070fbf618f5f88935c30683ae718cd29f7423b7a5614d7c497
SSDEEP 12288:gAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1554523BF965C41CAE52608B5C3E5F11DAC073E5BE9200493BA6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c240a186f68463dc356f4b3d69d04fad966493c9244ba7d8d5647ed53b7f53aa
MD5 1fdb442b38ad7dad4d1288edf068e348
SHA1 3cefe6df773399b3bda5acd461ff1f6dce577fb1
SHA512 95fa9238c6fae1cbaa648c82138ebb2356f19eea586ca90913fbbb431257869656f4e7f0c0b5f25abae9c36bf665212d7536ae4cad1fb822ed60a1af61956fa4
SSDEEP 12288:0yPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tzytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c4e470f6888e89b5cb7097e2f00d64d689a50d84ddc48bb7b7610dc1c610bde0
MD5 0ee59ac73dd8167a5e397927606fb506
SHA1 ee51068fce16568e5f4084c927e8954532603ed3
SHA512 4ac222bb9b672fe37ceba62b1be5e88ab575faf1caf24f14a21ab3ec9f8718311e72229d39fe1d3c4b3b7ec603c3315ac58124db0a9a702ac3fff3cecf36a734
SSDEEP 12288:/0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6563e936222013125e3a9f559fabd24f6975c2a509c3f792d79adea2c4a9a203
MD5 ac5ffdf4d91947079c85e0bc2c809567
SHA1 85aea30b2df1f37613bdd693c0ce50d66b8a30db
SHA512 efdb47f5cb265a5aa98004150584168ce071c2d40d5e059e98163ba25e976c1d76c156cf0a017782e215edcc8c01570946e55bde09512d47e960f8b9e61e14ec
SSDEEP 12288:Z0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Z0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 2f6700ca4dc6eb6cb832e9b8ade1af21efa0fe413155f482b20f3b68342b40ee
MD5 f589962e78b17452dcb5036417f306ae
SHA1 ea9a1b6cfec0842648f6608162cc3c88fe83ca54
SHA512 8ac95f6a58bbb013447f3eba3267e644cdfb77863000297686e67dca5e16da349fde0b9c4415f65702678a5014564b5bb0f0cb94fbfce20959b823f5a2d18710
SSDEEP 12288:xyPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gzytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10055125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 03f5f04f4f58857b5fe5c029bea281d081c7b3732ff89725de7f418bd037c197
MD5 3e97722a5a75c32de3ea9c251a162cc3
SHA1 7a6964f22749681b4d600c7907af0e7463e087f7
SHA512 43df0676adb87b08f50e841e8745ac8e7218647f2bf0265e427ceb75ce08a4577ad3a0cfeae6f28939bcce03db55597e0973f336339945cb4d3ce2eed0f57d5d
SSDEEP 24576:8TDaLl3z0zDnsqjnhMgeiCl7G0nehbGZpbD:8TuLlj2Dmg27RnWGj
TLSH
T11D6501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 49e18abb184ffa656aac4bb754626acac9b60c10347971557d17aea241318742
MD5 7d2660d96c677e5f23287282277d54da
SHA1 34a3090b42f3e40df3c1047259c506cf0ad8a558
SHA512 d7816cc1d61fc42b7ee7891da86ce82e437921ff9fa256790f27f3df07f836c7a2384b16d278e22f857bc629d7b5c214a186687a974ef37636f14eb3cbdd1860
SSDEEP 24576:w3vd9CHKy7GZbsqjnhMgeiCl7G0nehbGZpbD:6vd9CHKyaZDmg27RnWGj
TLSH
T1DB75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4f76a822c733021e698efa7bfaca2604f43d0d815b92e7e121e9e73359721ed1
MD5 089a717be823de214a61a6030f21ea5b
SHA1 cf5131d93af4d6d4c6b3aa0562918a07b4825ad1
SHA512 321004b9156f54d10ca49d9663879ecd4aedcc657d43842e0a1b6b8fc5a83d8db83df55c80083411b7b128e2a37c6ab262b6ade5a5be12cd50ddfba3941df4e9
SSDEEP 12288:ZXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BF965C41CBE52608B5C3E5F14DAC073E5BE9200493BA977CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9771a7e9dd0fbb0382fa2228304de6325dd4a7fa9181c1a55f68936d16a95148
MD5 264a4c5d3c3238722cd079e645360ea5
SHA1 46112c09d9babfcb1c7c477b3613834e7033717c
SHA512 3c0bb0eb344475c3f48459dd11c854ad624937ac77f4dc346e510eada3a58d7db1f2311d5e7139d46989f1c4787fbda32087ae55ad1837fb2a2cb7353ad2d680
SSDEEP 12288:JNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BE965C41CBE52644F5C3E9E10DAC073E5BE92004937B977CBAEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 390b1648a4161ca783e6620f7a316855f2d0c9d631a2fc17f9fed8ff9a5becde
MD5 6a7c7200c018f2ea8bddcc2273b063be
SHA1 42da1dd46961e1af85a296a9da5de1ece6c6802c
SHA512 69d13f57f3c6475e490d64d95e77783d78ccfa725412c895b39d00bd72776bb3809f05781240a310a601ed9e84b83182feb77e19be24d1d39dab2255690ead62
SSDEEP 12288:i6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5848773f4796a2678274415679b1acc1229bda255d2ffeaa59f2bf0496032292
MD5 a20026c969d358a9fe87e0af8b8abb98
SHA1 f89ae854432f153910adec1668877537f850174f
SHA512 3907cf45bdfb1a57e486d35adcd478ae6eb7306ad405b47dd37f811cd80d9e7f0c27fc739d2e48e981a5393ad98244d55dc1b673aeeb4dc3d4e1f6427acf8c01
SSDEEP 12288:2bsfkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dksqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D55011AD29802D9C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

572df8c7396076bf.bin

Path C:\Users\Admin\AppData\Roaming\572df8c7396076bf.bin
Size 12KB
SHA256 b29b38d0374a15821131cd4f364a2453cee3d5e18eff745b9c13efdbd928a4e0
MD5 52333b6578fa0ee6f25579aa181418ed
SHA1 24bd212e3ba12dceee4e4a60420216066d2c46ff
SHA512 978c1d428e298d68d45a840acf0cddefec8d366965fd376f91e78171b318fdefe2ebad6256f9b0e6761b823423fba0a36680b28fbced690c44060088583378d2
SSDEEP 192:COgrS5tK/GFs311L2le8Jb6+n9yVi8Mam5Ty42zhNdSx6gCRGrJ12lcbae1:GrSfKOFs31d2le8Jb6+iVmxyjJS75Zu0
TLSH
T12742B045462295B349EC8C03DE6B8A4877BDF364BF5FD27F2A35B26CB6EC6210A14181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8fd4d53a8c1e278e92e5984f17b91842b62a7dbed2573526c5092804cae1e6a9
MD5 e5792e0a6f7adc4215c869aca20426ae
SHA1 395e58aba034d6feb0f2de774cd685418a543355
SHA512 63bf1eb5d8c8c46089c2e39824048dd12ef158ce66b324af998e04184a0b97dbb40f58bc7d3e358e0a147e9b29bf6c62e70ef1f396895ea5b4b4b36a54971979
SSDEEP 12288:67Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:67sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16445237AD34C518AE57609B482EAF12D681B7E6A9F2004C3B94738FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7a2803cbb51bcb644d903a74534d0624220a7cd24d52b40574f85b82704d6570
MD5 82ee2cbf1a2b7a52135f2d244c7bd204
SHA1 1813d6bb93e693d8098d3880fa10372b52ed6da7
SHA512 b7c0e65a87235b0accd9ec3908a2c856dc98611c05d4dea73e09a73532602e4c7b87616676808e8796901f1d3b1d29df9fde12b7c866822085535d2211a1a273
SSDEEP 24576:w8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCBsqjnhMgeiCl7G0nehbGZpbD:xRZwQCyiHiQEaiPnMEDmg27RnWGj
TLSH
T1BF85B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 6d18badf225ff91026bb91ce519ea3f9af5c16670379d0a4d4c097f7eb6895a1
MD5 27309e820b34aa7159c76461f3a2f4bc
SHA1 8d2c4c89fac875a304a132ae40d7bb98105bf1a4
SHA512 fbafe92680effc4b43f9b682f91b22e6347711ff6e9bb7b66eecdd28bf21a6237570ac13285eaad8b227b866270855f9db23d6144cb0c14371291ea034b6d654
SSDEEP 12288:FbxA1U7KrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FbxA1UGrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C55127E62AC20E5E176953D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 237f1fd7bf560205d7b0c0eb9d446dcde4a2be91349fd9edcab4290a27aef948
MD5 ce787a67d81e645be8f4d324c1810061
SHA1 d4b248e203f07499eb66af980752bb644894af65
SHA512 ac3ea394ac2a7a450c21f6143bd894f7018bc25c394a9f7fb10b9ed79b603a1e2ffb8318d4fd3cbe54444f00fca28957d9c83ddab0f7cfaa9ec9f40e46de84a6
SSDEEP 24576:CjsmP0yHaqrVqHra44KDzMsrnKsqjnhMgeiCl7G0nehbGZpbD:CjRP0yHfVqzlAsrneDmg27RnWGj
TLSH
T17345AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0a3c93d8c78253b4a90633f5c0dec0af1678332cb211a25beff52364bd9e868b
MD5 b2aa56813afade5ec5543b0102d1b11a
SHA1 3b4bb96a818f94065192f6caf9f5288914174790
SHA512 241b0b27a6f26c3f33dd0eb1e779286fc5af26b6eafab7b2152be40821720346c2b739ff5abf71924381fe74babaa109e493b7eac9c5d24f386b47feeef4e6e4
SSDEEP 12288:o5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:o5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BE924C51CAE93649B5C3E5E11DA8073E269B2004D379677CFEEBB54E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 a9a9983960b0df6a9f1ae01ab3056e5fa4355cde2e40ec6e1522cadbfa88a543
MD5 de54160d89e9cbba9192c8b030562dd1
SHA1 3d52a95e9ce97f0d35ced8b02de432ab5174b215
SHA512 e656aa8034282d095c901a50c93cd933a5536320c3cd0510750380e680314e1e3f3a3c9f63929627ad7fedbfadc77b311b995c128e1b131f8279576f315741b1
SSDEEP 12288:5ObfA4LWO+vAYFTvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ubLBUTvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T138750159E7A800F9E87B813CC5A2D616E672785D0720E7DF03A94A691F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 648950acb765cbc3bd427d2dbf5ad357f84484aac7b69571bd611b7c18a86f61
MD5 00fe5d02024c4163c7d2e2d35aad8c30
SHA1 9d36e2f9cb2d0befffdc7f842e532abefe5a19e0
SHA512 2d4647c1b0bdf18360a5af0bfd990a72cb294c3ce99aa054e406c285c7cc6cfc49e4b2cee2bcc1fd3f5495f65a6447c9ea506a3370ffbe6c6d5b527a61827de8
SSDEEP 12288:K70Vm9IYNvUyBpcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:7pYNHOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E665E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 07a2e5ba3d76411a510fc767b460da11ed0ef6681ba5e5a32a228b9a31c1d3f7
MD5 c5d57b9a19cb64cbb17a15d0c8324e89
SHA1 ce7a97600df31aa2cf7dab9b46d4320b6bd99349
SHA512 de4bd30b2fc1fcaf3c2dcb83b2bc4e97619ae308662d270e881ad98f2a87a32d5a0db905d632a2df02f25227687d41fd291758a8513cfd402f2f7c9d7b73a2f7
SSDEEP 24576:anXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKy:anXoJJYH84VVS6AmEOJas+cHBjSSKHPs
TLSH
T15165BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4e59dee3f0b250720465045488741bb8ec3cea5eba579528c641235e50f8eae6
MD5 e6b26bc0a16fda39d7a10da2a627fd6b
SHA1 7bb7c896930e1b27a4df67928d6d026242d6a858
SHA512 a2ece600b086a1d80ea4cca60c597a21ef98b6bb64e26cde0e748562b7ffe84266990efae46ec829d921951645b79180c7f9f1edfdb8673320620d8174982e64
SSDEEP 24576:3v7Xbxd9Tuycf8M/TYlSuxrr2PC0sqjnhMgeiCl7G0nehbGZpbD:3DLL9TuJ0M/TYj2PdDmg27RnWGj
TLSH
T1E9858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 2430129b9df39f4b34cc2c228f2deeaf6d73174a8b4de298b479cfb18a6a219d
MD5 076a55005909d389e9ba5aa6f2381488
SHA1 fa72cf8acb199b641c5098cb8114bc509b1fb6cb
SHA512 0997472dc3882cb3f2455c43b8fb44a13985ba5284c8c48b1f2990c2bcb32ec94e3fef4edc09a4b0466aedc4707514fe575bc2061a9b0829cde099157ec9f9a2
SSDEEP 24576:pegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wvsqjnhMgeiCl7G0nehbGZpbD:pngOJOmPOHzTDmg27RnWGj
TLSH
T13E55CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 94ca950ad15ae7376adfea2449db70ccd91bb9c0f77096d7f89b10ad16778fd7
MD5 03f0eb641aa489f24a7d972c63d85c5e
SHA1 1e96def53ddcaafbd6a1ffbd914b4e05acc8386d
SHA512 503408310df893957d0eda8ed11fa34dda1b83af81ffbb8deae049125d5545c2b2fc8d962f9f9bc61f9d024f32eb6170bfcb51f66a11c9ef0ca71eb3b82be1a7
SSDEEP 24576:3LJnJiTk3R3waE4JrOZsqjnhMgeiCl7G0nehbGZpbD:3LJnJK8R304luDmg27RnWGj
TLSH
T19775E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f171df53eea42bac59a86592a0d326c4e54eec77342cd27bb37cd41386b63f6c
MD5 42b044486f4551dc72036aee9d83d7c8
SHA1 b28c45e971a334a9d45b8ceac3bff9857be9a594
SHA512 c95590ee29d100e10ada50095ccf93f7dcaaee662c6c4179df5aee043ef74c5949b4b6bed683750817666296f1ae66ca369d465468c261e717ac9d2c0e8e6277
SSDEEP 49152:s9mqCzDScAZmlvTcFg8Ph6ZDmg27RnWGj:OCD527BWG
TLSH
T100955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ce96baab4da27fb59586c909bc07f6d7d691bea1c1b35edbb9b35066e1f0e82d
MD5 e6ab09363bb9fcb3e486e3030dcc65fd
SHA1 fe55256dcca1fe79daa0bd4fc6c5806e33f7edc1
SHA512 115bbd77c9435eda0e72b8004c38eb990f30ce412d19c4d8b957a1a18f05062b8b0c6f967ff8c936b0f29acbcaede98a6dba21b3894bae8281db667d2fb35336
SSDEEP 24576:hlYJeXm5jUuE9sqjnhMgeiCl7G0nehbGZpbD:hlYJeXmRUuEhDmg27RnWGj
TLSH
T1E655126E669C30E5E13A8079C2E2C508E633B876671017EF55E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 f0eed3c92086d12a9295fdc11d23933073a4f47cd36e6418560011b48dc24643
MD5 d14da1ee90d002038e771bb9ee5d97e2
SHA1 3403f69ce6947c16934d3c68cfa3806e87f2f8be
SHA512 912d016d579c93db7429e4ab298fc0736d8eb9453e144d6988425efffbea2a142d6328727fa2d1295ab32194d1a70d664646b50ef245acf967f9aa1e7979614f
SSDEEP 12288:rmu6kyqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r7tyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F4552219639860D9EA760578C6B3C158DD367C219F2002DF65E2FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 899588f3be9608e0f9cc1b26b1480d52c6ec975c580dce681a1f8b2afa6d3ac9
MD5 2dd81a386de11549f99f25d1792d889c
SHA1 5664de0e187ebfa8c428789de551d3fbc820942e
SHA512 e5587d22176f1c3693de2858c8f94fad83f8ed35fe5c1167be731fce2a0c6b29569f50f7a0a48ad9021f6f78f03c1ca30eb048de7087ab0e11adf9d3f1ca2ae8
SSDEEP 12288:rPvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1494523BE525C61CAD92204B4C2A5E10DA8173E36AB2014E779E3FCBDEBB54D44B38C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 45b0490965452520cfc2a88a1474eb1298e285059dbcaddb4773bdbb5c42448d
MD5 aaabb39bd1f73b3e5b9fa69932f2f477
SHA1 3e69a7c42e448eae6e169c244eb25cbf04e92009
SHA512 ca839f42288a4bb99f54c443bcda3bd48acf8a9a692a6ad02e5050ae3089ee9f8740ff3924144313b1bbe8b4c8e5d0fffe310701c31a1ca05805892660945935
SSDEEP 24576:nC+TyQIu93VAumZr7jmwsqjnhMgeiCl7G0nehbGZpbD:n/TfIq+YsDmg27RnWGj
TLSH
T1A4558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a949867bde4e91cbbb4ebdc1c05b7653ff9f1163e9899f82af67ee7256145440
MD5 a8e04eaeccb5d85ae6bd2d65854f78e7
SHA1 4f7fe3bcfa85d4cffae772fdabba132a02303a24
SHA512 fc7dac60e5ed4cf10dffaf198a688a7a6409e944a10847719526c2629dd8c8cd7086f6e9be92bbf3101bea3251e495b25246400f48e896a9497479ba96405562
SSDEEP 12288:FcyrWOstaa3kcszXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:wLQikZzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF65F11FB3AE0095E0A7817CC8858116FA737835571167DF02A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 dd16e3684dd6a77c5d4db7b793543148daf1790203ae7ebb6c7d0097eacb79f3
MD5 43ea563b1dcdbeff7ce94adec4504942
SHA1 7d304296a80a117fe76270afef64234a04e34c27
SHA512 81e700c377581ae997411982ba59a85d12e8d83da3214e6943a9d3d496fce604651d44bc4281dfbbe5c5a48ed2d9c6b7c3a51a4bba69b4dec779ff132f6181a0
SSDEEP 49152:4pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP+Dmg27RnWm:JpC7b4+80GTkRD527BWG
TLSH
T138A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-316-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/244-325-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/244-523-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/244-522-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/244-520-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/244-322-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/468-360-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/468-542-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/468-358-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/468-352-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1320-519-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1320-312-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1320-309-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1320-303-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1792-75-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1792-89-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1792-78-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1792-73-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/1792-67-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2208-273-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2208-280-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2208-517-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2208-274-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2720-268-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Download

memory/2720-261-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2720-283-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Download

memory/2720-286-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2720-262-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Download

memory/3092-528-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-531-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-537-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-538-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-536-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-535-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-526-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-534-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-533-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-539-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-525-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-527-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-530-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-532-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3092-529-0x000002EDC3D40000-0x000002EDC3D50000-memory.dmp

Download

memory/3308-26-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3308-34-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/3308-52-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/3308-53-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3308-35-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3368-242-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3368-56-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3368-62-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3368-65-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3380-380-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3380-507-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3380-374-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3380-383-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3592-213-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3592-19-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3592-13-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3592-21-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3592-20-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3784-81-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3784-90-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3784-87-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3784-243-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4408-427-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4408-473-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4408-433-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4408-511-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4408-594-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4408-489-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4408-505-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4464-524-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4464-337-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4464-328-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4464-334-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4572-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4620-386-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4620-392-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4620-513-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4832-347-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4832-345-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4832-541-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4888-416-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4888-593-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4888-510-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4888-422-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4956-369-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4956-512-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5012-509-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5012-412-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5012-406-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5444-0-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5444-9-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5444-24-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5444-36-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/5444-8-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/5536-396-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5536-508-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5536-402-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5804-241-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5804-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5804-40-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5804-46-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5988-288-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5988-294-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5988-518-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/5988-311-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/6136-250-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6136-257-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6136-516-0x0000000140000000-0x00000001401E9000-memory.dmp

Download