b434feab8abeaeacd7da6b5ca8f994d2ecdda71ce85ee22224c42a947fa5cf15

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_b131806a7eabd3ccb24f5acfd3524fd6_icedid_luca-stealer_njrat_stealc.exe
Size 1.3MB
Sample260604-tnmbjsbt3k
SHA256 b434feab8abeaeacd7da6b5ca8f994d2ecdda71ce85ee22224c42a947fa5cf15
MD5 b131806a7eabd3ccb24f5acfd3524fd6
SHA1 757d6970b1017c3da112c2ab296e72eeaab5275d
SHA512 d8dc1d4afffeceb9e582a774374b8539b9491f4b2ac2b394566794baeacf12e0e4067b91544d54e6cd33c09768f45eb7559ec53e18e3f4ab983f21b1156128c9
SSDEEP 24576:x0z8pmC0Fxlc+3nGpl7+1WKe7wxtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:xJpbU87OWK3tdnYz5d6JgCg
TLSH
T1EB55C01A9BE801FCE0FBD575CE915917EBB7780A07B1969F039049AA0F376608F39712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5568	alg.exe
392	DiagnosticsHub.StandardCollector.Service.exe
1796	fxssvc.exe
5388	elevation_service.exe
3372	elevation_service.exe
5396	maintenanceservice.exe
5076	OSE.EXE
2176	msdtc.exe
5140	PerceptionSimulationService.exe
4040	perfhost.exe
1312	locator.exe
2224	SensorDataService.exe
5520	snmptrap.exe
1924	spectrum.exe
2588	ssh-agent.exe
3004	TieringEngineService.exe
220	AgentService.exe
5200	vds.exe
3336	vssvc.exe
5836	wbengine.exe
2328	WmiApSrv.exe
3592	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_b131806a7eabd3ccb24f5acfd3524fd6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_b131806a7eabd3ccb24f5acfd3524fd6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_b131806a7eabd3ccb24f5acfd3524fd6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_b131806a7eabd3ccb24f5acfd3524fd6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_b131806a7eabd3ccb24f5acfd3524fd6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9a4a44aeee2c9d24.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5841c263df4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fce87263df4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b344c263df4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089465f263df4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
392	DiagnosticsHub.StandardCollector.Service.exe
392	DiagnosticsHub.StandardCollector.Service.exe
392	DiagnosticsHub.StandardCollector.Service.exe
392	DiagnosticsHub.StandardCollector.Service.exe
392	DiagnosticsHub.StandardCollector.Service.exe
392	DiagnosticsHub.StandardCollector.Service.exe
5388	elevation_service.exe
5388	elevation_service.exe
5388	elevation_service.exe
5388	elevation_service.exe
5388	elevation_service.exe
5388	elevation_service.exe
5388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4616	2026-06-04_b131806a7eabd3ccb24f5acfd3524fd6_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	1796	fxssvc.exe
Token: SeDebugPrivilege	392	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	5388	elevation_service.exe
Token: SeRestorePrivilege	3004	TieringEngineService.exe
Token: SeManageVolumePrivilege	3004	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	220	AgentService.exe
Token: SeBackupPrivilege	3336	vssvc.exe
Token: SeRestorePrivilege	3336	vssvc.exe
Token: SeAuditPrivilege	3336	vssvc.exe
Token: SeBackupPrivilege	5836	wbengine.exe
Token: SeRestorePrivilege	5836	wbengine.exe
Token: SeSecurityPrivilege	5836	wbengine.exe
Token: 33	3592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3592	SearchIndexer.exe
Token: SeDebugPrivilege	5388	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4804	3592	SearchIndexer.exe	105
PID 3592 wrote to memory of 3316	3592	SearchIndexer.exe	106
PID 3592 wrote to memory of 3968	3592	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_b131806a7eabd3ccb24f5acfd3524fd6_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_b131806a7eabd3ccb24f5acfd3524fd6_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5568

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2456

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5396

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2176

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4040

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1312

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2224

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5520

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1924

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1784

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2328

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4804
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2964 2960 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3316
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2784 2920 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 00fed5df381d52ab590629c2a28d797a943fcd3be0abe00d8020496cd9ae7721
MD5 db9ea53549765b103294e12c6192f9bc
SHA1 0e7ed5222c2fb53897ac83f94d878756f8f74ccf
SHA512 5f05f94724c0327bc6a426cf5856aee5feab42e5964961f0a6baeedefa9858a007125aed55ec145c211a7a579ff39f16acf31f01870617e97240af4b784754ac
SSDEEP 49152:Db+632BuPkFKRrdE6ohdstBhuXjfS4LWxn5tdnYz5d6JgCg:h3q6mjBxz50GC
TLSH
T1E6D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7380153d089705d9e490fd5bba1935a3881369fb6d581de3506a248231be6bff
MD5 efd5e5a1354360c96e91b95ad755951c
SHA1 866766cc6e40725f82d7d7d602aae04d90075a90
SHA512 32067948c8a8a501e61bf153916a41ef093b710b45d88d85f2b5295ade5d6841679133569c60cde422fd32ae5e30c8fe9a71317e5879c8613c6305d5ada216c9
SSDEEP 24576:BXYfDtczA2tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:Etc3tdnYz5d6JgCg
TLSH
T18365016973E408F9ED6B8178CC62C501EA737C5547A0E6DB03E4AA254F336C85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 346bca83ebe85c6ac85a8f1a13ad57f6230a4dc3eaf139ac95d717888f8b6001
MD5 41ab6cf0c5ecade25e6d310417410f8d
SHA1 4a81891e68a7f75549580981f1a80240cdc74b07
SHA512 fe7a486e21e520dfbd9d19ca4c9c761a478e6cf32cd344ce04aa12872c39d4d1ff82eb1df651aeb5b50baf81db79ec98f6a9a9427b7230076d38894702f595a6
SSDEEP 24576:r0Le5ji0hmxQrMRtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:rPji0A6AtdnYz5d6JgCg
TLSH
T1DE85AE56F6748331D073C0B9C5D2A68EED7234825B3089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2732ab01eaefd36863b7c48795dd97a33cac09c00008b29d1cd5e34117234bea
MD5 fc4009e5d6bae29a68dfa7036169ee78
SHA1 bc8e554968565ce7e4317cb8e0fa466d4807a61d
SHA512 5907a0c3129fca678ea6a778f2e299a393af13059ba08ed836a581c4429011852b210c882d7365fe2da9b6eeb399c328d29bca3f74284b2c15a4f3b0494d6b17
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWj6q8wyuHtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:W/ezSC6vUzPv+Hjy0tdnYz5d6JgCg
TLSH
T126756C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5c5a3390dba711e2ac4e5c27d1f30ecfe7d60d6069428231afd1e74a2c7373ca
MD5 5f199c482560e12327ceb62489f9245a
SHA1 829dbcc1fc91ad1382803e07467eaf53ef09e173
SHA512 fbbb5e0b352d7e2563c88caee7283133de7932aca7b4e4bd6fe19ed2b655e0ceeb570101dc64b71e251758bd0e1da117df68eb0688bd7fd713fe46253ce5e0ad
SSDEEP 24576:sVbqPb88hv/l+BStdykir8q0Hsw47opM6g9+JVuOUj7Cg8:sVO88hXl+gtdnYz5d6JgCg
TLSH
T1AE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E77BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d19041dc9e419519ac479c14b777755b64c0ff61554cab4ac199dd1393cc9e30
MD5 7f5ba4f0e2220e3af82cf625d61a6929
SHA1 3a5d01dbfda2ca9179c4ba36b8c510513d93a7a9
SHA512 cdd1d7bdef1d1fd16a2260e9edd5af384365ce4b70947493f7837e31d79866dcf822db8fc62d99b913fc70b1496757305fa3899cffda1be58bd58a12b6295be1
SSDEEP 24576:rIttdykir8q0Hsw47opM6g9+JVuOUj7Cg8:CtdnYz5d6JgCg
TLSH
T1614523D3A65C54B5DBFF45B1980ACE04665E6F5988EA88B7E2643659887CCC0C338F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ddbc804d741e526ee98b8ff79cff7332af2645567fe1588b1310e8dcb4189a04
MD5 1eeea8c9d87f7672dd503b64dce1b2d4
SHA1 2555b4f5f0984a0f08cc4dacfc53325afeab965d
SHA512 13631f7acb7f3e7fcef78a61b98424a83eb4264ffb3e3600613ddff33101b4ae658b7b49957f56170adb57b278030dd07b3868f533fc7c60069f20dab4304221
SSDEEP 24576:7JIUqtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:7JIUqtdnYz5d6JgCg
TLSH
T15365CF7BEE28FCE2C27E8DB95A51C600A77678304F6293CBE164920EDE235D04E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b62d2feb68569834cd1e55e7fb12c954fc1ed769d205a862c880655ec91ac63b
MD5 5fa2c5ab2073a2a8f90b14a4b634ff86
SHA1 bd534d0de8d9d45053635d6b2c58e9922591ff30
SHA512 51325703c8a929dfd69eeff9ff807aac5ff56898bbc15830dd8aba7dd79fa4d3c479e0f7a2c74db3f393c36222ab058f75b07c73fb83f874aa9c8d679dd4dc19
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THb:mQvGAdlCEL8c/WRNw5CAz50GC
TLSH
T17A266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 cf6186667ae41f2cbec763dff26a04e853c34a39ec95ebce6e6f7456adede16c
MD5 00a6a18c8cbd2a9b90e4d36dd48fb416
SHA1 560b24f26836e1a2194c32d7921ed8909c7e8141
SHA512 40977a142bf0eb33c7a96b1b58d9efb03484aa860eed66eccb26c434bb1c43fd86a03828411fd16cd7b101bbe18a30ff30d2288a71021d62007240c9d966759d
SSDEEP 24576:YEewsAjQtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:JljQtdnYz5d6JgCg
TLSH
T13775E071FA74E036C6BF0DB21B26C716146D7E204FA219C3E3A85E9D59346C22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2f226c06a0b6c4e2b165406c8b2d237dc16f79f1a1f660244c41f32c508700b1
MD5 bebefc18ec55725cf278345921774d79
SHA1 c9e3b8d62583037cc122e8d62058f1dc5e32a2c3
SHA512 cd8333b2d49a33b68da7581f37a751866fa818d31b944a120d7d93798d260a3a70945257ea10efa7743e964e413992810e846da92261a68bef3af98b34a04030
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHn50:+UEtQevvqc2W1cpV20I32n
TLSH
T1EB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 654c200f742ecc4758fee433c2775a2909cdc5f9bf1b540071fd989e937faa88
MD5 5e6169473ccc6cb376c3e3c1b08659c4
SHA1 c716a007ab37a6402da8e02d9abe3f739158a4c1
SHA512 337f9f53200520987bbe43f33965102c51a27358a5a0d5488862fc44fdec1d14fa8733f07daab5c2be058a3255d0c55d84cfe27b92b657f2ffa8add4373539f8
SSDEEP 49152:GCbRquA/m2yL5zLfFiV+XenmE3/zwtdnYz5d6JgCg:roq2VjnmUz50GC
TLSH
T143D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 976f5c4bfb413ae17b2d72377df109988a8f4164e46b39a2a30f211ded2cb6be
MD5 809c187099de211dcd0af3a2227c4ed2
SHA1 8ae5a1e3944a07e9e734ebe2bd8f83e604b2ba13
SHA512 52328ad2a2f36f7b68bf6f215b4fcc71b39d9cce8c9303b504681b502712d6d47fe190abf630df591272e04f5050e5eca04c4e002b467be9d79cccf940e89249
SSDEEP 24576:iAhGL6IFoiwtA5l7S53btdykir8q0Hsw47opM6g9+JVuOUj7Cg8:iAM5Foiq5LtdnYz5d6JgCg
TLSH
T1AB359D81E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4c78cca66a79cc38ec540064a629b8d2f6aca2efa7fdfbb6cd06a32782e80a72
MD5 bad7de4af0d85f186137b315e9942e70
SHA1 fc68b233b3a60aeb98354af5ed85745dd1c04ae1
SHA512 86be70208bd7fa750a35265603d17da434ac6a48c761d810d344586788a111c73ef28fab93e30b6e0e8be9c67ebe4075ffa5b361c3de59fa22cc9bcadc298f62
SSDEEP 24576:Uwu7OWUtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:UwoOftdnYz5d6JgCg
TLSH
T11565F18672A80CF9E9A78239C547C535F7F6BC022A65CB2F5360C65B5F37250AE2DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6f8abf8486a71ab696840acf17ab97190855112f5978a3e208840c106e8f883f
MD5 44b407e7837b5e92b0fdd26ddebdd965
SHA1 40ddd26d40685b76fb7ce758f05b0d34314bc3a0
SHA512 50a88c9b3a7a5e61620daeb8c321513c0b9275ffcf7294e0c1b1965c2ccb632882e20536a7508c15ddea6359895dfd9cf40cab4702b8086c2b63856ba7d1b803
SSDEEP 24576:tZuJtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:mtdnYz5d6JgCg
TLSH
T1CF5512C633E820F9D5B78278CC958A04E7B67C5657B683DF226422695E37EC04E38B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7bdde19fb3d495eb36e622b76ae8afde6074232fd6b884b6d6ac5f96fe98f344
MD5 b5bb70130e35863884fae76e6fa8d5c7
SHA1 8f74b5204563ed5d0ee3fb7a449b0826011cba04
SHA512 79f2588ed8923dfd2f5377500639563730c638812691b6093d41ffcf75156c31822301d7c555e702f59c3ac37039a30fd05bda0da088e1cfc07730a286520c95
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uf:uQRQyi36YOcPDLvw2gAf+PN3dz50GC
TLSH
T15C667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 917e1c5102875dfb8d29623a95efa58837bf5bcda526eb72bfb2d9b363b9a980
MD5 614fe3b1e04614ae23d4affa4385a1d3
SHA1 4dda68402331d54bed581be021cb79eeaf6d87da
SHA512 64da935639ffbb52a53cbc9c349cf81e535b6c20733868c32c00aed731b344592367b7e87acccefdf50156dc5e7f835bfddd45846e50c5db8aca8eac8e8c4250
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uf:vQRQyi36YOcPDLvw2gAf+PN3dz50GC
TLSH
T125667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 634ad9e648b946633819b24c7592258b43abd7c5909c0592a3ba43a84211c792
MD5 528b46cdb5852870ef1e66f2b3eceeef
SHA1 20eacab19a2a91a2d85f07cd9a8581d330013d11
SHA512 1f2c7e3c2a5762ee1b1a673ebf064f0af6c7d101beb7532649122fc046cc82bb7dd2b781add925ea9dde4dcb42680cffcefeaae2f3a7089c7f2a29f3d3ac5cfd
SSDEEP 49152:668Qg55nhkeWu7PNU3/AtdnYz5d6JgCg:othTRc/Lz50GC
TLSH
T11DB55933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ac21f8e2067901fe9d49fb81bd0b0be84e35abe2da6e10033ca59f5d4f84481e
MD5 e83529d8c1b02f07eeca64d0e6a2fb9a
SHA1 004329b615a51f5883724a3b44c0b135a519f05c
SHA512 ac0739060449f940b1ea6f9d7b1000c605bebc7632f2fa758a9f2325f5ad3392bef5e846d672ba6d2b53a39e2fca8c89ef41f90025750206e5b2dd990a2333ad
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99V:Cy5112gYy5azzVvU69nLKnhZKz50GC
TLSH
T101167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a74a608e41f5ab75813f9af2381ed5e92e5dfbbc9c48aed71bcc8e2ab4db99b4
MD5 e0ba9b24ad100811fa8ad6e74cabf074
SHA1 deee15a5ad435240e50ba96ff913c905c4a5b083
SHA512 c35e4357c0ae5b3767f858cadecf672d31df1bbfe580a486c614c082a51edbf236513a0f38082cd300bfff52876683ed828b7d719363995757b151783b2ef7a4
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glmtdnYz5d6JgCg:mu6JmIxd2dlz50GC
TLSH
T1D2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6d977886f8cf188222958ad59ec8187de68680e35f0bc7aff839c920199244c1
MD5 6d2135f868dd649357cc4cedaf1d7962
SHA1 b7284d0353eb9d405ad90240787c128721a9a3e2
SHA512 ec27e42b6071c17428d8146cef7ff0a76b468cd703c03215b5c68416ae2cc47c424ee6f9ba765bb20cc84cb422ea567de3a08cf9a3104fb357e94196a08dccbf
SSDEEP 49152:I1hpsNoJpF1A67U44CwH7R4xKtdnYz5d6JgCg:ImifPqRUz50GC
TLSH
T177B5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5d65862b1bef1e4fc27c24e128456e099bf33a8dba888d7c8c6824c6142b826a
MD5 0e941ef210a6a9948c07bf6cebdeac2f
SHA1 5e69fd80001371900173138487732f723a1c08fa
SHA512 fe2a42f3673934cb4b6446c81ad2390f53549ba21f16180aa6335998f9234241a122df7d6ab6e212c9ac40a5e0b0a42d37f3d38603cecfd4b7fb6bfc144d8f7a
SSDEEP 49152:ySuZQIY0Be2KkRVtOnks6NMHqJtdnYz5d6JgCg:s5dKqi61Gz50GC
TLSH
T1A7C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fd0124767a8db4002c0858ce91f73e39f66c1555d3c2a6413a9c2111f4a3030b
MD5 d456e1579b8426416a634dba8588d32f
SHA1 87d5af1da1b1c8d157032801d95337852c5d9dbe
SHA512 660b8e17d260c59582b5ae0749879183a31ffc00b3a384faa0117ba7f21a3f8f10c696fa4f75a989ad411a482be0fe04162cdb5886c921cd63df4d87efc6e703
SSDEEP 49152:ChtSn8EApI0figjgiDn0AP5w2tdnYz5d6JgCg:jX2iWph4z50GC
TLSH
T11A95BF13F2D900E8D06ED174C7468632E962BC160B39A6EF0A90B7561E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 96520eb6926957a85f4ee9254bd0c5ccec02085480baf6775a4a8f1763604aca
MD5 0165ec3c9f93076ac19dd5d68bca4daa
SHA1 6d2ba2b357a3554d56242dc023f63e602a75b5b1
SHA512 a4e9170dcb1ff6cc14b227c05af39923146231ecb245733b94eb3cf241222f2894fd06fab5eaa6b7d583aae62a6866137201cd3c66ceda72424c6825f81f77f5
SSDEEP 24576:XFtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:VtdnYz5d6JgCg
TLSH
T1904523D3B59D44AAD9BF85F1C80A8A44658D6F5BD8EB84B7F39832158879DC00338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 159a05c04d541e4e251455fd86fae2089edac81966a8916f778c353a2d87673e
MD5 97fb205e115e9515118809179bf56414
SHA1 909fe0c24c37eccfdf2a81ccc3230ec5a8b318dc
SHA512 67609be765ffdd06ebcd30c51d9e3691402b2bdfe5e3e59fc17ca65e3cb577ed91ab9de8b34cd956aa8f8f229cc99b53f2dbfcd3acfc66cacb42da08df0a8758
SSDEEP 24576:e8tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ntdnYz5d6JgCg
TLSH
T1A44523D3B5AD44AAD9BF81B1C80ACA44659D6F5BD8EB84F7B39831158879DC00338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d54ac03e1032844f2c996f29af54aa53565d3b673c0dc756ee0525495d6328f2
MD5 dae685ab20f9ada4749deb5420da0cd5
SHA1 88797997679e7d766912e5602f6d7af4dc6fe350
SHA512 ce1fb6ce61fc1baff3e66aaf28412ad9b58a0233bfa5738a77f1f3d7fb136f811ddf9554130f5ad49be8ca9538f182d5d2b1f5ca4ebdd08da869076d00af07d8
SSDEEP 24576:4Ctdykir8q0Hsw47opM6g9+JVuOUj7Cg8:/tdnYz5d6JgCg
TLSH
T1A94523D3B5AD44AAD9BF85B1C80A8A44659D6F5BD8EB84F7F39831148879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a2a0b7ada6203941440afbc7a11402d6d83fdd16576af0e97ce44ac1021f6f6a
MD5 e1f7f5872425c05add8c3236a0c7b96d
SHA1 23bee8703f8e4782df19e98a4594334d25af43ac
SHA512 3bab6daadda285bc0f36adc9e04d5ebb5d8b285fb951af9dd58f35337cd9619876e74c1ce6e054c07bb464038671eef2a8457b86b3a2bca5974fbcd71c3970a9
SSDEEP 24576:Utdykir8q0Hsw47opM6g9+JVuOUj7Cg8:UtdnYz5d6JgCg
TLSH
T1F95523D377AD40E5D9BBC2B1C8168A04E6ADBD5ADAB684FFE35035194C75AC04238F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 109baf6c21f5fa217d003099b241ae75e20b3fc52c62c6f949e8c6b7a06511da
MD5 7a2e0173b734a17b22de9981984d7f31
SHA1 aae56bc71bdf77c4c4d9ccc0a944cd6e1cbc765d
SHA512 fb9f34531c960b9a9076cdcc94f9ee2e3f4d926bae05f3aca0c41e04835aecb34181ed78cf7f680d381301d231ce7b770b3ad21820f6c1417360dcd3cb3167f5
SSDEEP 24576:yDtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:KtdnYz5d6JgCg
TLSH
T1D74523D3B5AD44AAD9BF81F1C8068A44659D6F5BD8EB84F7F39832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 56f7e3961ea0b8fc7f721e16437a84aab7f115e56b5ac65ac3264adf639c68c3
MD5 343abe4fe3511837e87c21329c51d717
SHA1 2340caf073e9a2fc552651750e55c47794256956
SHA512 6e225075fa801e2991442e2e6007dd80499ab5a0706dda4e930cbecb0867419142d5ad4480c59e84be882137527e7dfde3e588adf40b530c2c44b0fd3e4bd60f
SSDEEP 24576:dItdykir8q0Hsw47opM6g9+JVuOUj7Cg8:KtdnYz5d6JgCg
TLSH
T1184523D3B5AD44BAD9BF81B1C8068A44659D6F5BD8EB80F7B39832158879DC04338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e282743f813013f19ad38308d63fbf271c675766507301345ae71ec51c4c2975
MD5 041d84a0bb963d7449c8693e43439ea0
SHA1 9074aa52de6ec93d754d48be2ccda946814888db
SHA512 4897997a30de7d1308d2435a2604dc04cf73c3673eb18c0047257683ba2fc2197301103c4b02f5810133bee9bcd49d3663f25d8e64346210819aa2be4c4d0054
SSDEEP 24576:WEtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ntdnYz5d6JgCg
TLSH
T1344523D3B59D44AADABF81F1C90A8A44658D6F5BD8FB80B7F35832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 42b21e55a63f8628570220ce2afc2e5c504e5e1ef21a9f865deeafeead09d173
MD5 19f0952190fc59613dd4208b10a02fcb
SHA1 aae05b27e566cf94abd5b69ebb8f69606e2c4c56
SHA512 a525ad479275dba3eb0153449fd4a8d654c9642edcc8eec91d92fc8daec057ed843ee460a586b893e9f71ec5fa16904595edb2d7e9099bd473dcfeb1abc01aaf
SSDEEP 24576:LZMxzFVSOctdykir8q0Hsw47opM6g9+JVuOUj7Cg8:LZMxzfYtdnYz5d6JgCg
TLSH
T1E7650195B39418F8ECB7823ACD158905D6B27C5A4BB0C56F13A4362A5F337900D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c65e4a573aca8c07cbefedbb361f2c70784b7f7b1b72e272ec6f92654f4e0f47
MD5 6ef266ad7f3a0904956d9b4e02996ed2
SHA1 78dd43fdb93c5799831b0fbcd61c2b6195f3c9c2
SHA512 bb6d3317b6c700296c29dfa94ed9af542642acb17de42c8dadcf5032b6de2cfa9344ea569581109f73d1041e2fff40c7bb64f15d394baabace32c45ec73a4791
SSDEEP 24576:iZtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:UtdnYz5d6JgCg
TLSH
T1B74523D3B5AD44A9D9BF81B1C9068A44659D6F5BE8EB84F7F3983214887DDC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6c2e205ddf96c6abb58c6403123d4015f0cbbd1c9db7c830adaba7077c3a51e2
MD5 bb11510f10c8e242443dbfaa82c750bb
SHA1 e9815cef4599323daef54158f2fcf11863361c07
SHA512 2f2f2bd1938f260a038ed2c9c8a211f17bc9b210a9fb67134d3cfd56d3a7d60bbd1842f553217d3b69ba725127c345e152a6d8390e5f6d516a1f6a8a0f44670e
SSDEEP 24576:k9tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:KtdnYz5d6JgCg
TLSH
T1774523D3B5AD44A9DABF81B1C9068A44659D6F5BE8EB80F7F35832158879DC00338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 035758f6d080a95c3d292617647fddf4bfc08d16a5e3628bb9f6b5a9d88aa87f
MD5 16a483fefea0eb2f9a281687dec28242
SHA1 5f3ec0ce96be2c2bf6e2c40452a5c8c87ad86bd1
SHA512 67945af556e906ff2f9e30bb66bd080778fe7de1cf96bca720f7a599b761a9e5276cc82e4f08d30e5b6710866fc89e899617d5d9f2236ae070ede49f3cf69673
SSDEEP 24576:Hzygtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:H/tdnYz5d6JgCg
TLSH
T1F155028373A520F9D17B8274C8524A01F77ABC364B7589AF63A427761E376D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 23f0ae8a9bb164611499c21b07f096f81b3991550658cc3219f7392d937ba4d0
MD5 f093648ebf60ae505334678f683cc2f5
SHA1 b9c5fd1081b1850ca72fe3c610b0048881742952
SHA512 58aeba102dd012115a89ff68df873253fcfe34a25156409c7a6494b64ae4d25227e09d63f85b3603c5df556c0b21df047b9187cab73d13eedbfbc604e70ce3ae
SSDEEP 24576:zZtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:FtdnYz5d6JgCg
TLSH
T1234523D3B59D44A9D9BF81B1C90A8A44659D6F5BE8EB84F7F39832148879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 036f806ccb98ebaff247762d6070688728bc6c7e77bf145495c01756918f4e89
MD5 4877f217b9002dc8becd43c0519aaaa2
SHA1 98b641b9f9d6551511076745720a03c58e13bbb4
SHA512 9e5cb80bbd7a9d07e0152b099ff08a0a93519a7dccb52202ca2359cb492ce1777ca73e3dfcb05f85114dde95e2c43254d86db6c01ee22e4169bf54b9a6bc1674
SSDEEP 24576:oZtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:etdnYz5d6JgCg
TLSH
T1E64523D3B5AD44A9D9BF81B1C90A8A44659D6F5BD8EB84F7F39832148C79DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7f202c8d7d88dd8a52b52b2860bced8a7ebcb30da94c1cedf95dcec451a2e764
MD5 f0234eaaaf20ba50e7c5562485f86ea6
SHA1 5d56b061a55d349ebd4649906139dd3c557af945
SHA512 326d65b94c3f8d6f718ea79fdcce03f561207ff9cd0339c8b7b9a2ea8537aa9f58821f15871a3e346c729d3269611d18efe6ce9956876b77f3189a0af8e5a843
SSDEEP 24576:Pzygtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:P/tdnYz5d6JgCg
TLSH
T1D955028373A520F9D17B8274C8524A01F77ABC364B7589AF63A427761E376D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 47147d03d54ec4cca5ff1d2c19dd92cc156715c489bcb3d789b475c7f1366d18
MD5 130c4076f960ae946f20c5a57844d45e
SHA1 94a72b9c9517a842a0a5a04c431b97415ba5c7f5
SHA512 985a9bcc65d54d10d38a88f1e0a59d4d37e168c56f1e58a3f31bf683b9e3f3af5a6775033496a49f9d72cf554948ed608bb04a52b17fc94743240d582fa31af3
SSDEEP 24576:vTeaLl3z0zDytdykir8q0Hsw47opM6g9+JVuOUj7Cg8:vTtLljHtdnYz5d6JgCg
TLSH
T1BC6501D5B39018F8ECA7817ACC168906D6B27C5A4BB0C56F13A8366A5F337900D3DF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e91dad1fc000bcfcc236e2f83ca032f7cb4c6affe85344577281d616e570f578
MD5 d49ee4a59fb1056e8e0cb3879b860afd
SHA1 8e39459d417e62c3a9a7d44ec3424407d1da81cf
SHA512 71c8ba6e86ed1f3e859a8d725e1a152a04c87d9a6713f8ee0fce785ff85a86f402fd47faea98e00d287c7aead3c453311188e5129987804493e2732ec1a6e92b
SSDEEP 24576:+3Vd9CHKy7GZutdykir8q0Hsw47opM6g9+JVuOUj7Cg8:AVd9CHKyaYtdnYz5d6JgCg
TLSH
T1DB85CF91F3E814E8F0B78A35CD664511DAB67C5A5B71CE8F13A4261A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 211d3ca2a98210201e9fcb8d68535ea4f51574c9054b40027247354e6d30cf2a
MD5 14799e56ed2ae438fd5086ba9671b75a
SHA1 eb9cc737a06d243a80a08d07196d808d9913407d
SHA512 ec385289f3dda704a719853c45ae10a63df4d197ebb8007a0d1f84d632f935b9fddd77995060cd8fa2ae5e87abfd28808717351e49cf091c3a11bc6856d2911d
SSDEEP 24576:yitdykir8q0Hsw47opM6g9+JVuOUj7Cg8:xtdnYz5d6JgCg
TLSH
T1174523D3B5AD44AAD9BF85B1C80A8A44659D6F5BD8EB84F7F39831148879DC00338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f3870bee57f0c392ca6e249d6f50078a6ad8f73e12227f9b906dfd4d4183d887
MD5 9d6bf84073d76a43286174c88242c4b2
SHA1 2572ac5ad6321122eb7763c88697c5baaa9bd945
SHA512 0fa627fec04fee89cb2a0a918c57a8ef8af7330d2de61e3ec05bb2e8961cfa3a82ea91deea0b74a073f9330ff58f0dfadff8d1d30396f5838c8675f1344f5783
SSDEEP 24576:nJtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:JtdnYz5d6JgCg
TLSH
T1B255F15AE29801E8C06E5175CB468A40B3677C6587E2D2DB63D0F53E0F7AAC05EF9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 75fc70bbb3f61dfe748b27e36b33de7fd3dde1a815308e40b244f405b7aff1c2
MD5 ef525ca3cd4fb36cb76ed0f5723800bf
SHA1 4d14731732890bb5215ee9f85d6537b9c6be0a03
SHA512 7f8881b007b61bec3e848dc0fe81f0a63e6608a86c6fa154d5ee70f1472606f76f9f269509a2a8d95661ba11f8b6ad040ed5693893e833afc34afb964b667dfd
SSDEEP 24576:Rmtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:RmtdnYz5d6JgCg
TLSH
T13B4523D3A39C44A5E9BF86B0880AC614265EBF699FE684F7F24432599839DC04734F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8b1f692dbfe647f721be31cda6748c8198ffd456b9200f1d041cb533a48a2fb0
MD5 e0f46297bcc5c5eab1e77ff66725d2b4
SHA1 b57aac642f51a4e77ed2bdb731705f5717c2ce30
SHA512 6e00804aa9042b2e10d923b9c5e907113fd3175b0f09d3be63af31c98ee54d604e92aec1e57de7547037c611f1086613d2d54218b81254afae31cafaa10c0d67
SSDEEP 24576:m8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC8tdykir8q0Hsw47opM6g9+JVuOUj74:fRZwQCyiHiQEaaPnM5tdnYz5d6JgCg
TLSH
T18185BF1E62DC46A5E0BAD2B8CD674407E6B27816473197CF1290C27D1F37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 ff32c8cf1529998bd4ac3f7add1aa79e0fbe3083a2e8e5c97c3a8c3b03aa3f6c
MD5 5620fe100a7bd6244cc3270d921d27e3
SHA1 eb765ff82124e2d7e41579a94a9ae7227870cf17
SHA512 dddf6509d1b654241bbdcce74db4253d6900be172325d29fbc5104a08e04ebe42e04093bfac5bd163eb96d7ef70d903c7c6de7ce58299e341dded45fddafc248
SSDEEP 24576:3bxA1UGRtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:3bxA1UatdnYz5d6JgCg
TLSH
T1935512AF62AC14F5E5BAC17988868105D332BC2A577183EF61D0A27E0E3BED44D35F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 47d2dba88cc6fd7e2f4ee4ea6b14b4b5f0955d0cddb1b335f7abb59c0bd7d9ea
MD5 f85ec3e1636f10bbdc9c4e41a5407cc6
SHA1 3091d00672e1e1cc4057ead0f9f629d651f6cccd
SHA512 e7dd35f3deca33e884981d9f79c97ffca7cd0c9705d6b6c6631d81a0e951b54d74e4f49a1fa8f9ec221319ca8ef3dcf9735a5f1e8cd8d9b8cfd4fc4928ba79eb
SSDEEP 24576:CjsmP0yHaqrVqHra44KDzMsrnotdykir8q0Hsw47opM6g9+JVuOUj7Cg8:CjRP0yHfVqzlAsrnotdnYz5d6JgCg
TLSH
T14945AF2EF2B910B9D4AAC176450107B5BB71B82D1F219AC70170C634AF1AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ca95ea01de168e56aa6a3dd1b17f269b1db2c559588f0b86f24410d30c874a9a
MD5 72c15d324f69b9770a3941f88eaed814
SHA1 a89b882db9c8df72723594c41a183eaaf4e84766
SHA512 53e0a915132584bb966d3e5b63a9efc4d2100e600666f8a24e148ccdb239d06d7db4622b556863ef9dbd00f2b00a54fc45861affa421968af5b7dc493a835b44
SSDEEP 24576:1Utdykir8q0Hsw47opM6g9+JVuOUj7Cg8:1UtdnYz5d6JgCg
TLSH
T1F55523D3B29D44A9D9BF86B1880ACA04665D7F1A9BFB84F7B1943215887DDC04338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 6fb2b143593594c6639418f80684dfecc675c39adc662aa08a3d648452004f3a
MD5 0a927e80a8ce1badf5c7cc13d4d0fb65
SHA1 aadb496cad15a17227d31c8393f69a8e158b3d73
SHA512 554816739fb47b384381e812486e35f77a979d075995ecad67f691faf145ba944e19d06487c34613f41034c076818efcd3eacc791663cd32a9f4ad3d73a62bed
SSDEEP 24576:7SLBUTCtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:7SLBUutdnYz5d6JgCg
TLSH
T1A8750155F7A400F9E97BC13CC8668A16E272B85D0764E6EF03A84B651E337E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2e7777fc3e4287b00dfc7274634e7d3bd01cd04300e48411d5f1d5e4912d1bd8
MD5 ccb8f462f0b8a94d0d1e77eaf18d0bc5
SHA1 8d88840c2e9abb7eb8272d30ba3df44b27d3cb66
SHA512 dea9a88f88961a1ccb91ad2707e4c92167cc766412254faea862db0336879e8bedc6e27e81037621395c294f9791fa2d933caee9460dbcacaf53088c1e776e30
SSDEEP 24576:jIYNH3tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:jIYt3tdnYz5d6JgCg
TLSH
T17A65F16FA2AD08E4D57B9179CA838609F2737C66175192DF01B0827A0E37EE87D3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 91b1f7834ae8a95d02190b2b805bb3598ae50ed0b53ba607eb763db2dfbfcaae
MD5 78abf60976c1b0b6ddf3f1a039aab90c
SHA1 2eaa6d8b2c24cee1866ebc5f28cc30282f25f2b9
SHA512 85d08ec79de41962d587e5bf32f909ac41e1277a9cd39f52233d670bb4aa82888ada70af4318f1dfbd1e2586d03d5e9b63dbb277aaca534cf1a696a22bbc3a61
SSDEEP 24576:3nXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK+:3nXoJJYH84VVS6AmETJas+cHBjSSKHPF
TLSH
T18065BFAEA2BC04E8D5BBD17DC5C24506F5B178661331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f5a259249c463e87b7847effc9cc5736aef871c238795259168429ad8000f436
MD5 01feb0da1dcde490ddb7bd019f7eb4bf
SHA1 90da39e0da727974241fcd7b318f06c19baf5dd8
SHA512 de1285ffff90ab763308fdf4643c2241f0ebe5d258c1952dcc546a98bf58895b72640922587c392f869a269c69ad54d8951d3124319900b039182d3b6f6b2491
SSDEEP 24576:Yv7Xbxd9Tuycf8M/TYlSuxwr2PC9tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:YDLL9TuJ0M/TYW2P0tdnYz5d6JgCg
TLSH
T191858D5EA3EC42D8E0BBD6BD85B79146FAB2B855173081CF1290856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 9171f4f924dc40716a7240312d306e5279558366e8c6213585b7a1563372c3b5
MD5 e5d0c0af6fe9880173a8683464031664
SHA1 fd114f92197a6e3dfdd06b4a2599a01b974de6bf
SHA512 1fef0a95b5c76305284711e236759cdb6feb7cdc7a85b3af54ea6e0c2bafc74ce0fd02d7fe8f96a23a7d08c88cd1dd5cd0be0f9a81807a1de91bc699033347ef
SSDEEP 24576:eegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wCtdykir8q0Hsw47opM6g9+JVuOUjc:engOJOmPOHkCtdnYz5d6JgCg
TLSH
T18555BF3FB7BC15D5E07EC17D8A968916F6B1782603255ACF0160827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 496c12080ec0baf4e667bcd150c7cc8bbcf552706e89edfe81b362b13db48f70
MD5 c39f71a092ea7252db16ac77cacbf041
SHA1 31ba4017315261fc58f41ed276c31a637a395c09
SHA512 776e7157fd1ed3312f0e0a3bacf1758597f6bb8eeddd56549f05998e4f3badaa90e87bae1f974ad0f277e3e1b3148b3f37c7d1667e53454028a9aabd13152106
SSDEEP 24576:OLJnJiTk3R3waE4JrO0tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:OLJnJK8R304lrtdnYz5d6JgCg
TLSH
T1EE75E06DD2A810E8D4B7C2B4815A1B56FF31387D2B2569CB69B4D5313F22FD09A39F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d97cdd6f8c351e258b3e7095329ca14d00ae43faace3e52502a1c5d2a769c8d3
MD5 2ca88e512224d67afd9b83f00cc1cbe3
SHA1 e9ed6654b691ec56d7c2431c3aaa84133aecdd47
SHA512 d935cf5d20fc078fce9b34506755f3c82b1f78006fc855c47caeeaedca136e4355c8c7f13b4214d91522f314e43fe9222ddf6a2e92dd2a35c96ba4d4ac630169
SSDEEP 49152:v9GqCzDScAZmlvTcFg8Ph6otdnYz5d6JgCg:bAz50GC
TLSH
T1AA955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 8087374ee5f9b9c4a132e7a1b0300c7f0e9853aab87f61f3bc4e1cb86e2e2935
MD5 c8eaf659a67714eed6a3bcf10357abd1
SHA1 26e1ae6ea4245d19a3cf0d8ecc85ba598c6b58b2
SHA512 c9894b13275c7a2c73c4ff1a8ea1ea0bfd0e1a6141ef6be053ec5e6d2d3618fd4eeab85589896905ec5a2d67210c2cd135edea301751eb01de3817b2de7bc944
SSDEEP 24576:BlYJeXm5jUuENtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:BlYJeXmRUuENtdnYz5d6JgCg
TLSH
T1EC55129E76AC20E5D17F807588528A04E376BC66579253FF62E0E2798E3ADD01E38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 4d51e665a69bb412d95a77e60a779d720dad4511d42f3cf2fe72d5aea511d917
MD5 333f2ab27819966e52ccd9016d4bd709
SHA1 27c811168816defd26eaec9b83d532be3008f1b6
SHA512 51066c07865a227e25770e37125b995155987c616aee3d81e880353453f64d93a7f155323b9827182423c113030af58a1e57862223d7296a4697a39c8d085a8f
SSDEEP 24576:ejtybtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ejtQtdnYz5d6JgCg
TLSH
T106651282739850E8EABA4674CD1382509B7DBD258F6581FFA1D0F63E5D36BC09634F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e56f8316d3467fa1dd68de2a920fa18056eac1770cab9634ccaf1d3399069e65
MD5 efc858a3c330e729f92af27c252a0cd7
SHA1 9fa900abf924ae118ed5a9d06d5d6e2100bd8026
SHA512 c9c9c541d834168261984e481f8bcd7c156b8f19578970ef0f5011441c37a4d495e7d3cd4bebe5a29ecf447a28c6dba774a636e15ea4a5614dd77f4d52508ff9
SSDEEP 24576:mCtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:mCtdnYz5d6JgCg
TLSH
T1C25523D672AC54A9D9BB85B188068A00665D7F399AF644FBB1E4B235CC7DDC04334F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0e420dfda0a6ba748f6f806a5d421f1e698f803b33075887934e7999d78d06d9
MD5 fef23f166b02a804778eb52386a06bdf
SHA1 55589560c673c16c8e0777fcb4fc633c85252649
SHA512 fbe7a9a7f621b516430c9cc2f1ac1797c22a5540f6496d73c839ded397a23e236d03f6ed5298555242ebce32b4da84ea69a410c0b666ca8b640b5166f190fdbb
SSDEEP 24576:+C+TyQIu93VAumZr7jmxtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:+/TfIq+YxtdnYz5d6JgCg
TLSH
T173558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 13dfd09a3b43c3c7a6cdecf74860be845bfd31a8312c216fc3233eeac1b60d5e
MD5 97815f51206cbecc4f4729809d7262af
SHA1 7d871a2f8937964c2eaaedb920b063aa7cb268a3
SHA512 0486a5c9081d41617fa61af120d70080d4647e6cd551ce2d03d92bd13a5391327e194ad816d51bfd486a8a4d4201219ba7a5c183c017385ee0aa7e0fb177af77
SSDEEP 24576:7LQikZetdykir8q0Hsw47opM6g9+JVuOUj7Cg8:fQikctdnYz5d6JgCg
TLSH
T1FF65F14FB3AE00A5D4ABC178C8458201F6B37835576262EF52A0C7794E7B9E97E38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6d1948b4737378645a401f9f7352591c8d7374f319282859cf00137fe6b7958f
MD5 fa4375469b6e1ed9053518f1a4e5f33b
SHA1 d4df53997c63ad9859aea722ccb0569e7e8fc8bb
SHA512 07b587e27ef01b5ef345474275f54e9550acc42c053e21415edd137cd384c416854fad57c8c601e1aea5b7ff5298644b4d74e527ef59a3670cfe00aff3268605
SSDEEP 49152:VpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPbtdnYz5d60:2pC7b4+80GTkbz50GC
TLSH
T113A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d6b1f18e13a636bfb0dd48379cf88a0081a52487f1d4df829516c893471bb3aa
MD5 9d0e91aea567954ee4e49fe1b3038017
SHA1 2a8681d9430d11ec6ced45ab34a91397df9048ad
SHA512 fd752f54a9fa95e58b89dcddc43a3c16960b84c8cdd478644b77b7a72546075c6359952e3795cf37191359b331728f266afd21001b2ac566ac7472a4f9cfbdf3
SSDEEP 24576:wSAwJPE1IDAo+4Kt+l4413lUQQtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:wqPCIo4Kol4jQQtdnYz5d6JgCg
TLSH
T12455B02AA7F946F5E17AC7B4D663C601FB727822133163CF5290913E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-420-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/220-312-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/392-234-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/392-18-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/392-17-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/392-26-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1312-274-0x0000000140000000-0x000000014013A000-memory.dmp

Download

memory/1312-339-0x0000000140000000-0x000000014013A000-memory.dmp

Download

memory/1796-46-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1796-33-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1924-291-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1924-282-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/1924-415-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1924-288-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/2176-246-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/2176-317-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/2224-340-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2224-290-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2224-538-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2328-327-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2328-539-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2588-418-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2588-296-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2588-302-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2588-304-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3004-419-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/3004-307-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/3316-433-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-443-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-455-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-456-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-457-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-458-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-459-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-460-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-422-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-437-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-438-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-439-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-440-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-441-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-442-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-444-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-445-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-446-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-447-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-448-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-449-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-450-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-451-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-452-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-423-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-424-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-426-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-427-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-428-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-429-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-430-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-431-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-432-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-435-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-436-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-434-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-425-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3316-421-0x000001AF90260000-0x000001AF90270000-memory.dmp

Download

memory/3336-536-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3336-318-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3372-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3372-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3372-55-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3372-67-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3592-380-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3592-413-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3592-396-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3592-540-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3592-337-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3592-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3592-331-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3592-453-0x000000000BE10000-0x000000000BE18000-memory.dmp

Download

memory/4040-270-0x00000000006F0000-0x0000000000756000-memory.dmp

Download

memory/4040-326-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/4040-265-0x00000000006F0000-0x0000000000756000-memory.dmp

Download

memory/4040-263-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/4616-30-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/4616-9-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/4616-0-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/4616-34-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/4616-1-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/5076-77-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5076-82-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5076-237-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/5076-75-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/5140-258-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5140-256-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5140-250-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5140-323-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5200-471-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5200-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5388-44-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5388-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5388-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5388-38-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5396-59-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/5396-72-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5396-70-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/5396-68-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5396-65-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/5520-292-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/5568-233-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/5568-13-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/5836-537-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5836-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download