2e6d4b3fd39da7210406d99394ff4f0b63c0c370ab490f38877085899c57be78

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Size 1.6MB
Sample260608-py5hnaes91
SHA256 2e6d4b3fd39da7210406d99394ff4f0b63c0c370ab490f38877085899c57be78
MD5 20fae6f8b428ed8aed1e83a920b49da4
SHA1 a30e52bfcda0d6977ad69b124d432d1c1c613dd7
SHA512 e39153cf586370c8773a42cb979a16fa26cf7c98acfb12d70726eebf9d17bdb6a7fdc7dd50dc86eb7949f7264b82733a2438584bab6fcdd68e579e44c4d2ad9e
SSDEEP 24576:wMA7qV/ccqNgPg9sqjnhMgeiCl7G0nehbGZpbD:wMA4pqNoWDmg27RnWGj
TLSH
T1C485D05DA75840E1E1B6C13888939906E6727C114B719BCF13A8E67E2F776D18E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
3068	alg.exe
5316	elevation_service.exe
5348	elevation_service.exe
960	maintenanceservice.exe
4048	OSE.EXE
2660	DiagnosticsHub.StandardCollector.Service.exe
2132	fxssvc.exe
3908	msdtc.exe
3552	PerceptionSimulationService.exe
3312	perfhost.exe
5284	locator.exe
4544	SensorDataService.exe
4408	snmptrap.exe
2636	spectrum.exe
4004	ssh-agent.exe
328	TieringEngineService.exe
424	AgentService.exe
2716	vds.exe
2600	vssvc.exe
2968	wbengine.exe
3252	WmiApSrv.exe
1788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\77cb054cccebd5c8.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c279edd44f7dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000274a02de44f7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006815ade44f7dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e3ab1dd44f7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe\""	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5316	elevation_service.exe
5316	elevation_service.exe
5316	elevation_service.exe
5316	elevation_service.exe
5316	elevation_service.exe
5316	elevation_service.exe
5316	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1724	2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	3068	alg.exe
Token: SeDebugPrivilege	3068	alg.exe
Token: SeDebugPrivilege	3068	alg.exe
Token: SeTakeOwnershipPrivilege	5316	elevation_service.exe
Token: SeAuditPrivilege	2132	fxssvc.exe
Token: SeRestorePrivilege	328	TieringEngineService.exe
Token: SeManageVolumePrivilege	328	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	424	AgentService.exe
Token: SeBackupPrivilege	2600	vssvc.exe
Token: SeRestorePrivilege	2600	vssvc.exe
Token: SeAuditPrivilege	2600	vssvc.exe
Token: SeBackupPrivilege	2968	wbengine.exe
Token: SeRestorePrivilege	2968	wbengine.exe
Token: SeSecurityPrivilege	2968	wbengine.exe
Token: 33	1788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1788	SearchIndexer.exe
Token: SeDebugPrivilege	5316	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 5380	1788	SearchIndexer.exe	104
PID 1788 wrote to memory of 5580	1788	SearchIndexer.exe	105
PID 1788 wrote to memory of 5416	1788	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-08_20fae6f8b428ed8aed1e83a920b49da4_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5348

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4048

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2384

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5284

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4544

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4408

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:328

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5380
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2924 2896 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5580
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2948 2908 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 413824ddffcc6183f917011ee8fd4689f755e9408e2675d378e557ce0b0b4c8b
MD5 bf4fa92bff68c406a4c62151cd4ed565
SHA1 85eb7a2c8a4225d1a43693c0be893cf860b18ad7
SHA512 bdbcd95db35e5d28c334923394c1c998597a611cb8bf642c4d584dba38ccb145dc70f3de1835612e7ed518bda7e4c29b78d0fdf968b7b6f2e77dc4b3834f08ea
SSDEEP 49152:gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRDmg27RnWGj:K3q6sjBOD527BWG
TLSH
T124D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8e791c4e4563a0062d5c2c3e5ff986a7b2d287754199de6b64a471ec7026d189
MD5 526716e1f650cc4c87cced7dffd12e2b
SHA1 8a48bd1e1913960d626a67ce60300269f3eeeeb7
SHA512 2aec043525d06dfcfb0194326c6947968b0a1d4c20734f392e579c2a32c5e035ccdd1c67fead3c3a4f45cca3202ed538347438eec57f673a3fa4846dbdd95f06
SSDEEP 24576:sXYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:LtcvDmg27RnWGj
TLSH
T10365F129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b0184b98e24202c930586f9f61e5b58e471b5c9f783ecd4e2485a3ab3839271d
MD5 8fbe3826c941ff971a48b0fc4595d076
SHA1 56f9ca9c07db374bc2b8caf4fc69656028bfe53b
SHA512 1cad6b5332c1f191cccbc817bdef10521c2a14adbfeac80b3754c1eec1ab6c00288a274929384962a0509696b09d7f41d818ba438400c2bf05473f19743ae260
SSDEEP 24576:z0Le5ji0hmxxrMVsqjnhMgeiCl7G0nehbGZpbD:zPji0AjMDmg27RnWGj
TLSH
T1CA859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ba86278d596d63b7428b52f9ed98644c4fc362bbc566faceeeed4f68bad6666e
MD5 4179be7027d03d7fbc6ef453e4d8e956
SHA1 4512778272fc932292f77ab3ba1abb49cb646665
SHA512 7a16a2259a0e957de0a3338315dfbe72ef76182594f75c68b3c59fd47afe1af731f623581b7a9acfb93108bd77f3a4d6fcba5eab0374dc91c8401cb3b2dc52ff
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWn6q8wyuLsqjnhMgeiCl7G0nehbGZpbD:Z/ezSC6vUzPveHjyADmg27RnWGj
TLSH
T1DC755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 59475254f7bb8eb46e0c0233c27992fdae336844811dbcbd76ea8a5c8eefb114
MD5 7cd67bbc115d9b980e3141da62807853
SHA1 df0cfd72ced05071fb5308521214cdb1398993ec
SHA512 fc885f4d797a5407a89c3eeb26cc3c7c8c86c6ad3878cf195d87d3e4448820b3f136bfa87ecf848abc69030bd12b225bcc881575853b7599d4b3d065dfc94af0
SSDEEP 24576:yVbqPb88hv/l+YKsqjnhMgeiCl7G0nehbGZpbD:yVO88hXl+HDmg27RnWGj
TLSH
T128559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 838b1a1ea9553e06c61ac0070edef69241a77690f8e1cfbe89c6e3ea41da70a6
MD5 035b3bb30f6df50829e5311890a8aedb
SHA1 5b9ecfa2ea2dea560b3267394f2c5589958441c5
SHA512 b7e65b2c77d6d16d4caee87d949059de66b93ecea62b22f27fa173b7b12a39a1c81f3671dda24b1ff388a3faaa468bc9948a8f9be35fcf03cc30d03ce5e2c3c0
SSDEEP 12288:NLRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NLRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 cefa4ee236d8a9aa8d1d9f8e75506b01c96133b67f4f646ab74c8780f6226b1d
MD5 6883255784ac11044f197099c6f843ea
SHA1 3bad16c8a0c36a6c14e1c294cdb029c576598d97
SHA512 56c1404fb99e16bc4af3a70fd81b69da28b4867aa3cf7214480a6522c198cb2a90e52e670c8fe19e59a3fa2c2b20671e772a32ba987d8c699e34050072e2c13c
SSDEEP 12288:SeBNUbTVO86UyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:SJIUysqjnhMgeiCl7G0nehbGZpbD
TLSH
T10065CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 caede6c8dcaf628d8963af5bb580add384613e9611a815bb78bb4c9352494af9
MD5 d0e57491c6671a9e145c6167c09ea551
SHA1 6ef4fc08ff79860e21ba17ada92aeee6ac02673e
SHA512 0d139cd1c4438029fba88f94510d71080e72f9c461fd7797569c2a9d528cfc0aa62181b35c41791fa2fb93e91017877eebedc3581dd3124e69daba49c1e0e4eb
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THF:NQvGAdlCEL8c/DRNw5CPD527BWG
TLSH
T1BA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 78f4d8acc8e46c99b2aedd6e24daaf9076f0197b2b1e0abded67f500688ff276
MD5 0dbf3e3d5a5fac1e89f4f85757c9db77
SHA1 5d5c85e9aa3b886a03ab59cb2d6825b6c3e39f91
SHA512 fe149dd27b1b362435aa0bafc26013630e6bade3e9759537a4032a6de3a1520da963b1366116d86754d94aa4535b81404e55a904ac4007254e0c81419ebedb44
SSDEEP 12288:uAwSfxL/2Dc3RDLLmt0LDQewsAjgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:T0ewsAjgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D175E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 442d02b9e78a2caa969779e805874d103fa8cb66ee720d125fe77506835f3cc1
MD5 bed28c1d7ab823443a1200f6f1299d58
SHA1 977460a78f6e4335ccc9ae19d887cccd0339e970
SHA512 acf15f0c4fc024b86f6051e98abc9a833254696d7b6b1228ace59bcbf9e5e4fc68d6653d8a36591c96ef0b725d55546bcdb08b9217b84e9ec4cc3077bb9daca3
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHkVQBWG:lUEtQevvqc2W1cpV2tI32rB
TLSH
T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 20ecca96f8a26532a1f376af1cc8f21b38cdf386ba108166283447f8b4cdbbbe
MD5 9e3cf6808344cae5eccff3b01dca57e5
SHA1 2d8d5806002f3d18fe459e3a0228c1fb51822c0b
SHA512 aece922d89513f12cbd1be1a013bada2e6cea781de9aab12accd44d681320af3a8e5e256e67ec8e7843f92d583252a2d84bfc00e61279820849a54f2d817e493
SSDEEP 49152:tCbRquA/m2yL5zTfFiV+XenmE3/z8Dmg27RnWGj:KoquVjnmDD527BWG
TLSH
T1B9D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 81575f96ea4889f167d4bd3e3e836b70fea4085cfbba1908a828574a2b4d1417
MD5 356cb98fa16be433f68628a8542bcf4a
SHA1 972ea72d92fc313f48024f480879b0f5018edc10
SHA512 c51867d3155fd5fb01dfda604f57be82f88b04b074932e708b1183577a11cf4f540cb01bb58ad1892edcc77c073fccfb0b519a08f7c8c397a0bcf6c46f810d54
SSDEEP 24576:tAhGL3IFoiwtA5l7S53/sqjnhMgeiCl7G0nehbGZpbD:tAMUFoiq5TDmg27RnWGj
TLSH
T1FE359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 09adecc020c1fb7a0868ac4c7b80765188c72f8ed27067343a0bde324051b53c
MD5 37de6e6dad73f36b03020138450ff367
SHA1 f5d7a40f09fad84610c56e1b9dc0d0a3f3a164e2
SHA512 63e3dca955d833d3295ba4141a8c879be4f79b4e044db8c2ff87f57ad64c67e4439e1de6127b40dac832bb4fa996b703d96ddf49b72c79617e0723b8d096bdbd
SSDEEP 12288:fmw5HEjsChNVBFgl0WDm+CrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:ewu4OWEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7f01c01e659bf3f2c7f5cca12feb46612b708ecbd2f7dcc9d5e1db6c06e05cf0
MD5 a44e107e287300d6204b5dfd2a49ff08
SHA1 f17449a7bb5d8b52fd4450814032a85b7f7d9590
SHA512 3258998e74a1d0831f44d06ec6232ff5e614cf76181ab3e0a02953badb5b1be50faa806c3922b131656e2dad4d468005e85c56c3414ba5f760996db8db1772d0
SSDEEP 12288:VeZ1IywXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gZu9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B5512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d9efd171c4d6ff35463b8dd013422fad2ef33efe9d15d661f09796762cdf2d4d
MD5 60363036c7e3c8f03b5e22fc91cfb1f3
SHA1 9e805189eb404286c559e1e81925bf18055d2ad0
SHA512 6b7a780f8dcd8f6ab6ea3a12660156d99322ba0d2d1004ba5e2d04289a6eaf471fecb5fff61325b9b111704fec864a9de04ac5e9a2e12897b50cb7134703d665
SSDEEP 98304:+QRQyi36YOcPbLvw2gAf+PN3qD527BWG:lQyiKa/X+PNaVQBWG
TLSH
T1CE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 987cbbc164414b65bedca707afdec2b153a9c0b8f107dd9ad508301216ebc84e
MD5 a09d9c460e24d4d481e6b38108b9f093
SHA1 2d4476811db9aac9f699c7b80fe1bd7aab69672d
SHA512 0eaec38f8d853dfce10e47eb14881df7bf8385e81236dc6a06288786c135bc0cd2a5c3a8b08a095030ce4840b91fdaa0d6f41cbbfa1d0753b6bba18d86a78a21
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3qD527BWG:aQyiKa/X+PNaVQBWG
TLSH
T1E2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 44b6880043c7c955fd26a42e79050ae3db45eb08b94f1bc82d1b245bd8651622
MD5 574e98e6afbc34d6b41ff31c085a5613
SHA1 2bf014e1907754662d08c2d52e39caa6b0202bd6
SHA512 8e62da0cc9ba621a944aa8d2b43edf876f27299e6c9262d2e8797a1b2fd3dd35b0f616ad2cc02b066d87dc47db339bdf6d797ef3c25b0c5ff5fba2d47a3fc271
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0tsqjnhMgeiCl7Ge:y68Qg55nhceWu7PNU3/MDmg27RnWGj
TLSH
T1D9B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d427f95d720a0201bb096e26a9446bba4b8d894cf50d04c90cd69ee8ad6362ba
MD5 72bce77d940032976f078804356357ec
SHA1 6b6c53950110f606790d4bff22080759115b1fb4
SHA512 3d7d2e1502303d0de8749f32daca6a1ea5d32de9f52cf029bc377f272b65775e15bce39b91cb604c5c16a7e3a153467c3916260e8e6da3daf0395c925d5bea4b
SSDEEP 98304:ey5112gYy5azzVvt69nLKnhZlD527BWG:PLIHEWhLVQBWG
TLSH
T12A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 29a6fae671fc5d0394915ae64f80e20e99ffda28aa9862bb80a238ddf977660b
MD5 a734c2c25dab973b99b8f9a5a0239a6b
SHA1 bf3745dc54c2be1cf194e56440350910dc5ca180
SHA512 cd63f6183c54315df373fbef4aa3d5fb33e6bdb4907ea25ed7c47a5c710c7eef0a8f7595691aa7dfb1f8171577365763705889d040ed3f90d3764b4012a70f17
SSDEEP 49152:RB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glCDmg27RnWGj:Hu6Jmdxd2dCD527BWG
TLSH
T1B2D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 151f0ec32a84f30acee7ca7a0f3770e6600cada77c3daed2b5f89203113c0f50
MD5 643c5c0b4202307c6132a54e429e5ddf
SHA1 4853a1ddea61a5e9cf4e4174bbe0060f9606fc88
SHA512 d44326420fa79d8e61da3c25f709c22bf91203fbdb6cc2a36ff6f416ce5a9acf4a5b9913f2a8a5ef9e19588c4abbfe06a1969ade27dde222658faa5d62765f97
SSDEEP 49152:e1hpsNoJpF1A63U44CwH7R4xWDmg27RnWGj:emifPWRDD527BWG
TLSH
T1CCB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 99bd2e7868d570799cd772552fcc71e9acd7f93733885339d0b4cf18872e2929
MD5 87e4125ae50ba28b9d6a4a9ee8824ef0
SHA1 3d68261d6b666dc4af916d8d8ee324c6a673aabc
SHA512 04b5b30f9b3d9a2b710269955841ae4122191a48080f1053116a10f92c961dc6a3e1c115b79b68b8fbde26b271f85f01f64eaed9d37f01466c3675a679d8a910
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqhDmg27RnWGj:u5dKii61hD527BWG
TLSH
T1C5C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dadc2d2d2e84082113dd7ef573780e0df4ab5163d8a3f741bb72e33dcb7eb7d3
MD5 2925e2d664011b083bf8d864396148fd
SHA1 6302ffd0efd107c0e509d290d5eac353854d907b
SHA512 28edd689b64f81c65d12bac355425448851a0e5ae883ffc9904d7bc5d8cff784d900bcc637cafbca9877d2681a19b54fd56a1af74fa6bf98650244f7fe5f02dc
SSDEEP 49152:YhtSn8EApI0fig3giDn0AP5wSDmg27RnWGj:JX2imphXD527BWG
TLSH
T1C095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7c33f108d20d9131e7658d4fa2cf3a6dd2d2efda6d1dba974d2f31aca80a3517
MD5 041f54ef7ca336ef76c079999777a971
SHA1 a6b7e6f156cef5d66c9bff522c1bdb995fb0f1c4
SHA512 bb70636f2f51d30a5c4e612b67a45e156e080a4ee9ce3151fa04af5be4d81c9c5bc7c936418b24c72329e206498817c84b9ca56fc180d896907090835028ba35
SSDEEP 12288:X5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A5B7CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ee03f3c33c7cdf272126682a43622b837904265ef59bacde816508ac154f86d7
MD5 9af70c1b4fb01e8657fb3b7bf69832d1
SHA1 6fcbebbe818972601c9c8719c4a1bab386e2ec56
SHA512 5edb83589c8719404d6afd24fee52e20e821f9158eb1a48e62aa6139aa32ad0b7b6062c08f0aa8c083f649b735bcd2ae0cacf8c43373c2b782fcfc7575c79147
SSDEEP 12288:ocXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ocsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 055bfb40cc3aeedac3cd411cd6c6bcc06388192b8a0d58face63d235bb2f216a
MD5 bb723ab82b7525e4100448c9b0a98454
SHA1 2502e2120918e1cfbc2e3308ba6c4e9b3b6ef818
SHA512 09c2376dd20fd5aab2776fa1981c743ade1bbf71c6317f93064d36d5c853242adcb061bb3e54da73470df300052638dd7c73ffd0f00e7b6bf58a945a80bceee4
SSDEEP 12288:26Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:26sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1264523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f618aa8b28cdc3bb8781a219dd5532c4a389408f800381122dc34288ff958680
MD5 e3b20ca10462ef239f1261b43013a499
SHA1 0e343015223da71927a2128c06f22b8736983f1f
SHA512 cb0819e54444781e478e9bf739e6fd401b5666471f1409408962e4cbbc21a0a122c833180ae30d38106d07b13fc0a91bc1bbd6e2b3aa99b59c57962610c52901
SSDEEP 12288:BVfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12945236F675C00C6D83685B4C2F5E11DE8237D96EA3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 92a78a4c3ddc11d3ed1af2dfcdae6f3894660df269694b9228beffde5b144104
MD5 350edb3e30b37458a75c194c12c7878a
SHA1 882e0ee41171482cc33275940b9e1632ca10f2a3
SHA512 af8848560003b02540286730affdc65e952514adeaa662ddc9b8088408eed6f7a64aac9556e7be3075bdde5aff8928117664507d2a290b78a9f3e23b2155735e
SSDEEP 12288:4XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4XsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c349d3c600271c1949c88336cb3c121347d3a0d8f3452e347bdbb870b256e9a2
MD5 d2e4133729c2c4592361e8abb8b461c7
SHA1 a2953c5c1a1652c66877863fed498fdad9f0c414
SHA512 875a6daf00eda68132999269b0059edf01c966c3c976e0145ce459ec1d008be8ec858e692bd326de9058af3bc89f780f2b3d5b1f1d4d3ed2574dcd2bcf8d0f31
SSDEEP 12288:0IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1754523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1665ba7c2d10fddaaea13cc69237a2ce54790537d603a215f43223659d3bbead
MD5 1eca3559ba63ac20bb4f74b13b5b0b92
SHA1 da9e113a2e15a05eebb10e8911cc92f53320b228
SHA512 50f7121f2ce4304153265aba9f60c0a76445798b691343eb594e55c90da0cd692513e76e6209fa5824cb5898910e6ede0df5c1181f911f8f9e3e02b0f0444a77
SSDEEP 12288:L0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B4523BE965C41CBE52604B5C3E5F11DAC073E5BE9200493BA5BBCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2d9406c53b66c2669d8552e30f7dca136d7b8b6bbe7fc1625e8d21d393516ac0
MD5 0e6ce5add7b46a13a0744fae2ecea6f3
SHA1 86a70c83f4d759bacfc087264f4fbe3c27508710
SHA512 35551d4365d2c93c1baa67b233531790d7f3a81c9371af41741c3b14f8bdf7fb4051eb92ee0f344da1747060ff075a0c2604670875ac8525d6956a7e8e76ed99
SSDEEP 24576:RZMRzFVSO8sqjnhMgeiCl7G0nehbGZpbD:RZMRzfEDmg27RnWGj
TLSH
T1A76501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6f7eff58e6fea53582bba0ae98eefcf27705e3407e5049b3442063cf61bf44cc
MD5 75cdd3306cc952c4b09549709bc9ba87
SHA1 c7fce8ae31675db3b597b935c05d92730305213d
SHA512 d362140ab1370eeee7538d72cda5e19f1c7149e620a654b4ce84f14beddb5e5d019857deba625eb6f3ab8b62a619135e60f1127b62bcaf7309f1ec63711b82a7
SSDEEP 12288:YNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 140b428a4f2e73498f8e284fd806de56acfbccdd5b6e09a38f88371886c16e35
MD5 7ee3a09517eda0f84cb5bab6e422d965
SHA1 9fa28034dcb547d97b5853c6b926d204a9dc413d
SHA512 72747718bafec024e39b6e716c4b68136dc64c05a3307d09e8c655875b3b4dccc0be3cd93ea475ea5dad4ad4b0dc0e241d04db53476b12205b6b34b1b277ba54
SSDEEP 12288:FhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 97f34336a30d753dae35a0a299e74f7ef4712fdabf3b9b8d62931eac76a5d57c
MD5 4f92344460aa123b424960321fbad14a
SHA1 9d9419988633bab308f0f6e16c1825d7d74c0622
SHA512 e75246a290477389e214c0bad78967af465c7e2db560f5cc0f9655995539c85c69f428680dbbd618239a22321d797fba54eea5b862479238437bb70b07fd03f6
SSDEEP 12288:oyPz5L8wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pzywsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C955125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 99eda72cc16ee8259a238743f71adb9cf4207de7851387004f34960d396ded53
MD5 7213085c2007097075b1dae663057faa
SHA1 06019a7f9100fb8397c750d1124881b06da4ffc1
SHA512 bf290678293afa47d7f41f1969e1d0edc41df4d9d002d22327d0bcf5fc8799a6ed56c1b39cd530c3cb53d3c51398b4303d4fbeb280c283ba827f821f7059e7b8
SSDEEP 12288:8NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F84523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a0e8030e54a06115f860e2539efa3420f89f0ce6c86cf7551f00e256319316a0
MD5 3c16eb91e30e71d0c4dd7a185c6b1c8d
SHA1 8fa6de4ea345a2e1b17974fe7bb47db15c69b9fc
SHA512 e0f0ea1e7a65da2da716518266ab545813368e7b222b7f31062b46eff3fe20b12024f393059687d59f51484e143467c275032c0fb2c9bf3a5954c58228aa9658
SSDEEP 12288:hNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1574523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 300928229e4dca44eef5ed36255ff16bc63e66eaa999f8d45c01aa1f1cb4c99c
MD5 176c0d4b51b1866f51768ec84b59bdf6
SHA1 5c6eabdcea8735006fc78cc16a1d229c46362e7d
SHA512 e482be22247f4c774db8ee76de4fb8540650d6082791d1e5c86d2176dd516a37c2a84faa51e0c02738fe987d6aa7d69283b850d9efbc5229fbca4a0d4b4cfe0e
SSDEEP 12288:HyPz5L8wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzywsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C655125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 26b483a623df6df0d7c1d9e47b99896be997f834cbbf456bc15f0398e6551fd0
MD5 f7b263f70b03c12b8c717c5991d05cc7
SHA1 d31729b9ce5a041b8a749d91fa5113822668b749
SHA512 e7881cbadbd3aa93f2f2a750196d131f62b22f05264ade88bdca0cc26a0c449f485ff1a34c98bc646cb11cee68352f413c5eed0bb6f57b518a7fd6e682c3788f
SSDEEP 24576:5TDaLl3z0zDqsqjnhMgeiCl7G0nehbGZpbD:5TuLlj/Dmg27RnWGj
TLSH
T1996501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8f4e160469bf153ef75ba8f406d9b51e0284564e03d0d69d213af28cddc580a7
MD5 b501da8791e2e52fddf9f0ffe9eb2c5b
SHA1 8f5fd64a695d92b8a346acef56cac194d942f115
SHA512 ddfd731296914b230ac5d5564a2f101961e6a8356f3bd4b786193b87c4b52246e64965594b5925c4274fbb59f7d11d06a8c28b797b5262abbd1c4baa1267027b
SSDEEP 24576:h3vd9CHKy7GZGsqjnhMgeiCl7G0nehbGZpbD:Rvd9CHKyaEDmg27RnWGj
TLSH
T12975CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4b0b852743df75ac2d4089bcfb8da630d7c0627bb560a4df4efe1ae1ec2347c0
MD5 b1f9c80e8ed0de4c6b485303d3f09f9c
SHA1 db2ae2341f6706a74c940d5c2195ef0140030fe5
SHA512 a32eff2f84ab2ba5b1d09419cccae90f86512489d433907e1f62c89fca8725110740609d37e00f0ab27d7748f5bd8cf04fe24c4ffa5df26c8bfc92c36c100ed7
SSDEEP 12288:3aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3asqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 037489fe3ae71949ca89d8e6322bcf16ff188786f7613c4927a6a508b29cdb4c
MD5 fac28061422b6487be924f1b0eb7d867
SHA1 f1af0f524be109ebe7e57b8c1d1de11380e00503
SHA512 2fe2039bb062c603f7f9d63a0c5ee81671b5126115ff021b265fdc7f7dbf654285c20bd96de6e65f6b8ce759058cbb2c0aba33c153543ef7d2c9743e7100fd11
SSDEEP 12288:jQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B4523BE965C41CBE52648F5C3E9E10DAC073E5BE92004837A977CBAEBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ea05e15792da39fb8488f0fc1090c4f603b12d70c01140f72f2f6a93fc5f96ce
MD5 84065536a3e7f172018709c9ca3fb9ed
SHA1 c3b8bee4d9008930b6db883b406ec16d4ed8ca59
SHA512 f992f24bb4c664ab629f5a2a959b264f043cf4b2c7e9acf5876257d90adf73b57a78a0aa9bf47436c98cd22bc5942bb34a089c4b32bb8954ae12ea72c35eda18
SSDEEP 12288:ojXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ojsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BF965C41CAE52608B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 27363cbee202ff320ee8541e70c2032099d35880c6a6fe84689f5d6ff1cef301
MD5 c47a566655cb09a5b7662f4d0ede1131
SHA1 830ca1c641cc83bdf649a62ca496e1967cff59f5
SHA512 9d88d2e87fc45d62a80e5eaf35d17ba2f182684ab84d4cb01f75190173e8008928b6fb95d7c8810a24e4062524ff5eb93ca6ff6fa5bdfc530c4516cc790f8eef
SSDEEP 12288:SNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 df18214419f3ec252bceea939294aba9bbc9a7dab6de988290302d8ac2153f4a
MD5 ce69e68a3bffe92963ab88bbe24b4764
SHA1 d7a2ded6fb95146da36b865334151bf0455dea6b
SHA512 d6b7f26f69c7d665305df4682d12eb06909e61e08be4b56b45756f69ec5f3153d899d9f4367fd417f714d79c9ea1a5160f25f7983bdaaa26195913b3c2c57f05
SSDEEP 12288:tbsf9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA55011AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1c9b5719351f14426235921a65dddc3e447e47ce6dc269a4c6b9c42e736ff0f1
MD5 183e2c52d455d8753e6b32baf1c945dd
SHA1 9f4316cda9fc054cd51dad8ab6f71386a1c8c27b
SHA512 0c9faed5a37d6de9988a2cbfc13480adeb2d06ffc0db193323e35e48860ab44c499afab2e3eea6c82f0a0c5fc028a1473e5a8976c1d51b3a4078005706ac9ca7
SSDEEP 12288:ZsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C945237BD34C518AE57649B482EAE12D681B7E6A9F2004C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 87aed4ce727d986461fd871b726af8acda2bb4d65dcd6447248488792f092b3b
MD5 88818db77ce60824325029e689b0ccb6
SHA1 fd7233ad126f7f92595256b9fda84a79b6ce2b62
SHA512 cf44e9c6b2f88a7d87d4e2a4c4661dc1725acfb9913841a6a8d29e0880e75e0e6761e009370b9e4b4ff7c45751e5cb0ec79431799666e3bd2cfa0dfe2efb6a41
SSDEEP 24576:M8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCSsqjnhMgeiCl7G0nehbGZpbD:lRZwQCyiHiQEaiPnMXDmg27RnWGj
TLSH
T13685B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 376a75b93b6ba08a28ab362796b402a8ccaeeed523884b93f73443076a717da2
MD5 9039cc6d151b84e023333be6a819fc50
SHA1 8f8c3b45530580a904ef8a200429c1e8f9d3698f
SHA512 42f4c34a1216a68a360d949090f5831c15445888bf485ced5027bd83386da900b1e6bb0399719fc8972a1eebe8902065807762275b7f1bd40366a269cc61c2f9
SSDEEP 12288:xbxA1U7KcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xbxA1UGcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16555123E62AC10E5E176957D86D2C10AD7327C26672093DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 eae7a35a49c9a3c739a1265be20bdb616e37c24d47f4136bef2a64790ace048d
MD5 cb24d74b4e9ec4c03f391a88b9b17e69
SHA1 4df3d6904b5140858dc7c8430675c3587349d4df
SHA512 9d86bcec4ce8d0d0cc2293d27e02d5188a570f6adf2e6e3236864f1839b51cc26e35ea9202b26bd829e069cc23a3fe405bf819b7c0d129bf06176cbbefa89f4b
SSDEEP 24576:PjsmP0yHaqrVqHra44KDzMsrntsqjnhMgeiCl7G0nehbGZpbD:PjRP0yHfVqzlAsrnRDmg27RnWGj
TLSH
T1FC45AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 cce091cf91089417540c871e098faaf71845676ee73f2ee280dc1c77f40c03cd
MD5 986936c49f9ab7e19593150dc0acc7a9
SHA1 4045ba82c98c6e7431c5a8a5147a4392049f4081
SHA512 3b06126ebb10cdf5adbd8052bf60770d765177c9ba48431a8648a1313b58c47e3c7cf2a5fb2367658d2111a2556dd993f9caaf24677412f7fd327118ea592a79
SSDEEP 12288:3KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BE924C51CAE93649B5C3E9E11DA8073E669B2004C379577CFEE7B54E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 d13575fcb3501674feabd9db2e8115c6a4781e828313ebec42056afb8039dc52
MD5 6c46aaa9e2b60dc61766f93f8854e33b
SHA1 18bbede98c216a97a26fa39f77c7af4a97ee1fd6
SHA512 ab9137c3e014fc195b38626a71fe82765fe071594cfd74d89f350fae22035cbc4f457c2161767445ab1551b78aa84cd769e6ab3053d4578de6cb6c8245240d56
SSDEEP 12288:EObfA4LWO+vAYFTAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:pbLBUTAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 0bd2617d86a0ccc32498d052ff97a3a394ebb38d7f7fb88c286b43e387aa9f53
MD5 05c4ca7c743092ef66e9653f1a105a2c
SHA1 0d7a6bd60b6e7728581ebecd704c263643024640
SHA512 0ad7cdda6ff5ba739d37fb23a5fa9c0db7032f8543ee14376f538aa0776ad2a58946dea1f521c32c568f2f3dca9737382d61a621a7737c1af1c7213050b2b5f4
SSDEEP 12288:970Vm9IYNvUyBpHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:6pYNHBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11365E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9a5994b38eadc5e52f3336e3bc05df21710f507af5ef4b595b0645aa7ee2fdaf
MD5 aaa53db6b1e5f2902d07c3d4e4acbf74
SHA1 7c6639baa70fee0accbd69a5e2aac0b8726a2c68
SHA512 459e27c285e90861b59f2b9e68b78858b725f1e29f83f55b8a3ab6f4c9e4d1017c3cfbad9ee5194b84c3a8b43747212981ae714abd2e78a4abb1099e2da0e63a
SSDEEP 24576:/nXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKF:/nXoJJYH84VVS6AmEOJas+cHBjSSKHPR
TLSH
T1D965BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b052935eba6aac9786938ebd4e26e4af3ecc13909be46547cad2de795a385f48
MD5 88a96db56b5aeab0802c8833dd3477a3
SHA1 765c84632fe1093e7cb3f5cfe6bd5537b36518e8
SHA512 1df8fe28f4bdfc6d98e55aba39219618bc4f992d3abd08414927782bffe06eb279e811c066208a303122b094b61258cbf3679c8bbdba2f4656428c24d48a6c29
SSDEEP 24576:hv7Xbxd9Tuycf8M/TYlSuxrr2PCfsqjnhMgeiCl7G0nehbGZpbD:hDLL9TuJ0M/TYj2P+Dmg27RnWGj
TLSH
T152858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 a81cf50dadd31bdc2d78964b86e5b8f600a600959bcf27686440ba28bb0bcd56
MD5 cd0c5caf20d45ad386d2ebbb703ba903
SHA1 143bf7890f6dda14993c2ec3aa563a8f7ab62b07
SHA512 0a55814070cf5ecd501ec279a74937fa2394527ce4b888fda5538a7ad5339929e10bc7fc657ac20ec51f6d5b58f90f56e1b14c6803740b7cb3977fc56ed99144
SSDEEP 24576:begJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wAsqjnhMgeiCl7G0nehbGZpbD:bngOJOmPOHz8Dmg27RnWGj
TLSH
T16655CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 538516deb9dee775f1ab2d030bc24a05345b3882f07c25d618e287518e025945
MD5 554f001585fae1a6acb699e423bb4146
SHA1 d28fd116aa2ec783867b8261a36c99b4a80a9073
SHA512 f25ece362c36c0c2217d375d5fd20dc1443dd172de032cdf77cb4d7ded7f9c6c89f7eb49cfd90dc366f538729680dda71b5463536f1e0b0977391c201e3ca6fc
SSDEEP 24576:5LJnJiTk3R3waE4JrOqsqjnhMgeiCl7G0nehbGZpbD:5LJnJK8R304lhDmg27RnWGj
TLSH
T1A575E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 11dd6a57fd276c6735ded5a66003fd1ebb5b9e5a60f2a0dcf4588a57cd0e9c9f
MD5 bcd4e8234e56c7647a918b7e9913ec24
SHA1 ecb3453fdc139b837447fe326af06e5c39619cb4
SHA512 99498e17c030d08822b786a8a0c81b3498da434944183f3e039f9541dc912c2810e9dbf3397151aee2aca8afdfc1bdc7dcb9f6fccda2161baf8b4f8ebd430ff3
SSDEEP 49152:l9mqCzDScAZmlvTcFg8Ph66Dmg27RnWGj:J1D527BWG
TLSH
T171955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f343b1f76179c49e01a1aa368be77cbc517312b3473200765261e3ca051a613e
MD5 1b6c72fcb2fbc425112cfafab04b05e4
SHA1 4cf4359a7e866a9e6defe8c13455bcb7b19249ac
SHA512 55365e6b22c224b5b847112f5310f94ebf5ec87f4908c0a01ff1bd809da10f890d3c6ca845c5fcbf10c15fbe9a7544d8840bdf5e315272a30e9a0301c38ee007
SSDEEP 24576:4lYJeXm5jUuEvsqjnhMgeiCl7G0nehbGZpbD:4lYJeXmRUuETDmg27RnWGj
TLSH
T17C5512AE769C30E5E12A8079C2E2C508E633B876571017EF56E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 f0d7f50e1bb3b2e11bca174bd3eb51b6420a7d2f14eaab0320224e853e0f9d57
MD5 a14c23233ce7914632dc512fe6af1550
SHA1 af50ff01a4082080df754f35fd6acaaad0405e32
SHA512 46e29322d268a1eb5e409596f1d38cf7f641e9144a97970673ae22880a050f5b093f0a0acef7dffd5f44ca7b5487bf0b12bafecce1fe25d4287f8232dd138540
SSDEEP 12288:imu6kyNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i7tyNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC552219639860D9EA760978C6B3C158DD367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d81424c6e73063a341cf8a2b6bf6f690a7a48a0940a2e35ac262946b58552a07
MD5 b22322868138d541dbdbe7f210643854
SHA1 a2e3fd08c3e5a4f3b3899d68962984e1509fe822
SHA512 9efcb05417ae0b4cfac958d670c5b244c437e87b84d96ab4fb068473a0fa12f048b7375486fc8d51f18c107206943339aa75a222108163d537356343323862b6
SSDEEP 12288:sPAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BE525C61CAD93244B4C2A5E10DA8173E36AB2014E779E7F8BDEBB54D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4bb3b30719658576d18e416243bfd96da11c2744a917a83ef8aabc1cf661b8fc
MD5 63c266f16c704d79cd5cdf3489f563b9
SHA1 c5695f755ebead25e53885d8a302d605bd652e1e
SHA512 9b6f5eba1b58af783767ffb714bad19853d8283f22314b6203ca5e6b54bab9ffd1dda05e24a554382a51c712bd65c39f551d0f3e8f4ef1cc0b46547cf79fe78a
SSDEEP 24576:8C+TyQIu93VAumZr7jmrsqjnhMgeiCl7G0nehbGZpbD:8/TfIq+YfDmg27RnWGj
TLSH
T151558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 cbfb0e74576576af4d28195b78059258bc85ca0d591f8a4ff4964071f356b796
MD5 54dc6b5f97e7f1921cb1b1daf10cd0be
SHA1 c4592efb59a7e629d6076602606d5ec80dca9394
SHA512 094b140a168141f601aa44bbdccdd55ea17332809d6ce3e6d50a48dea93005c4d378680b63d0985038d4ebf13fd0deb3b561344f548466d0a41dd092d73aaa7b
SSDEEP 12288:AcyrWOstaa3kcskXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:VLQikZksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F065F11FB3AE00A5E067817CC8858116FA737835571167DF02A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 32ffb85ea6af5bbfa6fc1fcf9e8c9682cab4d5b75edebcc8d470459c01a31a08
MD5 c0689f22711028c54c27452b55287344
SHA1 ce09d9043662184f09d3b37c5215537cfaaa69c4
SHA512 eec2b64baa038fe6a34484e85403b4d69b937601fcca54f18347a37ca6636f187a53fbd1a56df106e4bf5ac6c515648e5f87bf4651ba0eef2b49fb2a883fd618
SSDEEP 49152:9pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPxDmg27RnWm:+pC7b4+80GTkSD527BWG
TLSH
T188A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/328-343-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/328-510-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/328-352-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/328-349-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/424-367-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/424-370-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/424-366-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/424-358-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/424-364-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/960-56-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/960-50-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/960-60-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/960-71-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1724-21-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1724-26-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/1724-0-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1724-8-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/1724-9-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1788-421-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1788-502-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1788-427-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1788-430-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1788-512-0x000000000BE80000-0x000000000BE88000-memory.dmp

Download

memory/1788-536-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1788-470-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1788-486-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2132-243-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Download

memory/2132-249-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Download

memory/2132-242-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2132-255-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Download

memory/2132-263-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2600-406-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2600-390-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2600-531-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2636-320-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2636-328-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2636-508-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2636-326-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2660-351-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2660-239-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2660-237-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2660-231-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2716-403-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2716-511-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2716-372-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2716-378-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2968-400-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2968-404-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2968-530-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3068-19-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3068-13-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3068-222-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3068-24-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3252-415-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3252-408-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3252-416-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3252-535-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3312-414-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3312-284-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3552-277-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3552-275-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3552-269-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3552-405-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3908-264-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3908-380-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/3908-257-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3908-254-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4004-340-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4004-332-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4004-338-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4004-509-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4048-63-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4048-78-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4048-69-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4408-316-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4408-507-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4408-309-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4408-317-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4544-303-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4544-504-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4544-305-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4544-534-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4544-297-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5284-429-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5284-292-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5284-294-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5284-286-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5316-28-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5316-36-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5316-34-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5316-223-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5348-224-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5348-39-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5348-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5348-47-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5580-515-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-521-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-524-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-527-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-528-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-526-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-525-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-523-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-522-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-520-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-518-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-519-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-517-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-516-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download

memory/5580-514-0x000001A464FB0000-0x000001A464FC0000-memory.dmp

Download