88add5ccd2488425ae1fb2deac6b6c6d4cd2d09ac26c02644b01d695fdb7c813

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
Size 953KB
Sample260629-vr78vsav4x
SHA256 88add5ccd2488425ae1fb2deac6b6c6d4cd2d09ac26c02644b01d695fdb7c813
MD5 2d69ce6ba485de58e5752f376d711f86
SHA1 3aa5f4418a75e69c5ed2445674a03365dffed201
SHA512 f2dd08fb9089a2877352a471b287c799689ba7e16b2e9d69048940a86574d38b9bda44e70381d026f45724f0e80448dc6662658efed6680d138447cdf725dc22
SSDEEP 24576:Qot3+TporGvTWQMSBhvn/+r18fVSnrLFY+iOOMAep10:zt3+T4K5dBh3qIVSnN7iOOMXpi
TLSH
T1A325014536D404F8E5B3C678C9715616E2B67C665B30C79F03A4276B9F333A0AE3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4484	alg.exe
4244	DiagnosticsHub.StandardCollector.Service.exe
856	fxssvc.exe
1240	elevation_service.exe
3644	elevation_service.exe
1644	maintenanceservice.exe
3512	msdtc.exe
984	OSE.EXE
4852	PerceptionSimulationService.exe
1856	perfhost.exe
116	locator.exe
4104	SensorDataService.exe
3368	snmptrap.exe
3652	spectrum.exe
1816	ssh-agent.exe
3168	TieringEngineService.exe
3120	AgentService.exe
1440	vds.exe
2016	vssvc.exe
1144	wbengine.exe
4584	WmiApSrv.exe
3388	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\699af5e379c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e230080ad08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bb18a75ad08dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002261d975ad08dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba08e27ead08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d714ac75ad08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d10c857ead08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d926a37fad08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4244	DiagnosticsHub.StandardCollector.Service.exe
4244	DiagnosticsHub.StandardCollector.Service.exe
4244	DiagnosticsHub.StandardCollector.Service.exe
4244	DiagnosticsHub.StandardCollector.Service.exe
4244	DiagnosticsHub.StandardCollector.Service.exe
4244	DiagnosticsHub.StandardCollector.Service.exe
4244	DiagnosticsHub.StandardCollector.Service.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe
1240	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3812	2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
Token: SeAuditPrivilege	856	fxssvc.exe
Token: SeRestorePrivilege	3168	TieringEngineService.exe
Token: SeManageVolumePrivilege	3168	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3120	AgentService.exe
Token: SeBackupPrivilege	2016	vssvc.exe
Token: SeRestorePrivilege	2016	vssvc.exe
Token: SeAuditPrivilege	2016	vssvc.exe
Token: SeBackupPrivilege	1144	wbengine.exe
Token: SeRestorePrivilege	1144	wbengine.exe
Token: SeSecurityPrivilege	1144	wbengine.exe
Token: 33	3388	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeDebugPrivilege	4244	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1240	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1788	3388	SearchIndexer.exe	109
PID 3388 wrote to memory of 1148	3388	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_2d69ce6ba485de58e5752f376d711f86_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4144

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3644

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1644

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3512

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1856

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4104

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3652

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1300

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4584

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1788
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 21c59f288477c89dda28fc73d79222232c4d302051e57fef71aea38eee43825f
MD5 ec07a6acf65670343ead444b8da276ae
SHA1 417fdcba625a1579ee04ea8993c3633805febf28
SHA512 f91723c314ce1016845b65337c927a17382e07cce3ab68fe9fb175a51d4df8e5c078347c4902bc878e07453885761a904cd5f49f27e72d6e2ecf46d87465f1b5
SSDEEP 49152:Cb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnDVSnN7iOOMXpi:k3q6tjBWV07ioXp
TLSH
T13BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 260d29c0ba000831ad76e122498a0d892aa86e1b4c8ad4cc738ec3d13e827393
MD5 4975c430c0b387477e3e3204bb0356e0
SHA1 80bb86bcbea58708c43d8be821437af4795ed3e5
SHA512 4690722c39c3498cbd5a133e0db76c3fdc6a35a6c9befb17a623d463ed0e2f2c6094ab24d20f3b3044fcdc95d18d1cb123fc7af6a4468e9f6de2d22cc258bbd4
SSDEEP 12288:t1XLsswWkxy2lRq2czAAKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:DXYfDtczACVSnrLFY+iOOMAep10
TLSH
T18F05F12967D408F9ED6782BCC9B19512E633B8914360E7CF03E49A660F633D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0b1e3954fb9c04ce7887e422b2abb62ee10889b9fb11346c05db5a95b6bda80d
MD5 3457e1e6a8464f1c1f26ea89671a0dae
SHA1 c29cbaf496d849f1fb77cb9488aad25307cff3fe
SHA512 b3f1cbdcaeb75e542b215bb6c4a6c82072d38f448a66fd3f433b8c103c49157120c9fea1352a80f0616e736638f288b1bfd46a0b3315fbc8a0c8cba0924649b7
SSDEEP 24576:U0Le5ji0hmxnrMbVSnrLFY+iOOMAep10:UPji0AxcVSnN7iOOMXpi
TLSH
T1A635AE16F6748371D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 28f2eb139298198466a699192a9a7b6d1908578f314b80e1028fac98d94f36bf
MD5 a4674bdd9ed6a4ed7fe2913eb6b0fcb3
SHA1 ee38ee4ea96955909d5df5bc2637c763126a1b8d
SHA512 d7110578322de93a7f6e4008f1e6f3619f9edfeb9bbe7aa6885beba1b247df2d83a46bbb3e84cddcab809fa6621b3f068ff78ce7929606aeb50c6eafe1e06db3
SSDEEP 24576:ka7/ezSC6vUyDZaqgrvWx6q8wyuhVSnrLFY+iOOMAep10:T/ezSC6vURPvMHjyYVSnN7iOOMXpi
TLSH
T1DC755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 aeeb6365bb14edec85cb81cf62eb853eb02accf30f092970586c8bb39e3af6d0
MD5 25421d81569bedc5bcb38d43b80be2dd
SHA1 974d271db2b1cd0023c8e5e7c743089a3e353daa
SHA512 6b62e3c1234b4d1efacf68c24c4e2e5ac8a9c12f78c79aa3902c22920868b019b5e1864a4c5d6f472a0567371d9a54d1ae9a3adad7dbeb718f86d09556107500
SSDEEP 24576:UVbqPb88hv/lV7mVSnrLFY+iOOMAep10:UVO88hXlVKVSnN7iOOMXpi
TLSH
T135559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 6032f81617304cf70844238365f1da50b9969a3d721ecd157d63f7db182dc348
MD5 dda70ce1ada36c802b9f2596095a05fc
SHA1 46d45c2ac140cc4095be0cdd02f6e569bf4181d7
SHA512 89c2a771ca0fb0c83c2e3989707dd09f8857b18b5b5ee393fd97f91304e6abcc3b56fd33a4c108410222a7d88685b9665bc30803b37c567fe23dcd7075cdcb37
SSDEEP 12288:KGbKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:KGPVSnrLFY+iOOMAep10
TLSH
T1DCC423461C4458F6FB6AC7F106B8B072F239CEB664606ADF41E03AA64DF43ACE097351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ea057f3c2617dccb2117ecf8291b6547f81f130d45a0a1cdfe91cdf84dd6abea
MD5 7bdbf81eeb4bb62e27bbf85a30310fbd
SHA1 282a89c724cd6e0920cd81cdfb63c1b8887b9465
SHA512 4d3d727e42978e3edf495b89ad0d307005456d03ebef675f12778036c1735ac64d3014ef6221c1243f9fc305f75476cca11e82cdb051edb9b0dfbab60883d052
SSDEEP 12288:reBNUbTVO86U0KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:rJIU+VSnrLFY+iOOMAep10
TLSH
T1EE05CF3BAE28FCE2C27A8DB85791C600E77274714B61A3CBD165830EDE236E45D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1f4b576eb599f3e4e50f2cd308b6a6ba5b007f99ba6e9ef9e2282878f6f63184
MD5 cdfac66c87b318554902f96027b37d3f
SHA1 3c3bda9305575323aecd2324fbbd338f49cc0a14
SHA512 948890c3865d088d5d4711732c117e95022b8032b539541b803336008cbea849797a49a9dedaeb9174f949be0346278018579aed92f14689949a6aa9b1799fa2
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THw:dQvGAdlCEL8c/pRNw5CxV07ioXp
TLSH
T15F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7ce41b2884e75007c875c04434c2561fff72630ae624f7d6849c6f820dc85854
MD5 90fdbfc149b7b8f062435bd6a2dc0bfb
SHA1 28bb326ebd5df39a3fb8cabcd609d04e0c6e167e
SHA512 d36cd77c3afd6f84f06a35de6e92887fa6cb9ac5dd1809e6f81f04a97d70ec99d30138962d70f3f15db3037e8192ddac5e308c7a6c03820ed5894c9a2d68c6a4
SSDEEP 12288:eAwSfxL/2Dc3xDLLmt0LDQewsAjuKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24t:DwewsAjsVSnrLFY+iOOMAep10
TLSH
T16D15E031FE74E436C7BB0DB21B35D716643CAA204B611AC7E3E84E9E59702D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4803181220fef920ae4daeffed8c59a203a9bb015f76c72cec54b0175939c70e
MD5 dac01dad8e98525166e63730229e9998
SHA1 2e9488f006cadb35057966e5ade0b6fae45354e9
SHA512 38de176829c170edc5c21d0e602540315d1ddbb5d229a60373159d5d821187e16de3ffdb42321d4729de4da7c3d92d2cc44f956c74c6a13aa3da15685e55e3db
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHUAF:5UEtQevvqc2W1cpV29I32UAF
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dbc7d4f86a4d2b9c1d131adf3557f6601d26f01ab78d8cba408b8e4e68dcfc62
MD5 a3ea40f500ab18969bfb35fb5376d2bc
SHA1 b01108775bd9a9c1638cbdf71ea8b28f1a27f8c7
SHA512 a7d30acaa9c5c9820c3f560033df9127cc09eca3c653e2b0f0e388e93502b93a949902560e403891325d08d644957ff3d0261c5664d82700a4034ba87b5d44d7
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zMVSnN7iOOMXpi:UoqtVjnmtV07ioXp
TLSH
T14BD57D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bb45bb26a5236d7fc5ad70a6fdbfe25f7dded9c4dc1a42fab707ba1267c9b785
MD5 c158157be93ab101f3954bb30775ef4d
SHA1 191824999c47318ec8bddcfb9b899af945b6fa47
SHA512 1a6853266ce9d2c4e17f7b44672bae4114f7fc1f5f7720f3c33dc6aef87943d755cd7ebfd02063e7e930dbe7272e5e86b172295d7649b9eabd4306f5963576c8
SSDEEP 24576:tAhGLmIFoiwtA5l7S53NVSnrLFY+iOOMAep10:tAM1Foiq59VSnN7iOOMXpi
TLSH
T18C35AD81EBF945D4F5B3ABB899B69171EA76BCA65E30C20F1160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1ddb9af5887dd2294bdb123402846a1c79edf75be60517fc8b66223209720a57
MD5 793c48348e587319f2c49e865781f4ff
SHA1 e93b9b64c25e6884b510b434d1354502157bea89
SHA512 7205dd835ec78f396e83faeeb155f7dacfc3519c4a021247f010a68f40fd0adae4de751eb90d3c70f3cfed8c680896f2ec59ddf1d37aa31b689f4fc80f8ba954
SSDEEP 12288:9mw5HEjsChNOBFgl0WDm+CZKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:4wuXOW4VSnrLFY+iOOMAep10
TLSH
T1CA05F14636E40CF9E96782798597D132F7B2B8122A21DB1F03A0C75B5F77361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 598f902234094ae46644190a80e3a1ef3028db194a62ad6bbd5d595e8bfa0f79
MD5 ac15d6a247549b4ee69c7612e5520f68
SHA1 1cb7ec8616f33ae919f093083dfae88545dc2b26
SHA512 c4a8610aaf9f89866f52bd31185d94a05ed78639305210c1e1f31a54b89a1edf4f43d82d9491da8f6e3456f0bd9caddc2e246dad90aa6a1301530df40b7c1207
SSDEEP 12288:YbZ1IyeKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:AZuTVSnrLFY+iOOMAep10
TLSH
T1D8E4129A36D420F5F667C3B889F4A511E372B463233153CF02A416AA1FB27D95D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 eda4e3393da5ce4c0e13c5114626d41863ebbf36f119146c6db6f44f9c38e5cf
MD5 822e897c926440aabd95c09d237ee336
SHA1 2c41ccdb6a371b999319516a128feb56d0e701f7
SHA512 417af7d42056f5e24226ba46634cc05cce38e94b6442a52b6a7e2b5b01e1062a8386a9f39551e35635c475fb371af09c7137734eff8b421590687ba6cba330a3
SSDEEP 98304:BQRQyi36YOcPuLvw2gAf+PN36V07ioXp:YQyiKakX+PN6AF
TLSH
T155667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 01ae064aa94f5e9bb65af06300f07c09db7aed2134a313868d96bf19005a0c1f
MD5 ad4229916f8aebdd085145e05c96ae72
SHA1 3e4a3d2f5f56c0e3749852390226e6ebaf1aed7b
SHA512 64ce4765090c1389f0a7cf585f9c6042d2d51fee922131f3a15f157240895af33e24ff047ef3eec0494167fffe83b0ad526119df0915c069a414bdb90f38c4fe
SSDEEP 98304:gQRQyi36YOcPuLvw2gAf+PN36V07ioXp:3QyiKakX+PN6AF
TLSH
T1A8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a07f180714cb5c1cb4c5eea272a25b27fed8d6dbc11f3e9838e4d61454bc53c9
MD5 0f3f025354a1893ee5565766fb61aee1
SHA1 8285daa6ba36341a60850a42e296809fe6af8be4
SHA512 0ecfe5ae2d79a16682ace70f4803d8e58e059699016b05336f66ec35fac7b96efc99c7f0ccbce6e767e8c0f257d8e68a0777738af0c30d375a1899383b9ac6f7
SSDEEP 49152:468Qg55nhxeWu7PNU3/cVSnN7iOOMXpi:CthGRc/cV07ioXp
TLSH
T112B54933B2F200A9C44DE1769F4A973196E17C758FE0E3DB815172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8bb78f7b615f7dec1c9cfa27233a756a177091fa69a2a84ade2dfe664d9e0a6e
MD5 232a2745a33f5d4647ecc3834179bac0
SHA1 fe8e9caef00f6cdc0b2c9afbc88e195e241cb8da
SHA512 7769cc19097c5a730b1480fcacfbe13f1c12773bbdad64ae78eb2d44d1805263b1dc78c1f277433a21ede74c7bf891a4666feac6a5f463b9074a226b4e82f083
SSDEEP 98304:/y5112gYy5azzVvD69nLKnhZPV07ioXp:yLIH+WhLAF
TLSH
T197167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e3d0eb4d736900251f181de57a5bba93df4d6bf98f3d0fd9d080a2f643bb647f
MD5 b0a8b639737fbdf8ac886dc9689fdada
SHA1 f825827ca1ac3e85c71cda47c14bbfb65f75c3fd
SHA512 cb839ec1ee4127ff728bb69d4227f5ac115a8b826f5a896fd652b570d22d3794431e3d28a6ede405f0cdd043a953d56733d06b74910cc17295141d77de8c5ac1
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glyVSnN7iOOMXpi:0u6JmQxd2dyV07ioXp
TLSH
T1F5D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d9e75099fcd477dbdf442cf81b9fc334d0e6ddf2443b561ace9830731f1f6895
MD5 3fed1cb9ddd47d2333dff61599980a5f
SHA1 8ea510e2f87d694d9162f9c18170e052c9e7f56b
SHA512 ccb5ff14f2c653ae855c5da5f783972a734affc381be9143d4473a084f309ef6f84d3e3bf2d351ee20e6c9f6255a21ed84ec15041f204ef9574286d86c0360e2
SSDEEP 49152:Q1hpsNoJpF1A6yU44CwH7R4xeVSnN7iOOMXpi:QmifPVRtV07ioXp
TLSH
T17EB5AE13F29900E8D06ED17887569632EA72BC460B34B6DF0A9077961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5a9c11fa27f44dffae54edc4d8c7d7ddb4beacc413adf96635447b4509ad15d1
MD5 06b28b57043c380b9d1b0bfdd08f6ac5
SHA1 c2646fb7dfc031a39acabd8a7d478966e87ef00b
SHA512 6328c670bfa6ea4beb411f7fbbd59c8b81c99b799023d82c9ca90c7201c2a571649e901147ab55f65680b56d6e7777480dc2888855bb6845f0a402ae95b551e0
SSDEEP 49152:kSuZQIY0Be2KIRVtOnks6NMHqTVSnN7iOOMXpi:25dKOi61TV07ioXp
TLSH
T15AC5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d168e1fd04c88a02e28301e5c8b2e3b0f440e44d807e22cebe4aa6553b7783aa
MD5 01ee2d0732175eeb8ced1947543e9627
SHA1 e5dfe868720ab44614efcb5b27bb2518c9e82dde
SHA512 97965d356337d3d03080322cc6f8726b42116b7e924e4cd7e86b2cc5b7f395ea963be922ffa9552f8926c3887c4b30c257b2ce4a5504d71c40990543991fbba6
SSDEEP 49152:2htSn8EApI0figGgiDn0AP5wCVSnN7iOOMXpi:XX2i/ph5V07ioXp
TLSH
T1B395BE13F2D900E8D05ED1B4C7568632EA72BC160B35AAEF0A9077561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 78ce71bb9ce6c9f5d05e6fd7d81367bb90e13e63b0f2bc883a8c6585d34eaad9
MD5 350c59040a1307bc84cf42a55c787b88
SHA1 175ed2a0ea521092ffc4c71cf5bf9c9928757e74
SHA512 a11741f60de58e18de90999f0c84d657743aa7a4674ca16abe6f481ff82bd4cdf7f0578c36081d97312925706f96fc2afbd54c94402c4aef3fbc1495f0ab5fb9
SSDEEP 12288:ojKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:oHVSnrLFY+iOOMAep10
TLSH
T1D1C4234A1C8548F6FA25C7F142B8B171F23C97B7756026DF42E42A665EF43BCA097390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2e36a20bb17ca2d9b20487770d3c80d961b108aa18b4c149c36ebd317a662465
MD5 e9abf65eb6c70b1e58e4278f88c5a9cf
SHA1 887b3fa934479e1ba3bfb42501eca684a486da47
SHA512 83ff70a6da057aaac6dd7452e04c84217c667cc204420b9b9fc3c3448281ec5e35fed14d288f5c6ca76c8abdd7fcbd9990442a2f592367b85e57cfb3133d213b
SSDEEP 12288:D6KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:DgVSnrLFY+iOOMAep10
TLSH
T15CC4234A1C8548F6FA25C3F142B8B171F238D7B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a5efc75ce2af3995c5c9c2e99d3b207ead76cbfb9f1350bec53b6475bd7f8a4b
MD5 435c37a99248d05c6d3cdedecf3f993e
SHA1 2a69686eced53d150e2ac65a302a82ae90a987e8
SHA512 cc11adf6bbd18faeb1ec105892bfd91a9b3c72acf0adfd6ead481a845d0f8f5693ea28ec46f90a4e87ec125f736b281d00f4d1c5d98e133857c0a1f5084e8637
SSDEEP 12288:UcKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:UWVSnrLFY+iOOMAep10
TLSH
T13DC4234A1C8948F6FA25C7F14278B172F238D7B7756026DF42E429665EF43BCA09B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9ed3284e91893a5be488f2494b99088c4672e248e86eaccca61bef01f0e8ac1c
MD5 5af843a6dc49a47486a133d688842e37
SHA1 c7371e3db87deb2c9bd9703c830b4f1df2ddff3d
SHA512 1453ef9d9f431494b9c5e61dc99e382e2d8bfd44c7b6f133ab4952f284759601ab92dc9953340a9ea6e817ac2b6d03e4074c6ddcf73b8949c55ba1868b9410a7
SSDEEP 12288:PVdKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:/VSnrLFY+iOOMAep10
TLSH
T116D42346299904F6F926C3F486B4B031F379FAB6763167DF42D01A660EF03ACA476B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4a8a4411241c70215563a712df2ac5dd3b9ca0580eef2ca3030679b1cc974bbe
MD5 accb45647f56bfc36a66c5b7363542c3
SHA1 cc7bfb5b78dce3c85ea5ea94d8999abf5048cdde
SHA512 b33f9e7e2171cc3761aa6a97dcf8fcf41c9aabc8839fa03faa61772cda8abb51f8b34aba2a7c34edd7c3275a194b9780d13da2b5e7f58716160997c8d9b58f42
SSDEEP 12288:D1KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:D1VSnrLFY+iOOMAep10
TLSH
T158C4234A1C8548F6FA25C3F142B8B171F23C97B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 39002bd3ad27cb6957e2cf11a2fe82ffd423d59595811e3523bc6224f4663e17
MD5 f464b0c89e55bad0783ad221f07376ba
SHA1 7dd16bc7aac699c4c6b065c7c31ff918d0e25914
SHA512 95c347fcda622fb7e64a06b6eba7c27087d14653dc3fff98692bd609108a71cfe0949b0073b9c4360cbe9385c4fcc50f6c3a571d4b8779071202f13f458da9e2
SSDEEP 12288:FWKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:FkVSnrLFY+iOOMAep10
TLSH
T188C4234A1C8548F6FA25C3F142B8B171F238D7B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 8c6b5fdd700c87ac7d43a77213c6d305ab5d920a4c3a70a45be7905d77d256b3
MD5 983f69effecd1d81fac8429beb8d5d96
SHA1 a9877555be7c760fb7135788f0436de1e9de853e
SHA512 01e78f8b23df9963575fbaafcc1ce725853b2313211cc4dae82abd3aab05ecab5e5ff9ecdcab555a6e37a42128c541843bd2039d12aa03851d4a3419be56b853
SSDEEP 12288:cyKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:coVSnrLFY+iOOMAep10
TLSH
T111C4234A1C8548F6FA26C3F14278B171F23C97B7756066DF42E42A625EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 811a924cc4f08407fd5956831466131db1b91d102223d0374dcab1ee9f4cfa40
MD5 433879376d1598dcf5255e9a0c8a73f4
SHA1 f279e8b254421615b5c215531e371d6890468a79
SHA512 844c605e77584f2fb7c3f30e4b0f3d2fcadca56814d6d50585fc72052eb632f067e74192d16ebdbdd20e737a3bf1887d518de930557f6fb319ecd383bd55f14c
SSDEEP 12288:IiZwbNzzFEoS2cPvyaKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:LZMJzFVSOAVSnrLFY+iOOMAep10
TLSH
T16C050195739008F8EC67827EC9659912E2B2BC6A1770C65F03E436675F733A01C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 594ce30dee7d70d033dc1526822d1b32e9831a987f33507d4ceaefe14c352a7b
MD5 46121fcc840d82f1b294d756b1bdf9f4
SHA1 883fee5d682183759a06325dfb147639d76515df
SHA512 97bbd2f9863debd7e39cbfeea41d89f35dd07abf6323f5afd957c330c6a1cd9d042f3019a1c3123a4c90012304d2f355beaf62d1a7b36116dcef87d0e44e0699
SSDEEP 12288:+HKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:+jVSnrLFY+iOOMAep10
TLSH
T17EC4234A1C8548F6FA25C3F542B8B171F23C97B7756026DF42E42A665EF43BCA05B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3151aaa798f90883319bda95fd7f52601edfd450b95d6e22c9af9716ac1e4443
MD5 a4c095555a474fc3426b8ad8785f1abb
SHA1 9ac3e7e666cbfc2f422e242910cf181e602da23f
SHA512 afb006108252f6f44e5492c679fc10fd92ffa4681e1fd8a8ebe93a995ff84ee1b1be065d729785042c4a0fc1cdcf4860a23680cbe3a0f6a31ed4cf0b7bd76f9e
SSDEEP 12288:3LKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:3fVSnrLFY+iOOMAep10
TLSH
T113C4234A1C8548F6FA25C3F142B8B171F23C97B7756026DF42E42A665EF43BCA09B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d4ea1ea14e04c2829fa66fb2423ade6aa5a5a34767398d7f645d414c3f270785
MD5 76ba7dde3a0ed4b38f01e6bcf9e8193e
SHA1 04bfb538433e7066e994c299c5eadd267632a310
SHA512 383a5840b0e7546112176f7e3dea727d50f9c670b8fe19319a055ccac94c9cc2f38148a42dee37344b24016cd2b910a8fb2e2460a24f05b403087dfcba9d3452
SSDEEP 12288:QyPz5L8eKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:hzy8VSnrLFY+iOOMAep10
TLSH
T1DDF4024736A520F9E536C2B489B16A12F375B87617209AEF03A007761F773E49D3BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 636e5e6d4e7e3a0c6639daeabd57ddee91ca4defdeab34b7c12847050470262d
MD5 4340bd46d7063d2ba43a3979967dea4c
SHA1 bff6246cd3b55887cb769ede43dfbe5774d630a9
SHA512 8f626c304886854a04f57ec90cc16f307777b83750d65d4d3b7d7847e893050443fdf4774ee7fb721ac62c31087a6663985965eebe6c27569a9b7168df608f94
SSDEEP 12288:nHKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:njVSnrLFY+iOOMAep10
TLSH
T1FDC4234A1C8548F6FA25C3F542B8B171F23C97B7756026DF42E42A665EF43BCA09B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b996dbde916a4ac0d14b7bf6db8891def88cfc8991f8488c8caf7c98c802d88e
MD5 3681e2f25a0cdb6d4fb7a2cbe14bc528
SHA1 d3e6eba58e4ef6bff4384c071b9f18fe56af9084
SHA512 48f64b2a35a6ef662608377623a88200ee3649ce88a3428e5872463bb5b380333c757e9fb7ffd07744470d41aa585db34376ac59aaf4c6e2b87e1e03ff3f3696
SSDEEP 12288:8HKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:8jVSnrLFY+iOOMAep10
TLSH
T1F6C4234A2C8548F6FA25C3F50278B171F23C97B7756026DF42E42A665EF43BCA05B390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 20f8335131c1082d5582f746100c5b539c2cd550a4dddc737763d5fd2ffb0268
MD5 2eddebe39ce075de4798142fe7b5ec48
SHA1 7b9ac3eb4dbbef21db0c5b382a4711e40683f48b
SHA512 fa79fec0da1b955cfbc0602a3a79cededcd0570395183c220a6bb53d58bb981763896eac945e2f29da4f202df2291e54ffb8906f4f2967bc136626de367c53af
SSDEEP 12288:FyPz5L8eKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:Mzy8VSnrLFY+iOOMAep10
TLSH
T15EF4024736A520F9E536C2B489B16A12F375B87617209AEF03A007761F773E49D3BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 41946f956702e43398313e6bbaff3e5607838efd8af71043ec25b188d07a5f91
MD5 e3c6ee44881b17cba1a28340dc5bd61d
SHA1 230f42eca2f1291a656993eb77e278bd923f4049
SHA512 e09a11a5305fbed0f1c563439332b294bf59238dc4738341572ca89da75b12aed5572572c58fc9cd8a2fba52efbf30152c6e442ececbe0123cb24b6800f0dc44
SSDEEP 24576:bcP4mcvIjkGOxhKP2l71nNKbrh/8KBLVSnrLFY+iOOMAep10:QP4m4IpOO67W8KxVSnN7iOOMXpi
TLSH
T14F65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CF1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 ac3d066310eeb7327a60b14e883ad7560b8688042d0048649088412c756ebcaa
MD5 ce3eef9b8e9276acbb9bf1d0dd5f9ed8
SHA1 1a8e85158b8052b9428a889fa6692599f25596f5
SHA512 ce2f994b6746c35e107389b0815fd477aeb81b89c7fae963dd614034ee28a75756337129e7da2b8da783602284ce47c53614ea3e292e5a84ee503b9710dc22b6
SSDEEP 12288:0ksfXKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:OTVSnrLFY+iOOMAep10
TLSH
T1EDE4F00AD29801E8D06E92B5C765A651F3377C6693E193CF42D0F93E0FB62949DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2a381b96d8f0a4a3ef5d5bc438d8c4097d919d15c6735807fb3e0ffc8add761e
MD5 53240fc473cad1b80bd23cfc5b21534f
SHA1 070d13d4d750a0ae2720367ee5bdaac1c34961a1
SHA512 16a80099764a751e9e8c9ccb5d0ccf7190878b276afd9e7ebc6d49da4d1807d37bad8d4de8ddfa51b7041f441e98d9e5df26464deab0fbd17446d071753f06ed
SSDEEP 12288:j3KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:jzVSnrLFY+iOOMAep10
TLSH
T167D42356198848F6FA7AC7F00278F131F23DA7B66A2096CF81D026661DF47BCD876712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0ff9b20d7d9699cf8ec6f05fa098ed164ea835749a1f3c381f347d6b9ea91225
MD5 86ba04b72e6a9cb8b929651fb184d14a
SHA1 a99e1669352db5c5ba861e02b9021d24637276f6
SHA512 d0ed3c443cee21fdbcb2c828b60ee7bac4d2a3d3f478cc4c3da646c2448309b23df90a508a16343c5bb823a9388f6f2e507b5f0e49dded899dddc848dfbeff31
SSDEEP 49152:Ea0h2GEkuAe73q3pp46zwwQ1VSnN7iOOMXpi:Ea0hNYG4JwUV07ioXp
TLSH
T1F985AF1E67DC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 a1ad86a19715213dd30ec3f74e507bca693f6e6c79bf1eb63850a9e6fd19c148
MD5 4381e269dd69203fc08a31163f2b06d4
SHA1 b34b0e9e913a08877ba546f4d51b2a9a74a445fb
SHA512 14de608a591775d04c3c5d7d6ef7af60bbc2efd1f94608f18a3d786d6417e25d95f1999b75b07c17445a874d03786146c787d6e1f9fc6648b4b42ba9383c4ca4
SSDEEP 12288:mhbHjfXKKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:mhbHjPQVSnrLFY+iOOMAep10
TLSH
T17DE4127E1AAC10E9F571D2BD86A59106E331F8762721A3EF02D1427A0F77BE85C36B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2229f477fd2af763c5aa05079ab60006d32c2ac317f4f182dd295e621df845a9
MD5 3f6328e9ef3882d2d15c97d1c3e86098
SHA1 fc894fa7305f0fbff17fe161acb8b2bb4293b827
SHA512 46c175a86540d8c9eeeedea99ca4c23d302e04e70990aeb3b69f43feffb5ca719126474297d46b30506ab98aa5b5f0334b23789f4504304869614b462f7f7881
SSDEEP 24576:S3YgnJcRTk4yti+R5dBR/4VSnrLFY+iOOMAep10:SIgnaTk46pBR/4VSnN7iOOMXpi
TLSH
T11C45BF2EF2B910F9D8A6D236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 c9600a9be0ea3e6e7da441c183c83c70176e79a2c9d94cde50905d3121edb726
MD5 c0ec61189f9bc6bd2166e6a12ceb4769
SHA1 dfd4392e0df4d822ee445432bd5163d656351fab
SHA512 6b8013f894298ddefbc64ed57e7c6c9802a590a4a1899f20d25e476c869e259e1d0896a41f5237327e73bb1352518767c4abdc91a9b1a1a90679c8737d6419e3
SSDEEP 12288:M7KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:MvVSnrLFY+iOOMAep10
TLSH
T1E5C4238A184948F6FA26C7F50678F131F23897B6273126DF40E42AA65EF47FCA076351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 19d0bb3930021470027b97daa84f31f49afc764d1931a1a8bc834ebdf9d6f0b3
MD5 f1572a92f769aaeefab370f349487d92
SHA1 ad02e96a38184d08959b3ed60fbd3b2572a8dd6b
SHA512 3f96f60ea8a234ff4674302741630beb09c8f73cccb89f910c94ff4f5e496f93446b7fd47dc866505ccb55c22f90fc39b49b047e7d23867ed1091b2ea8b1ce95
SSDEEP 12288:AObZA4LWOsvAYFTAKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:9tL3UTCVSnrLFY+iOOMAep10
TLSH
T1E6250155E69400F9E97BC27CC9B69522E272B4AD0360E7DF03A84B661F633E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 cc89a63ce884b2d2a8f38522f89b4c82d81e8e7d506bdaef3b27f9a7c2dcc6d7
MD5 5caa4a20da54bd9049d46b72fef5cd4f
SHA1 ef6da705f240e04dbd891d875a3d961ff6a95314
SHA512 234af51ade916e4bc3de32191ea1e3c24297fe5c89219219a4b99acaa645aab4d059a232300dd63d525e2220584fbe949a28588516189e92c647b04048bae545
SSDEEP 12288:CpFtUOUKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:ZOeVSnrLFY+iOOMAep10
TLSH
T17AE4021A36DC10F5E536D2BC86A69219E371B866172157DF02D041BE0FA3BFCAC3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f72a2e3db79d9235b11806b322c287c596de4e1e593c6ccf60e0b11c4a1eb4af
MD5 00cf92684b82243771d6eec5464299bc
SHA1 aa5a91923d4313240956a69a6623d82868e1b93b
SHA512 9e51f25722c43d5f965b5deeae279276dc7f59c3a795c7b5d8d1fe0c1bb3778430822d038b828d458584e10fdcea6eed6ff17fc7382d336f0ba982d292899fba
SSDEEP 24576:E7NM9YqZqmWMUkPjZM48Mv6bEhsjVSnrLFY+iOOMAep10:E7cBWMpPjN8DbEhwVSnN7iOOMXpi
TLSH
T11C659E2E6BEC81E5D577D13DC9A28205F6B1B4611B318ACF1162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b54546927c196ebb87d5bb18d715b98398d85f52ffe2cb8a1e74f37aee89c5c6
MD5 590ed9c9ab342c7f6662b9127a6a3135
SHA1 130cac84e7a27d33a98a64180c8e8e76775df4df
SHA512 f15807fe4317b1b639a276d752e2bfa9a52374fcddbb5a0944da39407334d58162ce9e7e4bcf75cf281466a211cf682e5ef74690a29f5a45f8d013f00008d185
SSDEEP 49152:HF2YuHNETovAvNYf8kmDVSnN7iOOMXpi:e6BCf8keV07ioXp
TLSH
T1E0858E6927ED80A4E0BBD2BD45B6D246FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f6deb5759424a44863dbc5d7376daf09b1db5eebbf54a2753a8314e4f1bd8390
MD5 c0d061b9795cae9099016e359220c0c6
SHA1 e3beaee70ed35c015aca5ddfa9c8f3212fa98868
SHA512 a821a992ecee173c8d9a841a7118db07c8b900bde72ccfdf84df521d22fc602c7a2bcafe3cfdc68f196c0841ca77b16588740f7e473258b81cdccf9325e9c0c7
SSDEEP 24576:cAFs06+Omlf8NXEbToaVSnrLFY+iOOMAep10:xFs060lYXuVVSnN7iOOMXpi
TLSH
T1E365AF2F66AC00D5D07ED17D8A97C91AF2B1746307215ACF0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 09080e90b0f75678f31cb8ed758fabcf20c6e00192c515adb84cc22c373fec55
MD5 00726d737f9e1819966fec9f6458748e
SHA1 27858153127fd996bcc40440d20ad184ad9f8010
SHA512 f0855bbc9a034d7c1b6d9b556bec72ec7539b37a95bab169ac6bd51a3cd6a34d6a647f37caf7ec92c114754091043019ff9a6cde588a025a4c35e6c7f58a6399
SSDEEP 12288:OCJnJ5D3VkrDzxnKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:fJnJ5D3WXVVSnrLFY+iOOMAep10
TLSH
T1AC15D02DD2A810F8E4B7C2B4825A2756FE72347D2B226ACB14B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e7ff0e513983d6214ab40208e94f34b467c45bf8d9903d82095d10ff5d3e22e7
MD5 e8b26afd6f6a0a18298d0f8af8a65793
SHA1 3868b6103673ef4072c483244dbcf7afe28a145f
SHA512 56703248bcc66dc2f03229dd646b0519f78223b94f9c1d619fdd98014f3574677bb76eeabd5d27d43cca3e5f99d2a33f458054c4a422806625f35ff650488cb0
SSDEEP 49152:Sg06DIKdwc+eQnSt65aVHVSnN7iOOMXpi:LJV07ioXp
TLSH
T1F5955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5faacc992aaf72d233e82fb08f2fe3a05f389d6caa2456fe00b54e769483d5be
MD5 cb3f0c92b8e42860b720ad35209df494
SHA1 6e2804e14ae23fc69820bf65f92e791f6ebc9d02
SHA512 10132d9369a9a24374668be28200884e87b0e637f28b4076df491c1ddc55ec0c7e47315fbbb8e297b1537a2e552b4ae9f8774bffdd6a8fd27483eda59a64abaf
SSDEEP 12288:mEP3RnZKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:lnBVSnrLFY+iOOMAep10
TLSH
T1F7E4025E2A9C60F5E526D2BD85A08115E372F071272127EF02E1827E4EB7BFC6D39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 bee1c937d7d9843dfa28cfde553f9be60157893b924aa57c6d2800dd542e1b11
MD5 7a9f2e4e3836b9d7ca7fe6eec3a8af5e
SHA1 c68e63a205798cb3df643bbd6873aad15dd8cb56
SHA512 974259bfc521523387f73d67f65ce115d8effb1ca975dbe21aca3c4e6e89d4ab77d2fc63bd336610306cba95a7ae647c9c802d27b4d9a2f1293333e01286629d
SSDEEP 12288:tjky6KOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:tIygVSnrLFY+iOOMAep10
TLSH
T10DF41209278854E5FA7683B8867691A1EB34FC316B2053DF40D0B63F5FB67E8A835B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 5fa4cfa197aca324d8571e305448de935f430245010d0c869a930ae141590390
MD5 c96e40b5bd9b01166425c30531a538a2
SHA1 a3343cb080a6ea0311e24581c1ad456155116751
SHA512 94d2a790708c7f958c73e6d27f8ba2384d737801946f6ebbabd804107ed77700125b20611d76b0087dbc15555cd1f0e4653bbb2562ef83525a70082df6b3795b
SSDEEP 12288:CyEKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:LuVSnrLFY+iOOMAep10
TLSH
T192D4235D185558FAFA26C7F50278B571F238B6B6272026EF00E066768EF53ECA077B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 53b86bf6b8e6e28f5ecd0053e1a0dd159afb9c9f68adb6260747ed5ecdee3efe
MD5 e87d21b56f45e7ec0b293993d59bb6da
SHA1 13c4f2dfdfbbcd8d2a27ccbe9b57d620f9ed5264
SHA512 aa92c7ef2b2725914b450822df87206ca6cc887cd5db3b835994eb1aaa682828c2130095c775fb5bb3103cb234173d06f990713b71f8dda5c8b36bd455a452f7
SSDEEP 24576:+Q9MxZKdcz9dw37VSnrLFY+iOOMAep10:+VKZ7VSnN7iOOMXpi
TLSH
T18B558D2DABE905DAE177C27595B250C3A633B4311B31D6CF2448D03D4DBAEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 c47d6954165b043838debff0c561b59c2028a3926ba7b2e476eb92ecf8fa2754
MD5 b9a34426d790d882cf93e91578c580c0
SHA1 654c4c8e725417286d529ef8755e3303a5411b96
SHA512 ed5845eca57fcceb47888c9a6020e26fedadae06f65277bfa481ce6d7b18a4fa95dc1608b86db1d6465879e6e067ba83df5894271e339b9e11bcc5e55e4029fa
SSDEEP 12288:myoKo2JRple9puKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:myocDApsVSnrLFY+iOOMAep10
TLSH
T172F4E01F7B6940E2E176C23C89958255E773B0702B6263CB5191833E4F63AECBD39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9401fe94a9276fc135778ad610e1ff17aa6e8e20841c91d1cf50bc0f7f94dee9
MD5 bb54211470f525a8fbb380c7fe4717c1
SHA1 c0c32989bbaf0353db8684c2b7d48c0bf14ef6c5
SHA512 a3a7553fe2d96593b50d67c2106819f8a4c511f0fed2314d27d1118c234768b57be011d831e9dc0b95e8864b9e122eba94e8f6576a7cb483568b53c89522a3d7
SSDEEP 49152:mWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKsVSnN7iOOMXpi:w0zuNICV07ioXp
TLSH
T184A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b61c96c97bfaa4f23b3db71d35ec5646070acfce96fe8ff78ca7766f63090ff1
MD5 827c7a46cd9971235f478ab2f50ee769
SHA1 aa16e72aa96f2c5674195208c4520c9eb2ba91bf
SHA512 67a85b55f8ff6168a307f028dbc81b81ab61bf1ee954ad6c51264209fefb612d3cdf92367a17545923b02d0abb43cca54c643332ff6a7aa158a4179a8daf3c9e
SSDEEP 24576:31QT7EcpfxR+N5AWAz3ooiYqjMqbBVSnrLFY+iOOMAep10:KTDxR+N5YzTEjM+VSnN7iOOMXpi
TLSH
T1E655B02E67F815E9D17EC6798A23C512FA727861033193CF42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 06850b6f2d6e862e3c8fc16e7193419368320690e8ebaeae9c9ab2a853824e46
MD5 3a365c8eea85097582d041ffa55dc3d9
SHA1 3c24d0685f7e34ad67a426742a6f8a9cc51b7e7a
SHA512 dcc5d9df65c19e4bb088b1e6d3919bb6dd17c91e8b8b8e34e9de9981bb28418b781eb9b03e92061dec4269c0155e6df7d17cd095f23016ae53acc90f143e4020
SSDEEP 24576:BTMdOz0FFS+vmSLtVSnrLFY+iOOMAep10:r0K+vmSLtVSnN7iOOMXpi
TLSH
T1EF15F13E67AD14F5E43BC2BC96539906F6727462032166DB02D0C1792F9BFE8793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 9666cf36e77d29a3742da1cd9b60a5d2ca2a2d2a27723ddf84bbe2eab5848326
MD5 6b025b6de113ab69ead5bdfb7d58beb9
SHA1 964f023470cadbd93c7fac64bdab488f62d86296
SHA512 92664847340c63b31deb8c0e9392d2b81bf13591c6280e2cbe3cd229eabea675c40fbaa43238d4ad48c56325883bab007bf1e7c740d413340bbcb9ff439d5cca
SSDEEP 12288:04KAKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:SCVSnrLFY+iOOMAep10
TLSH
T162D4124D26D824F5F976C3B48675A121E230F876232066FF11E09A7A4FB67ECD439B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-113-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/116-168-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/856-53-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/856-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/984-77-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/984-83-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/984-76-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/984-156-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1144-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1144-369-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1148-399-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-401-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-458-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-450-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-457-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-456-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-392-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-393-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-394-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-391-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-455-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-454-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-453-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-402-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-395-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-396-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-397-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-389-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-398-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-400-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-403-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-452-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-404-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-451-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-372-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-373-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-374-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-376-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-375-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-377-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-378-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-381-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-382-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-383-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-385-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-387-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-386-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-384-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-380-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-379-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1148-388-0x000001A227780000-0x000001A227790000-memory.dmp

Download

memory/1240-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1240-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1240-33-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1240-39-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1440-364-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1440-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1644-67-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/1644-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1644-56-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/1644-63-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/1644-69-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1816-333-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1816-144-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1816-137-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1856-104-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/1856-164-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1856-103-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1856-109-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/2016-162-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2016-367-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3120-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3120-154-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3168-148-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3168-349-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3368-120-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3368-217-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3388-365-0x000000000CD10000-0x000000000CD18000-memory.dmp

Download

memory/3388-174-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3388-215-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3388-183-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3388-199-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3388-371-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3512-72-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3512-151-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3644-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3644-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3644-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3644-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3652-131-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3652-124-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3652-125-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3652-282-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3812-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Download

memory/3812-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3812-71-0x0000000140000000-0x00000001400FC000-memory.dmp

Download

memory/3812-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3812-390-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3812-409-0x0000000140000000-0x00000001400FC000-memory.dmp

Download

memory/4104-368-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4104-116-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4104-173-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4244-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4244-102-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4244-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4244-18-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4484-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4484-101-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4584-370-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4584-170-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4852-93-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4852-87-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4852-98-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4852-160-0x0000000140000000-0x00000001400AB000-memory.dmp

Download