947dbaf6cdf8bce8000f3a7a1e8c4a7fb9e775a2e7c7426f2c6130e49761c99b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_8e8991ed71a59433de40f24263cf81a6_icedid_njrat_ryuk.exe
Size 3.2MB
Sample260804-g32cssxyfx
SHA256 947dbaf6cdf8bce8000f3a7a1e8c4a7fb9e775a2e7c7426f2c6130e49761c99b
MD5 8e8991ed71a59433de40f24263cf81a6
SHA1 ef413dacc9cc611bc5e193c3a8dfb4e953736254
SHA512 e28e0a0090212d38c00fec38aed1a75e9b8ebccd0580959731901ca56e8403a45c787b70040404662c61ab9a283c93568f94d0b807c50bcb06c638be9de1237a
SSDEEP 49152:0ROwnZuS95gEFfFoTJ0YLjFcC55LcIaRBZ7b5+Pl6bJTIZ5jdgp2:7wnxRAq8ctBBslgJTIZ5Bgp
TLSH
T10FF54A23B196D0D4C01DD074CF165BB2A6A07C69CBE5A3DF06D87E217B35AD07ABA318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2700	alg.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
4500	elevation_service.exe
768	elevation_service.exe
4672	maintenanceservice.exe
1856	OSE.EXE
4972	fxssvc.exe
1144	msdtc.exe
4120	PerceptionSimulationService.exe
2260	perfhost.exe
4388	locator.exe
4512	SensorDataService.exe
4264	snmptrap.exe
4720	spectrum.exe
2356	ssh-agent.exe
1396	TieringEngineService.exe
1904	AgentService.exe
3680	vds.exe
2780	vssvc.exe
4716	wbengine.exe
3656	WmiApSrv.exe
4396	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_8e8991ed71a59433de40f24263cf81a6_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_8e8991ed71a59433de40f24263cf81a6_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_8e8991ed71a59433de40f24263cf81a6_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-04_8e8991ed71a59433de40f24263cf81a6_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\799b74bef77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000648312b2d923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f53c4ab1d923dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e9525b2d923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ea04cb1d923dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f4193b2d923dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000534374b2d923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe
4500	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3620	2026-08-04_8e8991ed71a59433de40f24263cf81a6_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	3712	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4500	elevation_service.exe
Token: SeAuditPrivilege	4972	fxssvc.exe
Token: SeRestorePrivilege	1396	TieringEngineService.exe
Token: SeManageVolumePrivilege	1396	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1904	AgentService.exe
Token: SeBackupPrivilege	2780	vssvc.exe
Token: SeRestorePrivilege	2780	vssvc.exe
Token: SeAuditPrivilege	2780	vssvc.exe
Token: SeBackupPrivilege	4716	wbengine.exe
Token: SeRestorePrivilege	4716	wbengine.exe
Token: SeSecurityPrivilege	4716	wbengine.exe
Token: 33	4396	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4396	SearchIndexer.exe
Token: SeDebugPrivilege	4500	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 5412	4396	SearchIndexer.exe	129
PID 4396 wrote to memory of 5436	4396	SearchIndexer.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_8e8991ed71a59433de40f24263cf81a6_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8e8991ed71a59433de40f24263cf81a6_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4672

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2676

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1144

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4512

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2356

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3568

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3656

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5412
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 115ded29f2477edd81e90bb5ac3ab1a76640b49cf4a498f24443b43cece1bb08
MD5 c483769fb39f03aefaf81b7a810918f7
SHA1 96dce4aad4b3eea0c97baffb8424c7f6dc6e6f9a
SHA512 1076401e68285bf5eb1ef66d32ae07c15ef0a535c34b93cf03d8c53c1c5b21ba08c09d856b5f5156fb7e87d740fb1db85d377cbb683ffd868da2e65e39c8a532
SSDEEP 49152:Rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnEb5+Pl6bJTIZ5jdgp9:X3q6mjBbslgJTIZ5Bgp
TLSH
T1FED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 dc46c2cb3288c8ba812433f4fc54f2ad8f6c671f94458eb4f031328a536d6ab6
MD5 3bf4ecdc6faabb82e74e17c139bd05b7
SHA1 30d96e494f9751d3c1850b7f0afc36ba910aefe6
SHA512 bc59f5c80276c6751b5638f3dca8f3dde934830fef531b0c4c23d0875c8096c48628b1b7ebb1b968f09684c312811dce4756d7f4e2599bb283db29d8b73908ff
SSDEEP 24576:JXYfDtczA8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:stcqb5+Pl6bJTIZ5jdgpc
TLSH
T16185F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 6e4bb3ab6b40c9452243f442c9db97966569fc83419f7ba7ebde61af906923c5
MD5 a780e5a4d38e168634f3c11119e55d9d
SHA1 d8cfefb3a6e87ae66887d0f933ebcdf206cc6c48
SHA512 320c23701dfea33744bd158ba8e99693e4c9e2e87be18b7ba684f4c34a7f357e925a6921a012b0225452d95c18b1b29a78b4e5407117f642de1f53e7ab4bbb11
SSDEEP 24576:I0Le5ji0hmxyrMxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:IPji0AIFb5+Pl6bJTIZ5jdgpp
TLSH
T1A895AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a9153704f4b336c400cd93471b3e45180b849861c36588ab2579c426ff35e289
MD5 a8e692c8488d572751567062b6ec3802
SHA1 6ab5a6852f3f805cec470722be83650a8a03a5ee
SHA512 d6f6524f2d5d79b6ac2b6de048a2550fd8b2c9099b7a5463400d542b9f4d018128fc1f81461d8b6acdbb9dfcd555363d56bce289e20950a5ac9e9abfca5ff008
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWj6q8wyujmb57GBiOl6a8JTth/RWZvR6wQQ92pN33://ezSC6vUzPv+Hjypb5+Pl6bJTIZ5jd8
TLSH
T124756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3f4f09388efb8f3e53326e1d8a8441fb9e58a8c34c1e2a8a34ea9f8016bf4c4e
MD5 02296c4a88a9fd5713c94b6cb7c2b270
SHA1 82d727efe03638e8dcd5f08e3a249c7d86786080
SHA512 9c7c8e3527b340c53bc3c7983c275e0b224d56f0fb47147d9fc7b6559f984ed52d784b836b160584d5746d01c55de4b6da60dc0e0faedc08daf79a5f568c7cb4
SSDEEP 24576:aVbqPb88hv/l+BAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:aVO88hXl+lb5+Pl6bJTIZ5jdgp1
TLSH
T146559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 295909bc8b3e21488927c34f8ed040db860b784459665c85c4b747c500160901
MD5 5485b6257b9bd759052da2ed76e52e19
SHA1 4e1db6881435879c7c1aa60a09a4b57e5d4cb4e0
SHA512 75a750639b0bbfc3b0504dea936692d1dca85d49adc232d88c264ed546b79877787474df83b574b0cc52a3f47e70655f9cfd5dd8fa61d87da80d7eef811bcbb9
SSDEEP 24576:jFFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:eb5+Pl6bJTIZ5jdgpz
TLSH
T1D86523834B6930C5E5AB1739E9CDDB00F879EF55CD866BB6C575282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 3b9651aed2217fdbc9f65415edc8f0387098faddcea7107b78de827fda4edae5
MD5 cbd17dab13387cb3c8106c2c314b1768
SHA1 457eeb7e0ac400389ebc1f2514c57930eefcc338
SHA512 a00fbfb23e70e63e9b366f954409d45525dff93f6fd53a4497484154cae4eddcbb668ccd72d637258a6ee18fc70367c02e3298c0d25fd9bb0c49aefadc7066b7
SSDEEP 24576:NJIUImb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:NJIU/b5+Pl6bJTIZ5jdgpM
TLSH
T13085CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c0cc8ec497e08d286aca5bf2a1dced89b211a0bad3396cc8a04fbf528884e5a2
MD5 30e5060cfdef1e6f756c359ba363d159
SHA1 f435451d26d93774c25aa93039973921c5983d90
SHA512 c147c17872c8387ce2b57eceac46717669d3a4579f276ea71f3090842730bca93642056a6e61ded8da804830a83e6481e210e73bc1951409c8b50dc7c96fffeb
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH:DQvGAdlCEL8c/WRNw5CAslgJTIZ5Bgp
TLSH
T1BC266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 9bc89d80e50742d27cf47483c8bd57ea0e61658c1078e0833a47cbb591b101bd
MD5 e959fdeb88ea7045195405f93a768d97
SHA1 cef3de2ef8f151f33c362fe79bb51a39f0f8be71
SHA512 0c048e09d91c1c0f0fe0119205b42cf3b70821e2fe090ba9e040f527551bf18e65af61eef8ea6e2e78dfa0eeacf836bb9dfc7dfe2fe912f69e7b9545b1388ab7
SSDEEP 24576:/OewsAjqmb57GBiOl6a8JTth/RWZvR6wQQ92pN39:2ljVb5+Pl6bJTIZ5jdgpj
TLSH
T1C085E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 af54b319e67bde9ba35da968085314d9fb49641bb65644e89806caa6302b1934
MD5 fc6d71ee84a3fa89e2de93bb26204bcd
SHA1 9e19e2ccb1612615aa4c684bff462c09df4f5fc7
SHA512 293288a726f7988348974d51395728a721adeb967d9d2194316a25f79012612aa4935e6292cb5e9d2ca96ae9e20448563ce1e3f8763f092cff3ffab6edcf140d
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHZsT6p:OUEtQevvqc2W1cpV20I32Zs
TLSH
T1BC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c5b8879e51b1e77d2f0d5aaf161fd02e2afc2eb2863c04ad7d7cdddd1ec1fc05
MD5 345863b9191638861c23dc8d3fab0ace
SHA1 88499d9647cae57e192c2f6c9058969f789097bb
SHA512 8e42b8a38a05633462dcaa9f5fd6ffa981528b4511216f9cea0fbf4b53961db61fed0e2d6f3efd76a349364bc5705ed9564e4e5b1d126fd154a23efaaec18ae8
SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/z1b5+Pl6bJTIZ5jdgpc:/oqtVjnmUslgJTIZ5Bgp
TLSH
T1BED58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5ab68c5080cea6ce68d2db951b3cbdbbd47708daa2cade121802e2979b5f2801
MD5 2ed086af019edd0be8ac9eac14e1246c
SHA1 654be42a95e523c0e995de79849b3a0ce429f682
SHA512 00cc7ff684009cdef70966afa1d825a2abbb4b9d2e9636b708dce7cf53bd2bb5d56417ddfd872720c7c53bb41dbbb0ea56e6df096a0fac2c148b91a8ca8903f0
SSDEEP 24576:ZAhGL6IFoiwtA5l7S53Pmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:ZAM5Foiq5+b5+Pl6bJTIZ5jdgpZ
TLSH
T1B9359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 fbe903876dadde3429e77118448a0a0c46719e7653f529772528b11117e2b7d4
MD5 6fbfae0be08b1a86a84f82d85a5753d8
SHA1 9b24d57758cb2fd041e8f123df499161fb63267f
SHA512 82a63c181a84d67e5cb286a008476808e834c14d1843f9a3f59cf326c181bb5095794bf064365fb9d4caf8700a2f608b44eb239dc421e89093fa813658985d24
SSDEEP 24576:iwuGOWGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:iwNOCb5+Pl6bJTIZ5jdgp+
TLSH
T1F575F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 dc1cbb156dc327717c94ed83a772deefb72553638789ff9a35b66cb0fd940b78
MD5 31b709eaceb3ad7aaec35efeb0e7ab42
SHA1 9674146461e00f4696f4308769dc8b8c28d552cf
SHA512 6dfc516b6e3ceb4b1ee40f0601d076b5f18cc42a2adfaf43e01b9a0b080cba2791ee035115725a30ba55fec55ba43db468395959cecfca2fee0c4ea8b8cc1587
SSDEEP 24576:LZuZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:Zb5+Pl6bJTIZ5jdgp5
TLSH
T10765128627A830F9E0A7533DC8E58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f3dd3b7b9a0a032f659c3a812d0d8655a6872e9b04b5c13cae475e2e06a4c3f5
MD5 525492798f51fa0ae659ccad0e053f73
SHA1 03bd20df8210962aa20864e4b18c227b401a8c49
SHA512 c139eade467c507c4c7da2b8f49d15a14d72debfaf3d320e1551c524b4efe8975ae8983603e25d1f788c66cb90503285f97057cee1c0d66c812245d2934f08d4
SSDEEP 98304:sQRQyi36YOcPDLvw2gAf+PN3XslgJTIZ5Bgp:zQyiKanX+PNnsT6p
TLSH
T15C666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 614072707bf3cd5ce678343e0370f6297d11d0c01afc99416af807901daa17b1
MD5 05e6f23d164428d69b2598acfb60cb29
SHA1 1d91e6165f67ca944f403361a4e986b6d8c68e02
SHA512 f04a71032f12ab1139977ceaaa6aefebcc6ae24c8faedc9685286e55bf3bb6920da84e90683d53a9a73cfa3bff59811b6c8da1501066958a9782486017b8b14a
SSDEEP 98304:TQRQyi36YOcPDLvw2gAf+PN3XslgJTIZ5Bgp:CQyiKanX+PNnsT6p
TLSH
T115666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ffd5928e8dddfdf981561630f4cd10086ed69043eee14c84577460e27bddbd07
MD5 8fa5728282ef435d8c97d725da7217a4
SHA1 9da4a9d2f89943f8b2febfe7eb354c684e7c999c
SHA512 5f4dbe148ad72dec082713efbbc891b106d29ab1275556136a48861af6fe88bb38d8902650abedd7d91b66f4a5cec0028385cfee47c6a16b25cbf87ef323bf05
SSDEEP 49152:T68Qg55nhkeWu7PNU3/Fb5+Pl6bJTIZ5jdgpw:NthTRc/BslgJTIZ5Bgp
TLSH
T137B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d64723070d2b7110409155b41d3cad655417032d0911181cc91be33ed77f18d7
MD5 3d6a359b26b3f020c44b27e164940cc9
SHA1 7adb17532a437ac537763d70519a4b9569fc164c
SHA512 a3f54ee51183053fea9be9ee78c492dea2d0c6025fda3def1496d69c5fb08bc44f60e1b1bc551917cca4800af499ae90da00978f05e754b678ac4308a093e9a4
SSDEEP 98304:Ny5112gYy5azzVvU69nLKnhZGslgJTIZ5Bgp:wLIHRWh8sT6p
TLSH
T144167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bc8eb65001a042807773d3f008cf9e7829c0ccfc6ef5736c3b5bd085f17d2096
MD5 81ae360ec6c367635b793f8b50fa9c61
SHA1 cc67aaa0693dc46a97ce9db16b59f3cdbe39af74
SHA512 fb58dde5260ca3e5a4460d5d0b34dcb4ae727233a6c9188f2eaee3759a73804659b148d44cb7bfca3c4f87e2df09a20e5b20597f0c63875100d5695180ba2b91
SSDEEP 49152:AB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl7b5+Pl6bJTIZ5jdgpX:au6JmIxd2dPslgJTIZ5Bgp
TLSH
T121D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6283e7fb3973f64bec4baec52f88562f8080f8edbd18b30594090f872be2bb97
MD5 e28cb88d1b81a6eae6112f6435e6ca89
SHA1 8a27e0e032af99714caed7d19e6e209bbb39ebb5
SHA512 183c65523f73fcf2409950d9cf28ea851e90720c28ad6a2cf4cfaf0a20ebffe06bb4fe0b0562efaa3b4444b82cb3f4f292a1028fcf90230540270b7cb7b8e3f5
SSDEEP 49152:S1hpsNoJpF1A67U44CwH7R4xfb5+Pl6bJTIZ5jdgpG:SmifPqRUslgJTIZ5Bgp
TLSH
T138B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 207668e7a726c76fdfeeb8281d9b1d5621066cf0dcd32ab19c6afb64023d6b4a
MD5 17cbfc9b72747419bb84fb73bd8d17a8
SHA1 17df091b6589375aa091331e19cd92b557292fba
SHA512 755097f1fc69bc0ceac47fbc965ade6f8e2de26d0056ecb80a5a051e983b96fde6fdc6ec90382377514b0c3de3282d4c53a162f0623e5017b9fa3b04bedcf906
SSDEEP 49152:kSuZQIY0Be2KkRVtOnks6NMHqUb5+Pl6bJTIZ5jdgpt:25dKqi61CslgJTIZ5Bgp
TLSH
T180C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6e19843c2d8c3dcec3e9229e5e1aa24921596ad2f17023405036faacc2804604
MD5 8e02915ceef31dc9e77390137874d2cd
SHA1 ecea48db7a002a0acb3598ef1dabcc2bb334c220
SHA512 b112243cf6807d80ed7e0a0f2ed4ff8efac795cea6e33e431fc7991f4b8d493271a979aa32e0a6a437ecfaeff0ac5f5277d64f3e594be6c7af61bf97d787729a
SSDEEP 49152:+htSn8EApI0figjgiDn0AP5wLb5+Pl6bJTIZ5jdgp9:fX2iWphoslgJTIZ5Bgp
TLSH
T1AD95BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 99175ce0f380bbd2a6838a1ab3f9b6c241999ef04f08596006cf6fb8283de0cd
MD5 d7cecb0dccd46940783bedecffac1e4c
SHA1 b3c184ade8c3874d18e689950b2fe60cd2270908
SHA512 69f2b9edefab9fc56ccfcefdc48706ba78bfdd55c6951011b898faee5a9931ac694e78938f3c6bce80452a5fe1ddb9beaed2dad73c4df5272e7150e68a8fcca2
SSDEEP 24576:Btmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:yb5+Pl6bJTIZ5jdgpO
TLSH
T1806523824A6B20CAE09B5779D9C9DB00F87DBF56DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a335d3f2431f58980e1ea522c62e0b70064b8f68a1112535d1c49d809e6022f9
MD5 345f84b8c6250d7c9dc63c5e547d43ad
SHA1 43167f407dfb7b83557e853344e39f352a87aa42
SHA512 ed671d206cd9bbbf5074994ecde6648efa3a3a028df295d445383b90d11b44762a861d867c5f687faec6d7722040c709bfc197aae54552e894e49128a8bbee4d
SSDEEP 24576:E+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:4b5+Pl6bJTIZ5jdgpO
TLSH
T1626523824A6B20C6E09B5779D9C9DB00F879BF57DE8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 07a5696a587515d31bd588691125efe6749afa705182d3f061c47b8238377b7d
MD5 bff81031f18345ad3415a237aad9b874
SHA1 37d619004a03732adaadd5fe88e1cd0c476a61fb
SHA512 f1aa25804a0ab4afef8502dcc1b988df93ce5c2b438c3ce87289a6b4862d98860bfde60bcc6df3ae2fa1c55ac89d0697a7164ef0844722681511bc3083a89eca
SSDEEP 24576:jwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:Lb5+Pl6bJTIZ5jdgpO
TLSH
T19B6523424A6B30CAE09B5779D9C9DB00F879AF57DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 885a140ff6b8c2de68128858962ea9a8335d07ff7642afb8e60e70c2d30b4627
MD5 a50b5535d53a961caaf8edf62185b3c3
SHA1 8f69b89611223f29c26dc6354863dd190d719332
SHA512 7e6896da3d562d6978c8582d6066b0a55c0df4bc3df6f535f95904f66a4baaa94c08bade72f20cffebecb1d81a9f3737798486c0dfdd6f8808df73896fa89846
SSDEEP 24576:0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:Db5+Pl6bJTIZ5jdgpe
TLSH
T1F66523424B6A20C6D4A79379C9D9D700F4B9FE96DF5267FFC675082BA931388383134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 97569f4f410264fd2540f297b09341fbc999ce38516ff451a3e8bacbd04727bd
MD5 f5142fd48cbb22955ecd12342e9b6e70
SHA1 44bdc1b48fa5fa08d43d8bbaae2ddaaadaf50eb8
SHA512 c94d1d4db3a37fb145f4f74a0837a378a427f0a99e6489f0dea0d874006c45760162b66313d11196b145667c66ec8ca88fa56c691ce7e9f474c9619ab0ac5b1d
SSDEEP 24576:Enmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:Nb5+Pl6bJTIZ5jdgpz
TLSH
T1716523828A6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C67D0427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 18a89b6ea4b490d1f6d68fe4c0fdf19f84f4d04d107781636d2c5b98db682b1e
MD5 b8a6a035dc4fa287788f12b8c5a00dd7
SHA1 9fb3e428b4f144e5664cf0f3a5a47f40d6532f3f
SHA512 0d7734900e071edf61082a271c54d79a29585d9ad8dbe03d7644eedb7ee880afe77e0d815e6959b24bdd48039056e46b0406d6971a61aac96a2c6ca068cced4a
SSDEEP 24576:NSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:Pb5+Pl6bJTIZ5jdgpz
TLSH
T1486523824A6B20CAE05B5779D9C9DB00F879BF57DD8727B6C67D0827F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 cfb121e36b14d2c7ddeb0dfbe3d4447933ba9019fc8b04323045a1ef1bb84b4a
MD5 c25b05e49c0d89fd45d79a8fd615f94a
SHA1 7f6cf2a540e8471839ad40c02fccf8a1d1bd9cba
SHA512 46f1d686d0703780fe5db16d069fa6a34636418c79d49cd6d3187357c86dbd90abc238a56b9b35f870da3ee41e22a45507897ff4ceeec200b9e7d5a6233b313e
SSDEEP 24576:s2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:ob5+Pl6bJTIZ5jdgpH
TLSH
T1CE6523428E6B20C6E05B5779D9C9DB00F879BF97DD8627B6CA7D0827F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 a279be666f892880e6ebbeed7d1e0b9b6d08ab437e544bb6e7bedaac402597fd
MD5 6e3de51e571ac660ade3ad242718001b
SHA1 b29c363cf9a01f6bf6100ac91fe41371bec52e40
SHA512 dedde16e0afe3596442dad7d7eb884e0278a19d7a9141e98ea162ee30df002dd7f6036f65c2a562b31c1bf459208544e8634f8f7f9c871277fa5ba61b1717625
SSDEEP 24576:5ZMazFVSOemb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:5ZMazftb5+Pl6bJTIZ5jdgpl
TLSH
T152850295B35018F8EC67823ECD958A05E5B2BC5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 4f31b9d7892c3628a526d9bd9211ae498145e62334f8c5dc7bd90e8771b255ac
MD5 e7fe4217bfbb416a387a8e21888656e6
SHA1 a52b637d313494c2174a3a3065b2e7d98bfd8a5d
SHA512 def0ceb9c0a59ccfe72bb2fb329d510add976f649cbadf8c124475ac0ccb7ea2ff4505cdf9275d913f5ae3d22eb47d418c421cae0e8300a638699afc6cabc564
SSDEEP 24576:spmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:3b5+Pl6bJTIZ5jdgpM
TLSH
T1F16523864A6B20C6E09B5739D9C9DB00F87DAF97DD8727B6C57D082BF130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 4abac63d210a2b8c05b6ee63edf4586f41cfb4e82ebb5a26009cd63d91ee1b6c
MD5 5538d7817d7f395e3000eb8d04519100
SHA1 530c86ac097e5dce279dbdec1fd74dbf4625df3a
SHA512 0d9659aa7854e3572f2ebf1065af815714160507f1d0e6193c243649b0f23a84660048f59538cebcd4c446e85775e1ce3b0bf815a48bfbad8158503e05ad9cd5
SSDEEP 24576:gVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:7b5+Pl6bJTIZ5jdgpM
TLSH
T1BA6523874A6B20CAE05B5779D9C9DB00F87DAF57DD8727B6CA7D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 865fe97d24a377b04e5a537cd73827121738112e6a0bf1b564bea1e36fae49ca
MD5 e5b6ae9aa56ead9e359ec4c8ef48e338
SHA1 a3c1d3762f1d88e645d2f1caa731d42e9a775825
SHA512 86f2d24c0201dcba1296ef94ccf03e735e665c464c64cf9e891f1478d40f6f657c345d70a6208ed133ce525ca72faf2b69e5492c9a98e47f078b177d4be55b69
SSDEEP 24576:6zy6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:6ib5+Pl6bJTIZ5jdgpW
TLSH
T1C275024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 ea7e979d0805130de3736a7ca4b55238ea205fabc64d664915989a5b9eb4e924
MD5 b00c2fa034a1554c8e0ab71359e00d44
SHA1 00ed57a9a6a0edadf1d5408f8825d63cc39f07cd
SHA512 fa34418e1579d29e966083298938ed508343b4462b30a492ca56483419125fcf5c99114192407d03bd842b85b873be0735ab28d318454cf0f02b9d588897711f
SSDEEP 24576:rpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:Ib5+Pl6bJTIZ5jdgpz
TLSH
T1A26523874A6B20C6E09B5739D9C9DB00F87DAF57DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 15a2b4358d66d46c79e1d999458a63fc73b1e692ffc5dc1943ec17b46e1871b1
MD5 c0a9e1fbe975e43ddcb40eb938af50be
SHA1 4325b0b6be518399ce62df1a4885fef758e9f72d
SHA512 9e444194be44190d79af3237dfb8f2560f6b3777727321ddbe3937b23d76e29a6d278d8252980001b090c897bf049922238e5c0878ff07e6c05dab5081a662e7
SSDEEP 24576:Jpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:yb5+Pl6bJTIZ5jdgpz
TLSH
T1CA6523864A6B20C6E09B5739D9C9DB00F87DAF97DD8727B6C57D082BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 1fa8fea85d7dcbeaccee27cb51e091d8405e6b3028ca1de01769fdf64b785d40
MD5 ecfe4004ba06ca4bce1f59a6339c5963
SHA1 70e4d7bbd9a6c0db14e6279a5097c6b4fff49582
SHA512 ba29f4e8cd6cf3da973a185f8615ed20b24444ab54b8df6a7f0d3b4b66472b607b844ea5ccea40c166356a9c78ed7411eb1e883f61f7b4871e8afc2bb6db3d47
SSDEEP 24576:Czy6mb57GBiOl6a8JTth/RWZvR6wQQ92pN37:Cib5+Pl6bJTIZ5jdgpJ
TLSH
T16375024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 f954837088306389e650bc51c598a5a2f2641a8ce3662e78529f15ee728da4d5
MD5 8b4759f212efa6597004c7627fb08c95
SHA1 f4f6e10b1ddcc3b7bb10d34f05f5e86293e26829
SHA512 85ef7f37b40f1fa7b79e927815f746fbc13b7e79bab06c39bafb533d3b9994d17cee4d65ab3df2ea3b1a6f16846ef0c3f194b6e623571b40e1ff84a6f5011b15
SSDEEP 24576:MT/aLl3z0zDgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:MTiLlj6b5+Pl6bJTIZ5jdgpJ
TLSH
T14B850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 d5661d758e6b6f99c5d4f42a847beeaf759507d8b60600d9d4f19ff07723c33b
MD5 84e411c6eb7a103117a2718e66b45122
SHA1 c20df9c81b61e39307997e36d530f62aff0284ec
SHA512 10aaf094cea302726cb5ce5cf50f1acda88e7664cb8ea519b7c200d26e6ac795be9042ed0de54f95cb80738ec842524754b3db2570aab7354e2c2b8765a22a6e
SSDEEP 24576:e3Ud9CHKy7GZkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:gUd9CHKyatb5+Pl6bJTIZ5jdgpT
TLSH
T1C095CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 95c8b2f7f0310263c8d59d2e2c17c0afa8c6ce47b03d2bb6c9fede1981a298d5
MD5 8e39707b937ddd27c4037ab3dbc7756b
SHA1 182ccbdcdba5039511f77377e7cdd766017262aa
SHA512 55079caedbce1a2926acc3846381a0b2d951e6b1bf0695e47965d8963d7afd3ecdb8acc7528601cab325b07dd07533c76cd25f873a3813d437907b1d35bf2faf
SSDEEP 24576:HQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:nb5+Pl6bJTIZ5jdgpg
TLSH
T1CB6523428A6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 323994a4778625b2cf33700354a01b026c2d6cd20263cb4479005db47620516f
MD5 a8214db46b2278c5543e8476983db7d6
SHA1 2ccb7da88cff1d88ad5de85a8cbb1bbe261e9ece
SHA512 8cf73fee82a0955b082957d7cb1351b684852cbbba1d3c176f0f24f33967772c7895de019e384de2aff3be7a3087806d64d0b680ec81a9c62e41b051c48069fc
SSDEEP 24576:bamb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:hb5+Pl6bJTIZ5jdgpM
TLSH
T1906523824A6B20CAE09B5779D9C9DB00F87DBF56DD8727B6C67D0827F134789385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 d2e31a193b76209abab2940e98d9b424cb0160bc0657fd0b278e2e5b350a9133
MD5 1f6c8283a18a0344c70282fa6e4a7105
SHA1 ad07c78bef132371567310d6cb2509977ec1d212
SHA512 cf82f37f866866167d8ecd567973e1415b2944795f6ccabf88d8a3f75f191e0695fd327c1dcb54fffb656622159abaa7f5fd070da9d6ff1f6ae8005ffe43be80
SSDEEP 24576:i7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:Tb5+Pl6bJTIZ5jdgp5
TLSH
T1D0652382496B20CAE09B5739D9C9DB00F879BF97DD8727B6C57E0827F134789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 14480fc2ec3c574cec91d7f2d9513c2f074f3e83499ab3e92e9d7431b4048350
MD5 8b19da8c2e5040fbf65a770bced333b7
SHA1 a29729f37e6d13575fcb500be57ecd4fdb6671e4
SHA512 0c01c61745c60482f387391e4a82a50950c4ee8086a878f70654fe1c6472b9ad762bfb9cc8527113c1d21df95202e5768b54881fbaea6e0489877e8a70972362
SSDEEP 24576:Xpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:Ub5+Pl6bJTIZ5jdgp5
TLSH
T1566523864A6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C57D082BF130389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 6d4bb99dcb8ac577c70ec0e948c9f8f0d216e5ce17359bacf8f2d1b8f566cc1c
MD5 d4418d969d371cb70cec85ce4a506d83
SHA1 dc62868e7305f2aa306438bee31d2e181569a054
SHA512 5e1b6064c9a0c694a49f657f621555cbb23c44b0dacb256abac837e7f6c9b1f752ffd52644022d79b14feab78440c524854e4677f0df3ebf37187067d7b17996
SSDEEP 24576:fZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:cb5+Pl6bJTIZ5jdgpC
TLSH
T1F475F14AC29811D9D06E6279CB858A00F7377D65CBE193DB86E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d49082ccd321241904eb467b447e5f1c096accbbc2c6ce5a97d33dbe586fb0f0
MD5 058024fdbd1a5baf1e2c5586897fccfe
SHA1 9e9ce25cf1c4b34720217e5893a67fe09ae3c221
SHA512 f58a022db57d6ab2f48c7f19fc96c5d9e719cae95b41db45e701451003febab9bb652b4c8351130fca953abfb59d520f6e49389aed7ccec781ee7358bb7318c7
SSDEEP 24576:P3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:P2b5+Pl6bJTIZ5jdgpf
TLSH
T1716523428B6E6086E0BB5735D8C9D710B83EBF65CE8666A7C579142BF1347897C2230F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fea3779029dd9ac80f3827658ca46433334d4ead8ae9322eafb796d3270dbce0
MD5 f3cc298e9522184975c4bf88caafd67e
SHA1 47bcb8680e0f5e65b897ccd14e5a832d6ef3acc1
SHA512 69c618e7dd7266b6aeaf9088125cb625b4e05894ddf4e537d43cc866a7d45b8cb9b56abe4a55bf0635bf60f0a43be3e679c852ee64fc253b6dae566742153d6f
SSDEEP 49152:3a0h2GEkuAe73q3pp46zwwQ0b5+Pl6bJTIZ5jdgpp:3a0hNYG4JwDslgJTIZ5Bgp
TLSH
T12C85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 f4ac38dd63aa37f8d3de4433b9ef539c377a56faf10aa7b7cf50b3694dc793aa
MD5 e4bb6b4c6e550048832fbb7a8ee0a8c1
SHA1 d2e2a4ba311e08ef6252f01dea346636c169e22b
SHA512 c62f666dd49284654465ea5151f0a7e9031ef05b88b72e0a25b970e32ad58f347791ab14db9b4f80d0a715151f85ccd3d4bd6bd7cde12c6e972bc4640d9dcbc9
SSDEEP 24576:chbHjPHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:chbHjOb5+Pl6bJTIZ5jdgpg
TLSH
T13765126E06AD20C9F076A27DC5C5C606E731BD265B1263EF42E5813E9F37AD82C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9f1833e5bad00c4e46346517436c0e8cca627f84490a4ba0f3400e1cb0c576db
MD5 f48eb68b861d558f678959bc8e043fd0
SHA1 ebaa5c4d99762ca229e4fe2aa1e3103aa72d705b
SHA512 e2fdd3662e4aeaedf92e738d62ec96f4bc832757083980446951c7994a4c8653b5ae11d88c7e750f78fe294c11a30eefda274b7e435dd695dbc01edf67ea1d7c
SSDEEP 24576:L3YgnJcRTk4yti+R5dBR/smb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:LIgnaTk46pBR/7b5+Pl6bJTIZ5jdgpY
TLSH
T1E745C02EF2B910B9C4AAD236854147B5FB71782D1F209ACB0170C538AF1AED85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 c7221409a07a7391584f02b8b40d29e04821444ce7bee5081aaad41e83f05e8c
MD5 263ef1bd21aa8514e56acce230e8df71
SHA1 900f486680606259b8cf551714bd80271396e0b8
SHA512 2f7f405c7291007194d97053124d61b060844b20d07f62cd1198cd71b9ca36bebde08f88af0bccbd782f4f867637cac036b587e06e18a82e95e78572828b0e92
SSDEEP 24576:Cjmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:C6b5+Pl6bJTIZ5jdgpy
TLSH
T1616523864A6A308AD0AB5779D9C9DB00B879BF55CF8727F7C479142BF1357C9383220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6934d3c71a641302ca494b724c328c66685f0ce98f1217eabea300d3f45d014d
MD5 c30fe458e6b7c8e21281c2f3310caaa8
SHA1 732dc0c4a4227acbd53f59bb6793b58af2174b75
SHA512 e7b2bf6912bfab997eaa9bcf30191ea46607c1c5179d63f8e3e591692e8baf78fe83559090a8f5166332eff611b43df1aa1409013c72b0fe9885115be488cbe5
SSDEEP 24576:CBL3UTemb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:CBL3U1b5+Pl6bJTIZ5jdgpa
TLSH
T161850245E7A500F9E87B823CC8A6CA12E672B85D0754E7DF03B84A661F233E55E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 41b9ea93c7b98cf07b3948e9e2ccdddc4550dfc85ddbd4ab5038e23f1f1ff7fd
MD5 11c9d36667889fb375b849f6363b870b
SHA1 d7ff83000c73b69a6fe91fac5752e6d64a0b8771
SHA512 5b6f65ba70a9622369c0bf888d541e42deada39c62d9dc58a0e9e2f1ab718946e004b46a93b7ea31b20c4d4edabfb32372a17b478a57d391750cac4abb5b250f
SSDEEP 24576:NOqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:NOVb5+Pl6bJTIZ5jdgpb
TLSH
T16975020A27ED20D5E07AA23DC9C68709E771B8664B1257EF46E0407E5F63BE87C36742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 57752e797a0e456f06712e67bcc2d618028ed0236bdfc43e7a3b4dafc5fba8df
MD5 992a22ec6dd99e9f465ef2dd7f902f41
SHA1 05fd708ca55a67e51ebf51b7641656b1f73d1479
SHA512 96f45a0c3ca22bc3773eda326c1632481861fe55a4c5afd81cca02e9faae32e0841331cab210e95a901f3c69f9f278f28316541c436c4979c2633afff96f77d9
SSDEEP 24576:m7NM9YqZqmWMUkPjZM48Mv6bEhsnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:m7cBWMpPjN8DbEhTb5+Pl6bJTIZ5jdgT
TLSH
T11E65AE2E6BAC81D5D477D13DC9E28205F6B2B4611B318ACB1162833E7F37AE45E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b776106939b4ad887b5b4a41951f4e82878d67229885a98e08f7c22db5ed2306
MD5 9dc21397a3332e613d63557f5e314267
SHA1 863fedd8406e7e6990a0dd2e38b446134e774638
SHA512 a9ce758b12e674ab8fc9c14704bc8c8da68d816d3eb8d074bd2b564c25ce938dd142761140daba0558c9a1179fb174805aedaca186ef6af296b07bccd286d6cd
SSDEEP 49152:CF2YuHNETovAvNYf8kmGb5+Pl6bJTIZ5jdgpP:L6BCf8kxslgJTIZ5Bgp
TLSH
T1C4858E2A27ED80A4E0BBD27D85F6D246F9B2B8511B3056CF0255862E1F33AF45D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 15a74075a3f082f92a894776660ce4171043a368198f4f83e28e859768935e73
MD5 d1ef55583e31c138b59429849c920ef6
SHA1 3d9f8a27313cb5b2198c6501d61a7f58b4cd43e8
SHA512 87f7d4f7ad67743c38480d9406faaf955cc022e6e9f643b402ebba61aa7535b8d79d38d5aec9aa7bd15a0268ed1b7341720d2e61c99f1079e7cedca4ef549551
SSDEEP 24576:YAFs06+Omlf8NXEbTo2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:dFs060loXuUb5+Pl6bJTIZ5jdgps
TLSH
T16A65BF2F66EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 adf2218e46bbcc4a1aff9bfb883780d6674e0058a0fd86059445f09f46fad5e9
MD5 357785e326a4bcb9707c76ef515ade56
SHA1 f3f39b2436cf896c222c2a81e9a02ea1df4264c2
SHA512 3a701a7043c114290953d95875433b4e772cc5776466ab8669a8bef20c4cb1cab3be5bb9f25bbb192418e9315d25e5017c6ecb0f3a9af58f83238dec8f978348
SSDEEP 24576:iJnJ5D3WxZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:iJnJ5DGxUb5+Pl6bJTIZ5jdgpL
TLSH
T13485DF2DD2A810E8D4B7C274819A5B45FE72387D2F226AC758B4D4357F12FE0A979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 03539d10e99d408c75e4ed778dae80f216de64e7f7e0c06a68f4c7b069b5419a
MD5 47b87e654ad8aa4e39fd0d05f19bba16
SHA1 2b860341cf51ec0fbc24272e6319c73760892390
SHA512 123080fc79525cd003c5b60b368cace82a9d9816d6aded0609807b70de82adf1c7fe9e6cd0350af6e6decc9473cb692cffdd5ad1a43d613aa0e1f67e9f9066a3
SSDEEP 49152:Qg06DIKdwc+eQnSt65aVyb5+Pl6bJTIZ5jdgpF:xuslgJTIZ5Bgp
TLSH
T175956C06BBEA5294E8B3CAB1C96295159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 bbf7ec390e818abf4a71dfd16c20b8baded4018f407ebe2f5d4738347ba6fa3e
MD5 990ad47aedab494cb482f471864fb57f
SHA1 738f8d011220aa88ce11aa2acfb866918d86793c
SHA512 be4e93c85343e24a1936c3f8e0449487c3bbebfcbd22d1b2c4acefa5c5898e463a912b494fb7506ea92c2c42513eb0ea504944c66fae092d9e6e1ac9b9a7b9f8
SSDEEP 24576:N8Smb57GBiOl6a8JTth/RWZvR6wQQ92pN35:N8db5+Pl6bJTIZ5jdgpX
TLSH
T1BD65015E1BAD70D9D06BA23DC5D1C704E3B2F4619B4227EF46A1813E9E33AD92D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 5baab8a334f58bc16f4bb41f2530feeddc215cefa2d2110d99057718a1ef6030
MD5 c277bf441951a74dab9e0484c2cc3e1f
SHA1 0343e7e6c2c197dd2f556a9d41ade581bb357f6f
SHA512 40301d48372ad16976ff5bcd357945f9f82f8c4ef66698d1d8a2c3dce5da8941df599ceefc6a3fa812522f13cfaa418c6ff75aeab12f6231ba68f663b24016f7
SSDEEP 24576:DIy0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:DIEb5+Pl6bJTIZ5jdgp/
TLSH
T16275124557A860C5E5BA4738D9E6C350A979BD20DF1267EF80A0A63FAF32BC47C31706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 c359db69ede3cff41c8954713645724fa07fbdbd24dd3ddb02ee5a14f5b69725
MD5 c80afe3c1bc2e1445ffa72c80ef10ebb
SHA1 921e16be6eec2ac6029937197d2430ea7e2447ec
SHA512 52cc6c2fad9058a646fc099603ee84c8771b65df49f484b54cbf323ba27cd93b3031f4a2555320fb6f34b53312406f243e78f9f8971ad05ddf341d8fad49837f
SSDEEP 24576:J6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:Jlb5+Pl6bJTIZ5jdgpV
TLSH
T13765234A4A6A30C9E4675779C9C9DB00F479BB65CF4636FB84F9943BE6313C9343220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0c8f4d2a758cd775ac7c43579fc1d1e9f45f231b9cda6fe15a36a9b4950e7958
MD5 6badb5ece407eba99d1cf25a48241cc9
SHA1 1cefc6fdc5ba4a72debdb9e6d9bdeba72974cc08
SHA512 31ce52f7f4ddc952c8c19c19c47dfac2149a1f52e604a184085211dbf3f589774e3c457240da9ec3522e805626857253f8129a5966bd0244c7f24bca4469189a
SSDEEP 24576:GQ9MxZKdcz9dw3/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3YQ:GVKZ+b5+Pl6bJTIZ5jdgpZ
TLSH
T175558C2DABE9058AE177D239D5A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 7badb6fa0b37a0cbd624d9702832d8281896f674b49d2fb122c24d7b1e000281
MD5 797aa3f1a9e02b12dce166b9e38212ec
SHA1 60ef3ab66dd782c1615ff97743e7f56776c34209
SHA512 cb54e582320f32019561115c059e32563916450bfa4ca3b866ca3a6f63cb7aedb44353b17822c8f134e7686a342a69d76944418ddf25933058becd9d6f27d057
SSDEEP 24576:VyocwApgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:oocwApXb5+Pl6bJTIZ5jdgpR
TLSH
T1EF75E00FBB6A4092E066823CC9858745F773B4309F5267DB55A1C33E8E27AE97D35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b86a371189288a1bfdff09b7df2abfe5686e7a59e4b345d82d4824d8950b3c94
MD5 1e2115ea6852ff67498ee1d185fd4824
SHA1 87768aabde7f3513a58b27630ac73fec9ee2b804
SHA512 7d9ee2aaf31e0a4979e262e4a8e94f371f883c4195e2c1d1d3424bbe7871fcf503fd059f1686b69115c17f09b4d3e6fce939637a035a928e3c45b9d67ec77c52
SSDEEP 49152:hWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKXb5+Pl6bJTIZ5jdgpC:Z0zuNIdslgJTIZ5Bgp
TLSH
T13FA57B3DA2BC00A9D8AAC379C5451365EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e2b4505d763d551323fb8b401b59b6c5ef2f0dc454ae7e5e6b1a6ec48ef72772
MD5 01e642ef46465988d9bceda691278172
SHA1 61a3e0593d3639d38132cc0c1a6fbc1424bf8b15
SHA512 f9e7faa7cf55d5ac0e81bec4b29615dfce1da98061adfdd98d5b4beda50566f68f080a6d1cf63b455bbed29795979ab2a61382ee8ca5682cfdcd14125095f749
SSDEEP 24576:M1QT7EcpfxR+N5AWAz3ooiYzjMqbSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:RTDxR+N5YzTBjMob5+Pl6bJTIZ5jdgph
TLSH
T19655B02EA7F915E9D1BEC6799A23C502FA727821073193CB42A0C17E1E375D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/768-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/768-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/768-230-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1144-242-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1144-311-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1396-304-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1396-441-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1856-231-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1856-78-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1856-70-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1856-76-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1904-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1904-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2260-262-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/2260-319-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2260-261-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2260-267-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/2356-293-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2356-301-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2356-299-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2356-408-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2700-13-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2700-172-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2780-507-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2780-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3620-8-0x0000000140000000-0x000000014035C000-memory.dmp

Download

memory/3620-0-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3620-9-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3656-514-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3656-324-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3680-506-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3680-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3712-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3712-23-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3712-29-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/4120-247-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4120-315-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/4120-253-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4120-255-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/4264-404-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4264-278-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4388-323-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4388-271-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4396-385-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4396-329-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4396-515-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4396-369-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4396-401-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4500-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4500-41-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4500-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4500-229-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4512-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4512-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4512-403-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4672-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4672-68-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4672-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4672-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4672-63-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4716-320-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4716-513-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4720-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4720-407-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4720-281-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4720-287-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4972-243-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4972-238-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5436-409-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-422-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-424-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-423-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-426-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-430-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-429-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-428-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-438-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-440-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-439-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-437-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-436-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-435-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-434-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-433-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-432-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-431-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-427-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-425-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-421-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-419-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-418-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-417-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-416-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-415-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-420-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-451-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-450-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-449-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-448-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-447-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-446-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-445-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-444-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-443-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-442-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-412-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-413-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-414-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-411-0x000001B112610000-0x000001B112620000-memory.dmp

Download

memory/5436-410-0x000001B112610000-0x000001B112620000-memory.dmp

Download