abea5eaec4b14fa005a8c4196e9b8c2a110d7c7ed75e27c70bf5e2eaca07ec18

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
Size 1.1MB
Sample260910-2td65axbme
SHA256 abea5eaec4b14fa005a8c4196e9b8c2a110d7c7ed75e27c70bf5e2eaca07ec18
MD5 d97c1d6ec1ec5394e546dd4ae111fe9c
SHA1 5888f746df3d3541ba8e64440b45b580a6cec99f
SHA512 8608e11625088edd6d5e2de83970ef8f148ebfef460f0f5c3f2de3114e409fe3a81c1f0abf5875aae774e4727132a3fba5b1b2cf563c9dc50701129e058ee865
SSDEEP 24576:rNYW1EK8o6mAfOvrhvVULUf/7w0gXe4i7ojhsP5Lgrk1TWb4AN5:l6uQe30jaNf1TWbdz
TLSH
T1C435CF5697E803FCE1B7D674C9D24A02FB777C8917B09A8F03E444A61F276918E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4052	alg.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
1092	fxssvc.exe
4456	elevation_service.exe
764	elevation_service.exe
4468	maintenanceservice.exe
4816	OSE.EXE
224	msdtc.exe
4216	PerceptionSimulationService.exe
2972	perfhost.exe
4580	locator.exe
1588	SensorDataService.exe
1448	snmptrap.exe
4820	spectrum.exe
3400	ssh-agent.exe
2600	TieringEngineService.exe
4632	AgentService.exe
4696	vds.exe
740	vssvc.exe
3500	wbengine.exe
4204	WmiApSrv.exe
1844	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6ad6502c7c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006ee673e7741dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd1c7a3f7741dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042b36c3e7741dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af5010407741dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c05a373f7741dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8eba53e7741dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe17f63f7741dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048d7b13e7741dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002272ed3e7741dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084d04c3f7741dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
3484	DiagnosticsHub.StandardCollector.Service.exe
4456	elevation_service.exe
4456	elevation_service.exe
4456	elevation_service.exe
4456	elevation_service.exe
4456	elevation_service.exe
4456	elevation_service.exe
4456	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4716	2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	1092	fxssvc.exe
Token: SeDebugPrivilege	3484	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4456	elevation_service.exe
Token: SeRestorePrivilege	2600	TieringEngineService.exe
Token: SeManageVolumePrivilege	2600	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4632	AgentService.exe
Token: SeBackupPrivilege	740	vssvc.exe
Token: SeRestorePrivilege	740	vssvc.exe
Token: SeAuditPrivilege	740	vssvc.exe
Token: SeBackupPrivilege	3500	wbengine.exe
Token: SeRestorePrivilege	3500	wbengine.exe
Token: SeSecurityPrivilege	3500	wbengine.exe
Token: 33	1844	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1844	SearchIndexer.exe
Token: SeDebugPrivilege	4456	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 176	1844	SearchIndexer.exe	120
PID 1844 wrote to memory of 4636	1844	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_d97c1d6ec1ec5394e546dd4ae111fe9c_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4052

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3928

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4468

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:224

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4580

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1588

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1448

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4820

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1952

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:740

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:176
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4dbc4cb7d0279c609c4d633597fb32e37df688dc08eeefa7071b1841433dc149
MD5 ec2da80bb430090ade59fdd4b8c2e04c
SHA1 9f33401d7bd72e2fd062c77e8557d44104a5aea1
SHA512 08cd3a36c4da9f8db1a73db5eb5242e37a7ec288240f9ca2b54d97354a527830af38dc265447c8c2cb27ab853e02f364782fb5b3358f588a93ea3bab9e185701
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2e30jaNf1TWbdz:w3q6HjB3U023W
TLSH
T1BBD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 82c35864a13a8d329c031042f84e69f7e6ad49fa06990ebc2eb18010db59e8a3
MD5 1d6aaf4c9aeb7452ae90c95d6423ddcc
SHA1 e0ee707576db6c8319c298d2eaabdc2e2f3a546e
SHA512 cb7eb54fc2681dfc6fe8d906956db1a2ab99447cd46a5c5db3b6d8bfe069ee04373f6b88c5b9355612cd55a2499dfa797093cb1aaf0ced041b6da6dc6c38c39e
SSDEEP 24576:tXYfDtczA8gXe4i7ojhsP5Lgrk1TWb4AN5:4tcge30jaNf1TWbdz
TLSH
T1F505F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 305fb26c840268031510090039440350cf4204e8eb341f4d33daee64cd5c826f
MD5 f6151768697dff6fbfa647ce5d54bccc
SHA1 c2dc43329eff7b31b3870ed430156eca7ace2def
SHA512 a15c152a5f50dbc90d688f800d55a3e76aab94ba26ef198a085ecb648586f9c0c64130f60a14f16185ee2f698992ef50b947b0cb805c87d673a9e8023c00a82e
SSDEEP 24576:H0Le5ji0hmxirMXgXe4i7ojhsP5Lgrk1TWb4AN5:HPji0AcRe30jaNf1TWbdz
TLSH
T18435AE26F6748735D073C0B9C5D2A68AED71308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bb39ed8d4e8527cf8328cbf2768c6fe8c6e8a41e098a57d8b716408c52b546cf
MD5 f1f56716cd07f2260310b1df07286ee9
SHA1 ba0ebf7defec841ac847e83f58e190c869577368
SHA512 1fd276c343d55251dbf8c87e6c14fe4ba2d10a07cbbe671d970f5364a4613c269bbd3234eda1223be94bfed7963cea561de3bf99c3aaa03bea63193ce292aa3b
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyulgXe4i7ojhsP5Lgrk1TWb4AN5:e/ezSC6vUzPvxHjyNe30jaNf1TWbdz
TLSH
T159756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c6be367d78e813909c458029214c0d1b0aa4f2340c240a57b43b5a86bbe5ae1
MD5 3d6b97ec9f638e7e713e84b64a315331
SHA1 da28f3afa2c4a6dced72d1213f69fd2b9d466336
SHA512 45b896872ddf0bc8ea4989d42ecc170d1301eed6e581f945411dc57b1a2945c910e9c5d8d3f147263b657d907c315fdd39d302011ba3798b3f42f46829659ee7
SSDEEP 24576:NVbqPb88hv/l+6AgXe4i7ojhsP5Lgrk1TWb4AN5:NVO88hXl+6e30jaNf1TWbdz
TLSH
T1A1559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 7253e3689ad3e30a846dce450a8a70b18f5471fac2fe3c8050b06c1cb00aebb1
MD5 137c75b92be75b6ced6fc716ab792859
SHA1 de8f1453c85a50941978b7e0258e096f8d8cf878
SHA512 2fc9e5c57eed35263a8971b338925493f9735cc5e4d1df4b484a2a53e6f61d0317bc8e7fd949aa3f6eb8068441d809d6428832f067ad8a4f3d3628cb3d49a58c
SSDEEP 12288:XRy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XRrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E7C423A19F5409C6F38FC3F4A0F7CBD1E9A11EC061444E6B47E0BA931DBC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e18dc8419993a3e5199b694060224643bd633f0cc095ce0e486880b89da4deef
MD5 c0dd1be7ed84753a419027dbe736e661
SHA1 1171aa136630f1476d89f2c7179067891c503deb
SHA512 c2ee2a7650584dba69acf176054eb8df421fd703b03d0a37bd7c201e51d7ab9cb68734ad20b09674e018f4672b140c2e9aaee4bd4b5b7fc348829cd12e946d8e
SSDEEP 12288:teBNUbTVO86U70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tJIU4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17C05CF3BEE28ECD2C27E8DB85691C740E7B278704B5193CBD1A4C20E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 65c0ad7f66e71d4235085f364080171bd7ee4046b76b3a9ba92f8eb69bbc5ed8
MD5 c1b8d56b748ef65facb4ea1d616dc933
SHA1 02149637f9cfc953dac58349fe9e050d4001e7bb
SHA512 7e44512743909d0288ba3490517ca61e8394c9ea40eb2c50cce75395e65abd70e7c4efa91998986f43fe1b24c6a0fe7e57518d254f2c199247d5f141c450a398
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:eQvGAdlCEL8c/yRNw5CAU023W
TLSH
T1E4267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 12713abde576fd4e06b1854e8fd1c8caade97983cc597c86a7b94a7956f3198c
MD5 a2d9dc35d083542726f292a776057ac0
SHA1 177115e9ccc7d88a76ba2c399aea46e4247e0131
SHA512 39d5fe1615c3f9d0d9bae72d2659097eb912976e6167663422aedcf6b9d9ae15a6d0a3f62cb664d6e44d8f40fd01da948cd7030ed6822dbf03c810867e537b81
SSDEEP 24576:OdewsAjugXe4i7ojhsP5Lgrk1TWb4AN5:mljhe30jaNf1TWbdz
TLSH
T1F315E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 490c47c9a5b09607e45d5f3292e8b2c002b371f71ba383d65d83416b132ab6bf
MD5 ef428759bc373fccc1f365a65d42bc43
SHA1 995c948341338290a584a8eb7bf8b94885db5332
SHA512 1f54e2c7e2af49c096f0daf19330fd0302dd966ed528411d84cf0ea51fddb023b08482253d91d8d3fc9d444548f99b50059a28c326f57e3821f289b0fd815dd1
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH5p4W:XUEtQevvqc2W1cpV2EI32r4W
TLSH
T128474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 290c1c17cdd2d30b69defede7e0e2d193e855b7dd772586b4ba2d19f3cefc35b
MD5 80cec687a6aa1b282ddeed47d6a8d049
SHA1 18ac9fc52fa067f3cb177d61390530092f1af744
SHA512 1b86e013962f9f550f46481b978386dfa0f8bb60f4173085f48642e047403e8775330576238b31946a6bf30fb832ea5cbefaca93527509b428ad33f18bf80828
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zBe30jaNf1TWbdz:xoqtVjnmsU023W
TLSH
T100D58D1976B8C2E4D1F6C77886A2C647F37178154B309BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b6f6e8460fff3f65b7e42e56152103eccc26298f22e4462bca47925962467f8c
MD5 83c4cef8339c1ea9616e2b2173c2e483
SHA1 f982d69c7d75632fc2b54151a778b6cd43175a73
SHA512 7b35f8220cb4d35b88606bf131fa7a211d8dc257aba1b83553489257923180230e91ac991837316f44ac9124c0833c800cafe0339f471f788b68c618c7f83ca5
SSDEEP 24576:AAhGLJIFoiwtA5l7S53xgXe4i7ojhsP5Lgrk1TWb4AN5:AAMyFoiq58e30jaNf1TWbdz
TLSH
T1D7359D81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 db151df198ab186d3f2ed5732f677309b237ae29b56420915922c9fb7ef56a32
MD5 e1901c3dd3784af1038d6616bc01454d
SHA1 1e074b0960095c6439e6d5fffb37baa5e812fe51
SHA512 e10233d534ae327fb3897cc4f1944658f251dbaf1cb19e772b8d2f5358f7397df955d9846df54433caf873dc9031b6d58a93601fd96fcd4045c2c6c204d815c5
SSDEEP 12288:omw5HEjsChNVBFgl0WDm+CE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:FwuoOWKgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19B05E14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 5f334a98e0447a2b681d15ec898e6689f392f8fb4aab502ba57f6175cde36203
MD5 71cc27a547a86832e4558a3fa063c8dd
SHA1 75443d90ea2ed18a3a1934221a197c68e5669015
SHA512 5bd93fa1fdedfb8f13ed88a7170150248cee211c684ebbd00041df5c3f2844e693fdf90d8328479fcbeada2441f997f4091856fbfb33711fb50065d9b930946d
SSDEEP 12288:iBZ1IyR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MZuPgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18DE4129637E421F9E2978278D4F28B41E7B23892233147CF02A096A71F76DD65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b8cbeb0a09803dea8ff2fa747cff81b363d5a572c0b434120c389bc89959ced8
MD5 2b7ae074be5b8327c103102e9b3c1e62
SHA1 4d69ffa78cba6f50eecdd0ab7deb299428d0d732
SHA512 2c124f5535c900142da2a152a544664af1cc57c8184369903a02da2d718689b902b3a8948e84722600b6a6d7059d38657f32226345b908d5433c6851f8877951
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:EQRQyi36YOcPQLvw2gAf+PN3bU023W
TLSH
T136667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 61b8205a01baca374f90ce473f52ebc66c4253495f39adc1984e72e97d0418d3
MD5 bff89acb86d30d53b5deeca18c24ad19
SHA1 d6832100c9fccf97d70888eb8fb91af37f565022
SHA512 2471e546e813c772a3dc5041792e3d44fff30adc13fd357e5b9efd5a055b1bcde2c23b58a974e43920b3ee6290e0c104c15ba792a6fb8e90f0ebc055cefee3ba
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:SQRQyi36YOcPQLvw2gAf+PN3bU023W
TLSH
T132667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 53a7bdc61b24108caabfe28a4520c438994a95fc57ba2c0453f7d9c334bfd42d
MD5 f5b214c45d426b2b91db361a15152926
SHA1 ac90de78d54c4f443a962bd4fbc293810b424651
SHA512 650d1c4ad52ee3b4079422318ba1f7d44426eb2a146f468b2bf98e04ead911a70ae9eb568d1dcfa409a56dd86245df97d0bf5582e5a668f0c3d24ad8302bf36f
SSDEEP 49152:568Qg55nhheWu7PNU3/Re30jaNf1TWbdz:HthWRc/RU023W
TLSH
T17DB55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 75f81577aa8e4739f52dce65c15503b801f28268044f1cad429f2bbf832cc480
MD5 a988b4e791c2141c8618ebfc508365fa
SHA1 879928d998700da314974a869474f0c641b88b2e
SHA512 065127e2c0315fb226843510051f33f34e65482eedcb44778397a2ae08b53a3f006c953ae3f7a05500d605d8ed2c6d415dcffdcdf5a5d05cf9e6cc8dd86370ed
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:5y5112gYy5azzVvL69nLKnhZyU023W
TLSH
T1B0168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b8c55f42490a96c7da0ce35c46c1f055b77214b1e273cb2f6396edb8286412aa
MD5 c311b302ec6c1a8b6051a8cb326ef31f
SHA1 21bf2daf0eb3431b9592ce0bbce7f7c78601a7b0
SHA512 52fb02426e218189dc80c944f81523f853ab663f63ec6123765c17faf3adb4ffad525cdb55283c86c41fc86c82833ec30a9fc98b5ba76f22e2cffa257cc751b9
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+e30jaNf1TWbdz:bu6JmVxd2d+U023W
TLSH
T103D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d97e83cf4b354cf955b82f3a14c412f45b8684b59fd87bdbdd3d11012218c0b8
MD5 08a5d72a821c6b82755215405947f637
SHA1 e25ba69e2e03e7b3464395f881635cae48237dfa
SHA512 a27b7d24fe29f955e2a99612a9fe2a7a021d2df4b197cc3dc0a47519b3890615781466f24d3c72b1ea80f3d06b4a99b239f8e17b0e86dcec2ac62594064b15aa
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xve30jaNf1TWbdz:hmifPbRsU023W
TLSH
T1DDB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4ce3e266145badaebe2105916766b7562133f6eabe9fb176bf5dcc1a1525187e
MD5 48ebafb1a5f6b33a8ee0833d0e747ca4
SHA1 3dded92c8821e0fe594f110c15ea6f184cf3290b
SHA512 af332fe3308916e08c026714788ee2ba8abdaa02104c97b00da35e3b83435331ec5de4f5773d636b15df0144b39ee51d4e6c96c50113dcbf4f8702caeb5c8645
SSDEEP 49152:DSuZQIY0Be2KRRVtOnks6NMHqGe30jaNf1TWbdz:h5dKTi61GU023W
TLSH
T1EFC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3868605d6f7dc521ca13c335573f2dfd1960208cca442584fc0b2aa2f4b4949d
MD5 9b576423d61a0771c62a5a9d954c8a05
SHA1 e8af30c1870571bfe44c09d28f529136297f0fb4
SHA512 04aa043379697eb6ca214d98a3613dc5906a168cb9f4ac0d8d911148d5ae93eaa589fa0b4da0d5d8a2f69884ac504d1c1aef503bc28a3d37179651acba6703fe
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wTe30jaNf1TWbdz:QX2iyphYU023W
TLSH
T11895BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1c672d2bacd324f9393782048c2e1f4894c750e1a99629af29301ca5ef6a6f6b
MD5 e6c5beefc7962050c675ccc1c1f14529
SHA1 acc7754aa984f67ac00643a9f1c960ade8e26da2
SHA512 fef1b69326e07cad4a30e8c2a8342e6958dbe3446d754b26eea71eaec442c1005bd1074b107bd0f94bd8a2c68f05441b62e4a4ff7f8149cb893899332ade1038
SSDEEP 12288:HK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:HDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T128C423A19E550ACAE24BC3F0D0F787D1E9E11FC272404D6B17E0B6635DBCCDA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 41888f9d03c94e2bfb3fde28f427bf6317c8248c437da63f58ea33f3808df934
MD5 b9e438dd980d3636c1a241ccc5b5f35c
SHA1 91efbd2fbe7d6b3033c41c457096745bcce51bc6
SHA512 34ccde2258494a148fe3f99f42b90372368365f364028025532838d6a84eaf521c5f41ba063427a3b6dce905e0a1cb35baa2cb89c08040be3fe1883eed81b76a
SSDEEP 12288:NF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BEC423A1AE550AC6E24BC3F0D0F7C7D1E9A01FC272404D6B57E0F9635DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 25ed12c3b5b4b7be40c16ac9e547282309e22839d44b0891adbf675bf0d183b7
MD5 68dd45d7d2d34986a522b985ab17551f
SHA1 602fc6a66aaf6a7749737cd3ee9d4906295af76d
SHA512 6fecb3517bbf22a21f2e10fd676ba085429778bed450a9dbde4914bf3092856ce46e2b1e0f1cf3ca593bba3c75fcb57a99c0ed8e177938e2482fc574a26e7ed1
SSDEEP 12288:IT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T127C423A1AE5509C6E24BC3F0D0F787D1E9E01EC272404D6B57E1F9631DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d1d3fe17e95beb51ae117a6cb79ff5818442a9cf78827af8088085dd72cadaf1
MD5 8900eccb4f06a0ca5aba5595155e5a58
SHA1 d973ea0ca7573abaf01d97519201c9be7fb5f585
SHA512 f8a30265e34ee5e45f50fbd280afd31222eb88bbc8fbe5ebaed40c9c370f43f5ce9257510070417e50cdea3cd7141c1515cd54546aba7d401c9282269bbdc57b
SSDEEP 12288:OVw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11DD423526F6905C6E14BC3F4C0F38791E6F13DC173114BAF47D06A530EB8AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ceab1522babb5086672b344090731d77cdc637435927407a6df04f18f06cc744
MD5 8ba0402928c6ae6d5044ba52ed9ce66a
SHA1 b80007ac08060736ea2b1b293f2cf7b05159a23a
SHA512 39b15a05b6e951228831b2044e6943fb4342598db7d1fdc50bf9fec39848fbcd5d75341770d999169736deafe1c5eb4234f0bf2438ed685e627342c3adb895a4
SSDEEP 12288:TY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T154C423A1AE5509C6E24BC3F0D0E787D1E9E11FC272404D6B57E0B6631DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 335c912b1e24d40f0886ad52d931e9dd21040c42068b98aa4195ddaf12885b20
MD5 59c250835adb8a2152a032bf8f3f6ce4
SHA1 c7c79d8a36c72f959d93c109f9f29c54b7a4df3a
SHA512 3f0dd3611774c9a875839275f7229f41d5d0c76f8179a2ed944293f10126860c460b920a5c0a7ee3efb824884960decf54e8d78efa6d23541ebc5ac6d214a7b0
SSDEEP 12288:1Z0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1GgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FBC423A1AE550AC6E24BC3F0D0F787D1E9A11FC272404E6B17E0F6631DBCC996AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0c396fec5226ac9bc42eb0ca300748b88011958d67c15b5a1f98753600fe28a3
MD5 67ba46fc5437e45219b03c2fddb5b7e5
SHA1 dbc7a91fa3ba0bb5f225ea0d0bbfe4c2f8358b4d
SHA512 2a8b093ff824e5c701d6c1d17c3b2d0476175ddabced05d9cbd4404ff66a789fd2fb24a24f6d95b02fcd430ae7132fd1087d2db6ed1ccd398b0c7db79a7e31d9
SSDEEP 12288:JN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15AC423A19E550AC6E34BC3F0D0E7C7D1E9E11FC672404E6B57E0F6531EBC8996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8e6e1dfb6e88b396d4df4543926f73805ad07ba0abedf234f12bc7aaaa93e299
MD5 46d037db712efa5a6e10417e7b2b5f51
SHA1 f37fee8edfb47475eee21751e1f9654f3cf5079b
SHA512 ce980af3a089b77dd521e3d820848907e088eb11bcbd7e2c6c2e40562ccc8bd29046b5859f92e8794683287bf163c08eb9e46c3148b73bb421fdbe96f9502b27
SSDEEP 24576:0ZMSzFVSOSgXe4i7ojhsP5Lgrk1TWb4AN5:0ZMSzfZe30jaNf1TWbdz
TLSH
T1A4050195B3900CF4ED67827EC8A68A02D6B27C561760CA1F03F436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 50d20bff31e85426432c211f098db4ff012e0b9e0b9f0aaf916dbd73c4f8a50a
MD5 e8dee6ff2675270f62f760a7851ffdb1
SHA1 45f35cd19b2aef9c42a96cadac396d28c8ddb57c
SHA512 bbb6cb74c21123cbc23ff0712fe9183675982c8c1ecc1fef188bd89e436bfb1a36194321c6037ffb913d1d128204f3ed96e2dbb6c79a5b6168e75461446808fd
SSDEEP 12288:sm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:s/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1ABC423A1AE5509C6E34BC3F0D0E787D1E9E01FC672404D6B57E1FA531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 615013b2007eb75d2a615f5c06b6e76262916f57598b6b8ae191566cb4bee374
MD5 08208395a794b5875198b816d3afafee
SHA1 c116b6c62335cd0eb9ac5709aebd2a15951ace62
SHA512 1fcb6f163e09c1e3cda9b065a104bc83871b6adf1ab372ab8751372f425e35679785e7ed7e6e687aaed0274dbc595c8068e3565ea8bd6516ecb7cb53cb5ad30b
SSDEEP 12288:rC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BAC423A2AE5509C6E34BC3F0D0E7C7D1E9A01FC672404E6B57E1FA531DBCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 81ca38e8245b9a181e2d7e50cba864de1b8cc7d7af4708b9e6fc9982c7e16d94
MD5 1fdd4964876f168475133afa7ca08cc2
SHA1 3fcbbae13f3a49f226ec7ff99bfefa2185ee09c2
SHA512 4c5067ba2c9dd8eb0868bf1d60bd5d8ac16cdfee4db08fb71d049ad8f81f2f2e0949338ef3ee235592dda5f8baef95a93888717b46919582cf8288d1d5c6ea98
SSDEEP 12288:tyPz5L8R0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EzyegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E4F4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ba0f7dae2b5b751ff0d59971537492b4015e4cb4960fe527bada136ecfe43e87
MD5 0088a0ad1c03f2c7709704d8e8217820
SHA1 83e68a25025d2dd9482d98393787b909f87e8cb8
SHA512 f29830f4ed0fd31aea56d76461fd46630c0fd99f804b8fb79820e532e006712b8a529e2275ebf6bae28a85a9c7b1430081332915ad1bec2aee9766bdd621175b
SSDEEP 12288:Um0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L1:U/gXe4i7ojhsP5Lgrk1TWb4AN5B
TLSH
T1B2C423A2AE5509C6E24BC3F0D0E787D1E9A01FC272404D6B57E1F6631DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f2c602b5741deca7917cc65ea1048c770e16fdfcef19d59b10d8d82e1ef478c0
MD5 22d5747b8af9decbd90bad46bd44c5b7
SHA1 38ea0248e385f8e25bece0a76087ea20f568dba4
SHA512 2095feaa31ce2d335fa310428ddec8714b977654cbe8fdda35b31ccd3dcf391d0efcc9dd494b8c8430e22b3ffcc39b5d492cb5d2cf12412754100a4196a2a5a3
SSDEEP 12288:Um0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L1:U/gXe4i7ojhsP5Lgrk1TWb4AN5B
TLSH
T10EC423A1AE5509C6E34BC3F0D0E787D1E9E01FC272404D6B57E1F6631DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c1b5d25f1e0a8033dbce792e97c34547ca33de2ad6728ae25fa61ee00b811fb4
MD5 b91cd838823b951f134a37a37ecea42f
SHA1 dd4dec10f022ab792a517eda057d43f21fa83cd5
SHA512 c5f8d263a12aed079bd09c06e1df03ab42473e89cd72ec0cb1458b65112a20d56626cf70ec90e1d2e056c0826b85724d5dd5e5be78f479e4b8f762e76680e12c
SSDEEP 12288:hyPz5L8R0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L1:wzyegXe4i7ojhsP5Lgrk1TWb4AN5B
TLSH
T1A6F4025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c11135d21c74027dbc75e2f730f502310434e5f0d2bb048fa683015cf556aa88
MD5 0d07b9fbec3d1e39c107c9533d0217c4
SHA1 85bf4d7c3c3c92875b80febc9ab580f135fc1cde
SHA512 ce6e9772277c304633d600df4e9187c6316e123144e7913b10135efb05b0aef01173700fc76a1b0ce35346e8ade1bc27dfa191121a3b1278852076dacaef7d97
SSDEEP 24576:WTHaLl3z0zDggXe4i7ojhsP5Lgrk1TWb4AN5:WT6Lljwe30jaNf1TWbdz
TLSH
T1450502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3fa04a70cfd04dd64d6fdeb9cfec1ef1c3a3f25181d4c131c8ed388918ef9c7f
MD5 f33568cc648ccac8e4e0bd7c51074e10
SHA1 b34d688f14aab798eb93c056c7a8867acee5f2ec
SHA512 ea1a5f01656d53b6453eb3ba0ca00f71b172e07c1644029ec8af4b68dc8ec45575016aade48f2f5bb42cb1fcc2d9c03afbd0a7566d07c988e4ecda35cc53cd7c
SSDEEP 24576:y37d9CHKy7GZ0gXe4i7ojhsP5Lgrk1TWb4AN5:U7d9CHKyaZe30jaNf1TWbdz
TLSH
T1A725CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 db58be96a3c53e8eadb3ddc2a234cab10743f7cffebfcaf2e626a1c9d51b7781
MD5 b0392ac8165293fe39f72cb682a9da3f
SHA1 909dd028c17db7626e6f6d02a43e19d6d48aae92
SHA512 25dd635370e933857a84d621f978a0bd99cf68f11fbf4e7997dbc88a2b46fe569751051cd441057261d6fdf84fe7f64c1db7a6c254c8e620425e39804f283ac8
SSDEEP 12288:8z0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8wgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T133C423A1AE5509C6E24BC3F0D0E787D1E9E11FC272404D6B57E0B5631DBCCD96AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 989aa2b593998bdddf71506775133ce6017658ad360a8eb948ebadd2a5afa5b4
MD5 a1b0243cf412d892dfd7320675abaeef
SHA1 1f590030ca2b5a594febd8abe6df56439b3beb9e
SHA512 80e2d63d2c733bc793280b008049ccfe1294b924753d7fb073caa839df134315cb203194cd663c1ba6e9a3d9c6078a82cb73ba4e99cbf243b8ca98c7ff18e758
SSDEEP 12288:7x0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F1C423A1AE5509C6E24FC3F0D0F7C7D1E9A01FC272404E6B57E1B9631DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 04b69babd8938e67767d58081ebe6a7458f934c1a66267517965233916d724ad
MD5 21af5e4646c4512e4e6e3597472e9945
SHA1 429357ef3a02ad0f5065acf1ed1bed202bf9302a
SHA512 1a078df74f282bb20bf9964d8c70a36c7da006f6965e702c2427ccd062b3dff8138d5cf0f435c68c7adc1bc441405e4c67533459725607fa307b4935056c559e
SSDEEP 12288:aNsfW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TPgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T151E4F15AD29802D8D06E92B5C3968A41F3733C9193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c4999e33fa6027f18e7259145f89bf797b859be8a9cde90a80c249635a9e611a
MD5 5954406ee81776048dc6e5250b5912a9
SHA1 875162c1a1edd511c97490e0a625d879fee820b8
SHA512 5fd6a7cd3f7dbc7db849101ddcedb2256c28aa132701a9cb662be99128145634c75e5ca304f41fd6a77800eeae4bfe0ba4e1096bd0be1e22015f5691d337c875
SSDEEP 12288:Bh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15BD42362DB580986F29FC3F090F7C760F5653FC07B00899B66D0B66319BCCD9AEA4529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c793114440b3671355f761a9d18bedb5769de76810ba8d150540d1982e6b18ae
MD5 8a1a936067fe4d2d266ab9526e092e1f
SHA1 edcd6d22fe3695bcc4faad62531054a67de97189
SHA512 3e947572fae7e8754f9940ea0c5a1c95286c6ce47376b20e90e64fe45fd59807e503432d93f9e64a85a2bbc7b83ef91838940f3b6cc13992f94a58f570d7f1cd
SSDEEP 49152:Da0h2GEkuAe73q3pp46zwwQTe30jaNf1TWbdz:Da0hNYG4JweU023W
TLSH
T15D85AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 300d2484133ef91512c8c3718f88ac479d11b02e567ba2be8d35219b519c790c
MD5 81e078037841bc1a65928e4ceb9ee315
SHA1 cce3219aa9e40f3881726b48eb483854938d127d
SHA512 3ba42c60efe314d470c62b766701d94e5b990c233c2a75fd74e3eac9e8b4fdaab4dcf6c358e5dc9c32698adb82304f99df1c79b2a7b621b7841163188e4ba3de
SSDEEP 12288:8hbHjfXQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8hbHjPxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10EE402BE2AAC10C9F276D2BC91E28646D371BC51271187EF13D1927A0F3ADE85D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7da66eee7a5984bfeb13bade6656139c98a91c47adec44893527896f5bc8b41e
MD5 186a7513af7505bc49d6583004c15240
SHA1 39d20f8c61ac3235982622a7a1f83a170a97e7c8
SHA512 f2b067494fda11636c4f9b64520a197d8d32ed3a955b32c3a9c7aa1486f9d964e4b4f91d7def823e98c8da9a0eaff28ada259c3b305248fd0997fb1c5319325f
SSDEEP 24576:K3YgnJcRTk4yti+R5dBR/5gXe4i7ojhsP5Lgrk1TWb4AN5:KIgnaTk46pBR/Ee30jaNf1TWbdz
TLSH
T19A45BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 c6199512a807335d484558ef98eaef523a8cd00e3dddda13e58df30d0d577c72
MD5 406512b658caa3d8b475e2f7124d6762
SHA1 eb70713bca9f413e4849b629e2fb941d6bda0719
SHA512 6511953afe3b627b8a21ad03b48c8df91e8bbb46169638fff00f48e03e9e537ef8c7c92be1365a88581d774565f0f337619fbac0434c4b22bd4dc659027ad096
SSDEEP 12288:UN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CAC423959E550DCAE24BC3F490E7C791E5A02FC133014EEB16E1F6631ABCCEA6EB4458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 5c5f164351ceffd6ce72b82e193cdb871a05fc7f9a20a17b873743904f655138
MD5 0fb05ac84a6b590ab2ede52515bc10ac
SHA1 a07ab4cc963f07c075a5c6b152680f71850ff3ba
SHA512 3ff27f595c5b4fa67ea8f5f3c3817c878800f4500d92061958a1e9fb62ecc7f6b33b199e4f383438257564c28a8de4b72533ad0bd1fbf3ffb1b23219c008c1f5
SSDEEP 12288:6Ob9A4LWOsvAYFTQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:rpL3UTxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11925F155F79400F9E96BC27CC4A28A12E2B2789D1364E7DF03A84B661F637E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 e54227744e583254912d7305e57ebf370f26a9c51f70ebafb271b9ea1ab494b5
MD5 1c00c0631d76ec7b10b099cd87824fe7
SHA1 8506d827c28a40a2d0ebc385908678bcd60f5bd0
SHA512 2f10222d978c340ce03259b4cb2f43f4d629da4028812ac340c2c15388d11a61dd6be60a35a02971b30154c7c5ccf695f3a65c4f47e38a024f2f317135515d5a
SSDEEP 12288:wpFtpOs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yONgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T137E4026A37EC10D5E16AD27C85D38349E3B17892171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3d4496dffb9c69f242789de79f356c1c8f8baa188b9825ff84291b2d3dd13570
MD5 8fcebab65361c3ab9495d2e046412f7e
SHA1 0bc75c06fccdc49e0cb015e94c8e5e1c9190096c
SHA512 2871af9b799875ccb8e4f0494542d2309bf82f4befcb0fd22776f22e07345998c212a991d051d01cbcf49a3ffed17c9c072d0efb634f1d31cd9a043c94c83ff5
SSDEEP 24576:g7NM9YqZqmWMUkPjZM48Mv6bEhs+gXe4i7ojhsP5Lgrk1TWb4AN5:g7cBWMpPjN8DbEhqe30jaNf1TWbdz
TLSH
T168659E2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2b238b2572c02229befb2ba96b4d2377b44ae4a21f71328bb9bc955e7254c951
MD5 6408a2883d71999db1a4618f56c6a09f
SHA1 617c38d16dfae7d52bd1a9158a6bb35272b45c8f
SHA512 4ce92a3f86ee3761c9d6221f6ee918f865dbd8d82f0d1ff275e28717f93790096b1d66506df127890ee1ce8c0365f6771235004e6d24086512f38115db42b546
SSDEEP 49152:KF2YuHNETovAvNYf8kmxe30jaNf1TWbdz:D6BCf8kIU023W
TLSH
T1D2857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 45364bd32a315d49fdbca0b8626f688a279c47a2e9e2f31b429942dab08b390b
MD5 3026bd47398e092a14d9178bb4fba985
SHA1 368025d2fe5f964dc26d74fd2280e1c54d5e15d3
SHA512 508ad1d4bed2b7b1393cb10e4533a1ba1e653eb03cf15515498058bb76c9591d462273c482144892d0c24a656a31a4e9fe66f7516aacef7f46b55d7302541552
SSDEEP 24576:dAFs06+Omlf3NXEbToZgXe4i7ojhsP5Lgrk1TWb4AN5:SFs060lVXuze30jaNf1TWbdz
TLSH
T1F065BF2F66AC00D5D07ED17D8997C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 aa77734f64ca6ab1a36332d44f1e4cb03b11accf4097f4edd1d055e70848890f
MD5 2790a2aa47a2cec230e71bc83c51414b
SHA1 5ab4b37d980d2cc16bd8bda0a3090e563f846a6b
SHA512 dd4f13c795106a75823758f37aa7ec395da4f9153114eb4c28041a95c6fc98421817c6fac8119777c656b710f71f3684d7875c3b8c4b0bcff30b85e47ad8c92e
SSDEEP 24576:fJnJ5D3WXcgXe4i7ojhsP5Lgrk1TWb4AN5:fJnJ5DGXze30jaNf1TWbdz
TLSH
T17815D02DD2A810E8D0B7C3B4819A5796FE72386D2F226EC714B4D5353F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 20fbf042bbe359177b9b69abc9f384d45dfa7c03510bf3ce9140801cb7c7bcac
MD5 52495b0ad7e2361dc103b4fc237d2f27
SHA1 c4faf0d97da39267576e6b88c2e97f8e19fc2af8
SHA512 b0171e77a50eb29882422c0e05ac7db9080368ea6739f19bd82b06ed2e6075fee1ee13f71878ceffe71dd09ab9519d2a26a8024b2a9be32e2305249c74505919
SSDEEP 49152:dg06DIKdwc+eQnSt65aV1e30jaNf1TWbdz:2nU023W
TLSH
T1F0955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 a35543428fe3d1c7b08c1769c2934a1259c011d24c91c0b64a65009bbee29c39
MD5 c320ad0d6865c037bd1e6284ff7bca6a
SHA1 4fa5992da14ee0dd469449e89463949fa4b476c9
SHA512 6d589f970fbd94593b322eefe0e42c19e88ba934f86b28f00b8cd232a7dcd33d957d3e77933a94a489ed96ffeeb6b294fcaa556697d718329d15420b7f15f357
SSDEEP 12288:0EP3Rnh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vnOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T146E4126D6B9C60D9D16BD17C90E28741D3B2F4A027421BEF06E1D27E4E779E92E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 40ebce90a80dfad1981d80e7c42434bd97902a4fdd07a474438cb4abba92d9e8
MD5 bf5c1a19ef61e2148f7f0e384a913dd4
SHA1 395ae3588f07cb9703291effdb6a4686dee129a7
SHA512 9253353ecf86bbccd4b11ab1008c3e72eb921a306ce60459c8a15ca6705f55673dacfdfe9c08852ff5eb8b51747af75db7269fcb79f2c1d422b0055f60091b9a
SSDEEP 12288:JjkyK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JIyDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T172F41204679814C9E2AB8278D5F38390DA70BC606B1087EF52D0F63F6F7AAD4AD74B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 cc715f648786703823fb612a175f1205f3fafcf9dbf72a418c06262e9ba69663
MD5 5e3fa4bef58500721f10ec132fe0d8ef
SHA1 fca9cc6812797c4e9a81bd415d759e2024944776
SHA512 04e31fac0e2b471d9481a70c9ea5d116250cbff869020bd66528d1c407b10cc033074f2ee8b3aac4d327e90c44b0cef95d0a36d7f8f014f3d5c0547c35cdb472
SSDEEP 12288:Ayc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ddgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13DD423695A5519CAE24BC3F490F78B91E5B03ED133004DFF16E0F6734EB88DA6AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b092680145d43350f7cbfd0549dad8c1a5cad03d14b2745a3d5d0822f763a014
MD5 9b62f0de64dca17e088047c3ad6f0f71
SHA1 af65c883e49e33c9b16d634fb6864ba6a5b058d9
SHA512 84a0cf5ee1128c43d3b6bc52d55fbd97fb43f7eef1730dd490f69a3135355b09ab3c1a59e9fc0c8933a0fb8e7a45ab9508767f01f9cfaae1701604da9e5454cf
SSDEEP 24576:oQ9MxZKdcz9dw3GgXe4i7ojhsP5Lgrk1TWb4AN5:oVKZJe30jaNf1TWbdz
TLSH
T18F557C2DABE9098AE177D275D5A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 71756d2df562052ff61518a08f25e8ac4fabdd05c1c9267b1c97b6cd54250b94
MD5 434662828d552271166878489e58da2b
SHA1 a086d4a883fc07c27a046a7adaafe1eaf523a4da
SHA512 428416dbca3e86d69b4853bc8ea6de6d3dae5499a77e316310c1ab4a971fed999d1a34542da1e73c35b1b69869a4f8c8f1381beeb10852c5c3634907cdaa3fad
SSDEEP 24576:kyocDApfgXe4i7ojhsP5Lgrk1TWb4AN5:ZocDAp2e30jaNf1TWbdz
TLSH
T15FF4E01FBB6900E2E166C23C88868741E7B3B4702B5257DB56D1C33E4E679E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bfc7be9ef3dee270f5b174894dc9d22f3826433d08d54ed5cd8e25483ddbda98
MD5 320cae5f17aed3dca297c1a0841a3f65
SHA1 f73702e8937acab42a77264130a2b57b43ddbb07
SHA512 763ea767b9552790b53d51be560b111d54556f61ba3b64baacb8735bba8ae41f627511844cd952f9c17ea8bb1feb0c27d679dc30e36f1fd0a2901d54ce9804f4
SSDEEP 49152:bWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK2e30jaNf1TWbdz:L0zuNIMU023W
TLSH
T1FCA57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 64fa05e28b3a374ba4ef3d210a1ef6f494e789a28b032275890130b6767f42fe
MD5 094ca91d2da858f9ee1ce38b2a759989
SHA1 82257c08361fba01e9cc9e008fb05e55873af114
SHA512 d08d520e365fd3c5fa4d94cda28529b530a932a0f064a2464342edc017f48bd1274db702d30852a49bc03caf0585afb54801339ba8c8147f34c6a38fbccd4d7e
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYtjMqbOgXe4i7ojhsP5Lgrk1TWb4AN5:rTDxR+N5YzTfjMye30jaNf1TWbdz
TLSH
T18355B02EA7F805E9D1BEC5799A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-313-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/224-246-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/740-481-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/740-319-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/764-57-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/764-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/764-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/764-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1092-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1092-58-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1448-281-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1448-404-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1588-412-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1588-331-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1588-277-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1844-362-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1844-502-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1844-408-0x000000000C340000-0x000000000C348000-memory.dmp

Download

memory/1844-332-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1844-378-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1844-394-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2600-307-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2600-411-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2972-265-0x0000000000610000-0x0000000000677000-memory.dmp

Download

memory/2972-261-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2972-322-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2972-270-0x0000000000610000-0x0000000000677000-memory.dmp

Download

memory/3400-297-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3400-303-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3400-410-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3400-296-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3484-234-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3484-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3484-23-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3484-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3500-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3500-497-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4052-232-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4052-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4204-498-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4204-329-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4216-259-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4216-250-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4216-318-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4216-256-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4456-43-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4456-46-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4456-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4456-37-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4468-83-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4468-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4468-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4468-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4468-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4580-274-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4580-326-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4632-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4632-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4636-420-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-430-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-432-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-433-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-434-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-435-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-436-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-437-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-438-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-439-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-428-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-427-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-426-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-425-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-424-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-423-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-422-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-421-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-440-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-419-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-418-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-417-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-416-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-415-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-414-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-413-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-441-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-431-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-442-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-453-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-452-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-451-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-450-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-449-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-448-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-447-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-446-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-445-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-444-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4636-443-0x000001A67D150000-0x000001A67D160000-memory.dmp

Download

memory/4696-429-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4696-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4716-0-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/4716-1-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/4716-32-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/4716-9-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/4716-36-0x0000000140000000-0x0000000140125000-memory.dmp

Download

memory/4816-72-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4816-78-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4816-80-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4816-237-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4820-291-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4820-285-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4820-284-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4820-405-0x0000000140000000-0x0000000140169000-memory.dmp

Download