8da388c7f73fd839c3ea91b9829d06611a4489917ed227daf5956370c345e83a

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
Size 2.9MB
Sample260910-n8lymagg39
SHA256 8da388c7f73fd839c3ea91b9829d06611a4489917ed227daf5956370c345e83a
MD5 afa66d4dc8d294eaaf6ecae6d5273bdf
SHA1 4ec1aea341f56b2cb4b4b91349b81d6c191c180d
SHA512 a55c38dc383f4a0272be499be9776186c7c1d72d17505879cf5453dc56495bf2c88dada2ed6c891a12b5baf02e1f71bcc0c572c8e069f1fa5d21d979c031d2c8
SSDEEP 49152:X42+N95fUnYyAfd/LKydunkoeby+1bK2tnp/CXjKXi0aj3JWkZTaDmg27RnWGj:I55mey++TaD527BWG
TLSH
T1FDE59E6E66A405FCD1EBC1BACA4ADD13D772740F13B0A75F07A185622F5B2208A7D723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5104	alg.exe
4184	DiagnosticsHub.StandardCollector.Service.exe
3812	elevation_service.exe
3380	elevation_service.exe
3552	maintenanceservice.exe
2128	OSE.EXE
5064	fxssvc.exe
3956	msdtc.exe
4812	PerceptionSimulationService.exe
1404	perfhost.exe
4608	locator.exe
1964	SensorDataService.exe
2020	snmptrap.exe
1496	spectrum.exe
5044	ssh-agent.exe
4760	TieringEngineService.exe
4708	AgentService.exe
3872	vds.exe
728	vssvc.exe
3704	wbengine.exe
1952	WmiApSrv.exe
3632	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\94b3d68c3a3ba122.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1b393bb1c41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa20bdba1c41dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f31efba1c41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbf7d4ba1c41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f2f0ebb1c41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d9cfcbb1c41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000264a86ba1c41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a635b1ba1c41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4184	DiagnosticsHub.StandardCollector.Service.exe
4184	DiagnosticsHub.StandardCollector.Service.exe
4184	DiagnosticsHub.StandardCollector.Service.exe
4184	DiagnosticsHub.StandardCollector.Service.exe
4184	DiagnosticsHub.StandardCollector.Service.exe
4184	DiagnosticsHub.StandardCollector.Service.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2092	2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4184	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3812	elevation_service.exe
Token: SeAuditPrivilege	5064	fxssvc.exe
Token: SeRestorePrivilege	4760	TieringEngineService.exe
Token: SeManageVolumePrivilege	4760	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4708	AgentService.exe
Token: SeBackupPrivilege	728	vssvc.exe
Token: SeRestorePrivilege	728	vssvc.exe
Token: SeAuditPrivilege	728	vssvc.exe
Token: SeBackupPrivilege	3704	wbengine.exe
Token: SeRestorePrivilege	3704	wbengine.exe
Token: SeSecurityPrivilege	3704	wbengine.exe
Token: 33	3632	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3632	SearchIndexer.exe
Token: SeDebugPrivilege	3812	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3568	3632	SearchIndexer.exe	123
PID 3632 wrote to memory of 3772	3632	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_afa66d4dc8d294eaaf6ecae6d5273bdf_blankgrabber_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3552

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4356

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1404

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1964

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1496

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4828

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3568
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5c177bf5c7afb31385bb4b00b48ed8d00a89f986c99e016820428cd293f569a8
MD5 95692c9d592df0aa9866eeb053559a69
SHA1 d1cfedaea08e6ba93a1047562cd37cd8b259f3ec
SHA512 d534ed75badc1a0a2dcbb616b2ab484c6e0b8bb2cf660e93fa4bb1fc4223caaee4fe013e83093d9c7dcd64285d14ff6fe92d49a4266c17d7ada66da842dc3ad2
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnEDmg27RnWGj:/3q6HjBDD527BWG
TLSH
T1F9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a2195e109881d313fff2bf2c403e77b795ce74772542ca84f46e228f010c1cd6
MD5 a35c3a1f7f99effd5ecd52316c1b32d1
SHA1 07fb7d050ae5079ef92d5af3af06cab999fe82e6
SHA512 3d957bad83583d221df0ee86cd84a2538412a21c2ea983a7d5776e53a5df5813f3b19035e5106b2ed3b155318e5be981939fe739163beb703aff68c46ff961ca
SSDEEP 24576:hXYfDtczAbsqjnhMgeiCl7G0nehbGZpbD:ktcSDmg27RnWGj
TLSH
T1A0050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f14c1a6d0d847eda6aed6bd9b0a325a39554169d77c1c7ba3af33748fb00ac00
MD5 11d94bee3f293689faa178835a1a8fdd
SHA1 ee5e44c7faee64525831ef190cd5c57cd2091e76
SHA512 d110c28b74e509d53076493f728e3cf3905d6cf36555620731fbca4b2e99b08d0f1c236575910156d07608cedfc5f6f87a88e30be11ff5b4698e9965d9e4e212
SSDEEP 24576:M0Le5ji0hmxirMwsqjnhMgeiCl7G0nehbGZpbD:MPji0AcRDmg27RnWGj
TLSH
T1F0359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e2d2549dce60fc55a51049c1b33f37a82db0f67e5e87f1d525e18b6dac5c7cd1
MD5 d8acec13fe7eaeddff10e76e162ddc70
SHA1 dae90fc0b4f5c6c2c3cfe6ab9d07a42fadad7a5c
SHA512 12bfe54dba395e00cb7603ffc45b424aa6bbe2b6903eace752b68997e029419d9b3990ffb28e3a6c7f9ba626970bfcf8785304da8515bab8a6f1b1c0bf2bad94
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyuOsqjnhMgeiCl7G0nehbGZpbD:C/ezSC6vUzPvxHjytDmg27RnWGj
TLSH
T191755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 43a243127ae344f337bf8b8bc81c19c19876adb66dae4595b359818931dd2f70
MD5 b4f3ac68ad94d41e6da8fde56ebe5ddb
SHA1 529ac4e452cd8145f23d3ce1d36e018aba5461e8
SHA512 5347cdf6500a3dcb05080fc81ac4a1c373e6ee6307f74a2efe88e368c76f2b2de015a8360779223f950e2c9c49d0b7a32aaf267857ccaf7e50b9a41025b64b1e
SSDEEP 24576:eVbqPb88hv/l+6vsqjnhMgeiCl7G0nehbGZpbD:eVO88hXl+4Dmg27RnWGj
TLSH
T1CB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 7fb0774c7b622c0ab0d1555f2d22a0a5cf8d854c8b02ffd1ddd68ec1a393d276
MD5 96c1f154a8ff82674aca3708c2b1449d
SHA1 a491cd91ddd804148a929561448c4a9192a92a8c
SHA512 b46f019aae9c07bb68f517ae4ef352f1923c7e8556bd9da2e9bb189e968893301694b2e24452256cb0c930e3c6f2be01a15436c5578c5318c8ef6911058966e4
SSDEEP 12288:9R0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9R0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T134C423BE824C10CAEA7704B5C3E9F55EAC137E5698200843AAA77DFDE6F5454CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 39239095f023a463c17094d56291514cce6e3ee0a8a0535523fe08769261ef75
MD5 1533d1a119ac943693592e6784ef95de
SHA1 0013eea1a7a88f06b844dd322edb463f162ad928
SHA512 d179309c8532599235c21781ff6911597ab09be1e5e178772cfbf65057503ae01c21c5959c92902fe60a89d819c49a2b731e7c61fbfe781e453ececa17f10db8
SSDEEP 12288:TeBNUbTVO86UnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:TJIUnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14405CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E04E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 21db7af9500e17a2696f073f16f2dd2bf192483563178314adfc443784a1abc9
MD5 9ac697dfeaa29c1a2f0b0e564442de48
SHA1 358f1bc7c8c814609d9345bab8eafe0ab676214a
SHA512 0780e686b55953acd06ab151448dce019ff98df23a99479b3783afd88d5edc4f94139a5b23ff30572cb8f30046237645b0edc95f1732ad933c7833c6bc537a4c
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:OQvGAdlCEL8c/yRNw5CyD527BWG
TLSH
T10C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8a7207b905da077e6597454328b11a9f804fc66639bbfaf7b196554b35abfc95
MD5 5a9adf211e4ffe80b2f129f6e1408ba7
SHA1 925e9e044ee9d52797cd96cffe34895e28949509
SHA512 6d7bb78c3abb9ddb44cfcfd82fbc221f404a7b3a68fc0ba98748275a12ba82f1f212f32c15c847d6a6a8131d6d61dae96f838aa0258834fcccada1913909e521
SSDEEP 12288:MAwSfxL/2Dc34DLLmt0LDQewsAj9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:xdewsAj9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12915E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bfde36938acceed251711b63406f08a01ed47d596e60bdc19e533f75082fc683
MD5 d9a9cd8c7d039a6ae166fc4527c787b2
SHA1 f6035e0af4265566eab08566ec5758dd93b0fa8d
SHA512 142372b90092f28d2ae3bff886f03b1a38bee878fc747d0e113d540a4b62a7cb09b8766edbe4f5e111820937e6c56cdbfce31ea08ed08956dea55275fd61116d
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZVQBWG:8UEtQevvqc2W1cpV2EI32kB
TLSH
T158474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 46eb56a021b45d3722dc58cbe6340dd3ce65349af67c71ff9a2204f8ef8d0099
MD5 ce3b13e2bf5a33f6a89f2c0ffc128bc1
SHA1 8fc478ba85c8484c23a955267d53c82746aa75b2
SHA512 af1645b16c332a7443611da04ee66d8c9a0f5e5ef3d5f11c464f1a76f2fd7211e99f7d046e8d7e216b1d27fcbf2f9bbd6c4daea90dbd37809aea416b770020ff
SSDEEP 49152:RCbRquA/m2yL5zQfFiV+XenmE3/zBDmg27RnWGj:eoqtVjnmeD527BWG
TLSH
T18AD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e1d0775a9ac91460eb5c92b987d3a2191d41db971a0563ada65dbb6389bc9a99
MD5 c77bcc06f5af26f99872e25bb3627678
SHA1 6ce289745ff9a0abada6e94ff8aae1932841bebd
SHA512 758c8664b9246cbb8d74aaa56bf2e887288ba9cd7caf9604e59326102ea8893f4b749d62aa3c6b2429c13a16252e576ff60e221752a836845b9b751ee124459b
SSDEEP 24576:zAhGLJIFoiwtA5l7S53qsqjnhMgeiCl7G0nehbGZpbD:zAMyFoiq5uDmg27RnWGj
TLSH
T189359D81E7F951D4F5B3AAB899B69171E977BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9121822e5be8225295be72bc54c75ad2558883b487f91ef138fb82a03e100b77
MD5 801f0e1939f4387a37ec5d6d7602a707
SHA1 59ee47f33ca1c8b1a5fa6452562a075934efb5bb
SHA512 9297afc5f2c4e68ee5fffdd0038f07bac03459942b18ed4410e7388ceb9324dbcda73a70aee6ebfaf436ded7da53cefcc763a88bc203a4608e2a34b4536e6e65
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:qwuoOWJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15005F14A72A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F77260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 81b6c93ffece901bb44c5ed77ebcbe04deab823ec14347334eddb5e54576372c
MD5 8aa9215556e91c7c7a89c9b82839de13
SHA1 73f02a4386ed7e3d9f013732ac8c2c9f360de294
SHA512 44f5fae95e7c06a245a73a15d2e2ddeaf74e64c055552d945803531d40c5715ab390bbe0775c33d9cb939c84e914e9bb321dc412d9a8dae66d27874ac8619037
SSDEEP 12288:BBZ1IyNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vZuosqjnhMgeiCl7G0nehbGZpbD
TLSH
T17EE412AE239820FAE563417CC6E5D609E7333C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d8e597527abd6c4779f63d5a5c0180695c40920eb89aebe6d81cf7e93f342558
MD5 fba1d58a64db06fd7e36eb2b168bce3b
SHA1 37004e5bb87b67a29af8dd5790c7467bc758b11a
SHA512 533f22a63eda7246da891821258f1efa534c5aea88791a89b0fd30f934e4e016a1ada1c8ec5dc0aa36bfdc5a8f91252540ac8d0015c9ada758a4404b2dd9b4f2
SSDEEP 98304:nQRQyi36YOcPQLvw2gAf+PN33D527BWG:2QyiKayX+PNnVQBWG
TLSH
T19B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 270518b92bcd74dc9699042bba5eab577dbdf102d684f8953ffa225fb8e9d481
MD5 9ff686352630fcdd0247ef7847366f98
SHA1 501b8c6ce6212a79e204b963ac3289a4bc3ae06a
SHA512 3673accfc170b7a75c4e02263c7d2c266158cffd0d3396876e7a85864094ec49efb447d920d9f5724254560987543b3b65fb92fc8718c6f9bcb412d16986f76f
SSDEEP 98304:GQRQyi36YOcPQLvw2gAf+PN33D527BWG:tQyiKayX+PNnVQBWG
TLSH
T102667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6ec03e8c67edaac7753531186f0ba4e6c25a0155c3abccc28956a8d799730bdc
MD5 a72393d3c394389350f22d2d32249dcd
SHA1 d8913ab73ab837696c2ed2b8f951ddcc44763b43
SHA512 3613ba237ba18be8f083db30aa5c1b95b23ec49ec5307e9e902bd1e0e89220b24432887067ac5dcbcdc4de2efe47629056757ca42c11c83559a76f8a5b64fa72
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0YsqjnhMgeiCl7Ge:X68Qg55nhheWu7PNU3/RDmg27RnWGj
TLSH
T19AB55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ea995bf8fb02c1c6c410ceb15f728a35c5ebb1a0238d99e0e8353817b245bc56
MD5 4c96d41f6ee59275309a0b85b9449f54
SHA1 76d56fdcff48dd18865ef53624e38bd30b6d2fe0
SHA512 a21832ba552d6b1c9f05e746b2c66767e7da549b6b1d18f46c64b8e6bc7ac1f625fa29fe4498b7bd5b42d23892da6d28d987d7e574166a1173ccdb86c7c8a1c7
SSDEEP 98304:my5112gYy5azzVvL69nLKnhZQD527BWG:XLIHmWhWVQBWG
TLSH
T10A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e6aae711d5c6c83a53ca0a64183c246d86224e0acc275b04086748a9f904979
MD5 1bb47b3fd6eb20abd97608350293acdf
SHA1 2c36712b65a0fc5dd60c1c60492f1f78d1810903
SHA512 a1ae41b75b78bd864f0ba8f83cecc5f2034e6c1d1f0a4b2b6f382d61546ec683e13be3befd5e323234d966cf5ece1b5da92dc4df76ab81993e519a192f8d51c8
SSDEEP 49152:9B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/Dmg27RnWGj:ju6JmVxd2d/D527BWG
TLSH
T1EED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e833357dee03c6879495c8b6fa6bb1b68018f4ecea96a0a56cd7f9acec07b2e4
MD5 c8c99324f15a91dce636315c2b742cde
SHA1 291f6e5b83e6a7bf6b15c9b3c43729d66d8ac08f
SHA512 5ef4dec64229300663dc4550d3666e39ba072f13b1cff59cb9e7ef034012f6af849272ddc09a53bf8f1d4212bd12aed8e6765a6eb0a4b43670dc95681f668d6d
SSDEEP 49152:11hpsNoJpF1A6UU44CwH7R4xbDmg27RnWGj:1mifPbReD527BWG
TLSH
T177B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a4c794fce2426f3556085d99bdfed27e82835e4e0df281c0cda48d634aea03e6
MD5 2186c27033fa70b76e61ae691d3cd3ee
SHA1 f24208e08e1e4433d78c39d3c6c627fdb040003a
SHA512 71d95592a9078ff143bac20756e01121035ed9660457742987307d6b0d68f453118d904aacf26a61a43bae4324458a789a86b577100ba8c858a3d40c1c111b19
SSDEEP 49152:lSuZQIY0Be2KRRVtOnks6NMHqUDmg27RnWGj:r5dKTi61UD527BWG
TLSH
T16BC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 984c1812b7ece2593c7c450ad8a7ebf339e2b80b5bb893a4969164ae2707d5fa
MD5 4005b24bcbe205212403f32726352115
SHA1 9f711370859c9a6f973844d29869eb6c7f11dfd3
SHA512 055ecc1241e3918b2e6f7d123add6df898e7301a2b4bd40e2accd102be73d638495c55ebf6e32a9806c65249d753e80760708426662bd98b5c7a144802a271c9
SSDEEP 49152:lhtSn8EApI0figngiDn0AP5wPDmg27RnWGj:UX2iyphKD527BWG
TLSH
T12995BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d3df6c9ceb3c750e3fc286d0b9355575fec3d245fd1576f804f89969ff2d02e1
MD5 0d60a28353200a1dc239f03fcaf6b6a4
SHA1 4eef9f07934713d55b30f5fef1d6afc410548815
SHA512 973e1dec10eeb9f25a470a72e2ee65cb14cb2013d3348d0fb44b29ed3c1736668516acade944899b1789351e918b9cbee156e3c12922ef1bf14eba299156d066
SSDEEP 12288:4MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17BC423BE915C01CAE92244B5C3E5F15DEC173E57E9200483BA5B78BEF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d0b3965a0edff366930ccc9bf2d3cb0eb472667d680522bd3eedc0e9d28c823f
MD5 d43d9e78164012d2acf6c58caa827bda
SHA1 76422f36743a716e49408c78bf76ad9c26e5489a
SHA512 b3416661501a3eab725059a29769625679930b9dc3c133fec9320806d64b4bddd88fd94dea63d69e94a5e498b7c3f726208b775f631ec31a84e82de1aa0d9dae
SSDEEP 12288:nxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T101C423BE914C01CAE92244B5C3E5F15DEC173E57E92004837A5B78BEF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 91901879acb461f9682b975c835ecf3d918ab48b5b3e4a1ec5b0b4b2d919fcb8
MD5 dbbf99c4d3e47e461ca439594245eae3
SHA1 1b2b8ecc18d3e9e3a53bb80bd850fc87090e300b
SHA512 ef4156fb96048bf6bb22b230fba1cfa183f16164495fb156a713fc7751866328cf5d70de45526da99a57efbc79a38baeff0625ca4bbbc8f3924b79fd7cfab6cf
SSDEEP 12288:OfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F0C423BE915C01CAE92244B5C3E5F15DEC173E57E9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 97e5f4b1bf0e3ecaa9311006b10cbd4782821c3f234c6e6de4f1ba8c6cac8d9b
MD5 ce2436f9e27aef9a20c37d87abaf8cd0
SHA1 8b4de0f5cdcbcb8f33020c425ad00a3445b40f2a
SHA512 4c365922ccac1599c7c341f82000fef926428f3ba6171ea0254318db9a3055d1306fdb790c7c2406dee7d5ef810d385c794e81db539cd2950d7ae6f112fccf0b
SSDEEP 12288:RVKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:usqjnhMgeiCl7G0nehbGZpbD
TLSH
T164D4236E535C01C6D83285B5C3E5E11DE8237D56EB3005DB6B532CAE9FF26948F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 90ed0ab3fc0ffe6e980a002485e92ebff32d639e885219810168065e19e4512d
MD5 b668fe6756e5d31bbea4a053e28869a5
SHA1 b9a116e053307e4470722c0a1d44d65e4f10a777
SHA512 2ea4a582d24f9820f2b123c8984e70d151b9a93758cc57d61110d5c6ccae0f703d9899578e24866a4a5c1bd15bb47b1b280df217cc28862372989990d6fa6986
SSDEEP 12288:LyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B5C423BE914C01CAE92644B5C3E5E15DEC173E57E9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 afc2e1a1687ac6790990204f669d4fdb33c40d1797bb3c48351416ee6798dccf
MD5 aee980cd43dbb700f176937aa16cfa62
SHA1 517270de6747379636b64de28555001fc03339ff
SHA512 786a4f6eaabdbbf52fa6cfce11c55d8de699714784ca8a407140d5bead4306c0caf929ef3eb3804f72948e2d96f3c296f8f857220644b9617ca70e8d6de6bbcd
SSDEEP 12288:i1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T108C423BE914C01CAE92644B5C3E5F15DEC173E67E92004837A5B78BEF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 80f6aaff45145a903e3b81eeb709b1ca659cd32e03aea519e1934595e07391d9
MD5 3571c9866e1870ddb96549db93e568be
SHA1 a19f2955f06bc56dc3d1c8424f7f532ff8e209f4
SHA512 a5c3140e1b48dcd5ed9fd129fe156edc516df3f7b45f7106829366b58211f7d780d6ef2be50566c18db68186315f3f4e6142394ae6b84a739a1a4600f9f11f7f
SSDEEP 12288:O5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EDC423BE914C01CAE92644B5C3E5F15DAC173E57E9200483BA5BB8BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b72225e2a16c0f1b26abfcdbbda8cac806a705b3349d5249c58237400ae3a75e
MD5 7551611d517ef310a6405dd2f85606ef
SHA1 95e914022c6d05d65777901c60307215d19a3bd8
SHA512 a9f7ba4191cc8ed6307a56aec1366c56edb8053dc0e53ffebc8f93183cee7362259af41ca4acbc6b1c49d3087a2d156b2146b11e24328589fd8d7ae73a49e269
SSDEEP 24576:NZMSzFVSORsqjnhMgeiCl7G0nehbGZpbD:NZMSzf5Dmg27RnWGj
TLSH
T1CD0501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b0067fd4be1a4ee2c3c67257799567abffb08feef1bfa676ad289522e148ed87
MD5 7b60ee4413f0bf2ffeab14d7c5b9b399
SHA1 78a9d03a9fcfc171938ca43e25fc1e82d79b081e
SHA512 28acd59369b6617a9142d18b2acf1a4c4dc8180ba430cff0beea99a6932f5b8e24837100e04606a0c115ca753bfa033774e9fffc3808d72464b62a4b22415fff
SSDEEP 12288:b4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B0C423BE915C01CAE92604B5C3E5E15DEC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1cf252a4b3907a97553c4235b34fca4ca5a681514dc4ff22f51edf491f353362
MD5 16b8ad35271cb34b67267369a17eda65
SHA1 2065fad6053c9c813a6b6eedd1fa75618a377093
SHA512 c199b24a0a20165593125a52ff0de6ab75e4d87250becc845400ed89b2367a0aaae4900f89a4c2c3cd382f1d2a1184acc1a539b81619590d22611dfa25b973f9
SSDEEP 12288:nEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15FC423BE914C01CAE92244B5C3E5F15DAC173E5BF9200483BA5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 edb2f2e79037fc702d5881a607df53b3d77b3b65f0123a01970f7400fd55ca82
MD5 d5d974994b6f7e6907cebc235ba89889
SHA1 d0d4071cc1601eca46d37c3098e67fc0d552b99c
SHA512 8e59418bd01b532e9d8dab802c2c652d6fc73bf5bf95b21af7254e6d17b8835276e089a16ef5051880bc198d3d12c45f2e8abc1a89720d03351bffbce2196000
SSDEEP 12288:8yPz5L8NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lzyNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12DF4025B73A530F9D5378138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 eafae8fe28ccab39e0ef79c29a1482d59ee47f7329f4db4159b7708e39529846
MD5 6be384e559476dc197e489c2cd934819
SHA1 218f7f2eb50c06a66b930232d9efc32c0fba1ea5
SHA512 26685b0448aae143c376e2df63738228d5eb4f273ab21f2ea9320d1254c9e47863842002ec04b93f7ed5ded89289d6f0950dfe1e5ae800edb0fc724c26d1e743
SSDEEP 12288:J4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T194C423BE915C01CAE92604B5C3E5E15DEC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 86b308848da5a57b338ed55022ee02e1549a4b69d6e9500a7ff13df9edc91cbb
MD5 6a5a666425129a7433a7f72249d1c6e5
SHA1 57f63a7c03ab27e0f8b5cafed30d77bb9c8d2372
SHA512 12da8f6536e10edae7787eda327104fe76db8e542a9d314ed1ca6a12be5ebea9ec80a87f0a28615f53c360827286ce44a037a6814d92c03fb32b37d700e02356
SSDEEP 12288:U4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14BC423BE915C01CAE92604B5C3E5E15DEC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1ccf38f08723c0356acfafd05891a3ed59b10b5ee1fc6f2e1a4452aa3da0241f
MD5 31b7bad16a97bdfb56726570b249d1f0
SHA1 60184da192628620c0f512035242b94aa55c16d3
SHA512 bda3a39c1a837f3dc68b3b9a8760200e3b542efaa83f2c867f64b690bb32e626db2f8bf6e0f36fe39da3554ab6f415b9c50db1cde9a4bcb585b58f0aea45463e
SSDEEP 12288:OyPz5L8NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TzyNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T121F4025B73A530F9D5378138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e0018473a6174cef0d35c4bfe0091c617fb5b1a065c21d81a50e3f313667fbbb
MD5 27c6c12023973f1c80c6ffff836186c7
SHA1 26237b2f0a25d69e3bf8b21fa5b5a00180ae08ce
SHA512 7917ff3e8feea9907d38d49381a3a5c0981834495b4cb6d32fcadded6596347a7887b29ee92310e6174d05cf5ab07264947ea70dce2cd264996b9528c10cfe30
SSDEEP 24576:lTHaLl3z0zDPsqjnhMgeiCl7G0nehbGZpbD:lT6LljiDmg27RnWGj
TLSH
T1CF0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 522bbfcc9a22d959fdc012f20e9040e99d4a6c6e209dbed9033d206c08cbb36b
MD5 dac4d2c6863b70c00475f419fd1feef0
SHA1 4963e604298941d29ab008843df8ca2bb86f87bd
SHA512 e16412f50ade5a39183c324da8f31f1031ec36d849790290865b3c025c6da0eb5bfcfbf4e1a5b841c841683dcef12f31d6277256874728cab2dbcb4264da588f
SSDEEP 24576:V37d9CHKy7GZTsqjnhMgeiCl7G0nehbGZpbD:17d9CHKya5Dmg27RnWGj
TLSH
T1AA25CF90F3E810E8F0B79A35C9769511D9767C5A5B30CE8F03A4656A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 be301d0f57f40eb107f5debaacf0d6151ad0827ca5eb9193725268b949a867f7
MD5 bceec2c1ed1f7534c3383496dd4311d8
SHA1 460eadf2445768cf941cd47b0ac2f12f1d7ce19d
SHA512 5b184bd3e5fcb1edf912befaa7e0b9469c1b80d980240a11cbe8e4a308c3cccb1c77b0f28791aa5ddd75d9ab8857591a83c8b60e7d66a4ac0fd84d0ebef483d2
SSDEEP 12288:E/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T117C423BE914C01CAE92644B5C3E5F15DEC173E67E9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 51eb2a25f5fa6a17b5398c5205419a1945356f7a7068bdb010a5b84b8a7bbc27
MD5 046404fd16a035b49ce8414686b4a268
SHA1 8999770a9bb61dfb97d5af692c5d225bb05af820
SHA512 4ece71a92414b246a20e728b40ab78318bfa99a3b4db66e6645188f11d5d73752106521176e770dae63222cd8d521ae9be508b81abee57d00614444de5a46d32
SSDEEP 12288:GtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11AC423BE915C01DAE92644B5C3E5E15DAC073E57E9200483BB9778BEF7F28684B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c6ea5e6a1f0833fcddd85d3745b8dab2c5df00ce2413975c700f09aa4408a563
MD5 103314119c9559f18efcee3cdaac337a
SHA1 2fb5841bc0a9ceff1a30f613219005955a2e54d6
SHA512 16c6697c71a0de4f4aff4bc3a7cc6ac0922f2130912c09ab037bee55ab0af56241f44e7446e207115cfa043e56f7ffc3e0746d0a80015de9daeed8cf1f9d9ac1
SSDEEP 12288:QWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T164C423BE914C01CAE92644B5C3E5E15DEC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a688b8986628dfb675c7fbab8c4a8247b90684b516c527f0008edcc838af269a
MD5 c6b5c6fda9c972e5dc45ea3f75790ad1
SHA1 0c09901eb4a1dae8d346a65265ab1d66f6e71f08
SHA512 b919ad4f993ffc5b4c9d74a65b184a5b8d90ef1d1aca1973c84ecab5608a469dda7cade2b59ea9bcbe038d070daad53c3c2102ed719438ea73e1aabb075c61e2
SSDEEP 12288:fNsfoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8osqjnhMgeiCl7G0nehbGZpbD
TLSH
T19EE4015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EFA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8b8a73062874c8b238d50cb796491f740c98be69b6e36ba1931484d2fba543d3
MD5 8e09bbf5bea7c5490374b707453abadb
SHA1 29cda3cd8f8d8c2aab7f8068f8b48b67be5d36c2
SHA512 2ef592b06e3a5bd264e2f1c508d5376580859896117883a9b0f6b101bd51d5d5601c06fddf6f5ab27c80222f0e857ac2905691a4dd107aa66c5dbd8607b7ff7b
SSDEEP 12288:knJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C0D4237FD34C018BE97649B083E5E12D681B3E669E204483BA4778FDF6B18A48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 71afc7bae7403e0e40bb90f891b71292844e38142b634ff824ab66744736f20c
MD5 fbe44968870274d80aa4bdbceecbe218
SHA1 85d35fad95b62262296d21a1508bc347b7c7bc85
SHA512 640f84d08aa121033a16421082041561da09c409c017f1dffc3a052905978628d8d5cde52c71a44efc4d7c69d5b31fdbad09b0bce65114a9e47f2a5a4421ccd5
SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQHDmg27RnWGj:oa0hNYG4Jw4D527BWG
TLSH
T13385AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 2b990096072eb0f5ec9afc858c0e5c425ba0f55bfdf225f2ec8dd1cd0c61151b
MD5 f9ca5a03ad41d92cc3d632773168531a
SHA1 aed6c0ad81d7f1f6a0d1b93151d692c4ceecc9c2
SHA512 f14ba8836dba4b120eafcb25a00b1f6fdb4c85ab50600f8076b61c4aca7be81e64093298d7f7eb31ab6abe911aef57a5e3fa97f5a5fbdb45bb4b49f3a115a83d
SSDEEP 12288:khbHjfXaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:khbHjPasqjnhMgeiCl7G0nehbGZpbD
TLSH
T19BE4127E12AC20D9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 363894b020eed47ba9dbb957526c9093e3c6640217dffd6f235136f201325875
MD5 db1c8cb45b1b8a2e39c9ff269dd9e8ef
SHA1 c9899a74abc83252fb4e34cbfc780a0fbdbfb800
SHA512 90fdd18587ae1221359aa5631964caeaf42cb88318c0e53fce1a5c63414624895073155e800952e6b1ee8f266be1964df378a86e71b2f85f78ecf9a4060d799c
SSDEEP 24576:G3YgnJcRTk4yti+R5dBR/osqjnhMgeiCl7G0nehbGZpbD:GIgnaTk46pBR/UDmg27RnWGj
TLSH
T15945BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 6200cca8b516defd70ef083ae98b0eb2c87be9a77c1d3f73e55f45cd3878c390
MD5 658c5aedaf2e89a800649e9e17d3d7d7
SHA1 3fd20197d07785d35e401cba2cd3a1add4ee96f5
SHA512 c194f671942710ef773e6f5d871df37e82bbd39f2abd489b0848782938cefb791621aa8333dc879ab13ae5daa0a59146777527ff922f5d63fa7fb387cccafeb1
SSDEEP 12288:77JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T177C423AE924C11CAD93645F5C3E5E11DA8173E56AB2008C3796778FDF7F28E88B38512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 50f4c9da71ebc6aa8e49e5e237fac9f1769cb989d6242de274795207f6d4a92a
MD5 1580af40eeb9248d1e96ea190f14057c
SHA1 a121cb8712373d8323aa3feadecf4fa0f9ec4751
SHA512 054961ea51c4c9ec098f31cad04cb347ba6a3e2e92073884b8dc95776b70b79b155f6878f6f1548a65244450914e2d1ff2e70e3f152aea46712195472d89b04b
SSDEEP 12288:sOb9A4LWOsvAYFT+JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/npp:RpL3UTKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T196250159E79800F9E87B813CC5A2D616E673785D0720E7DF03A94AA91F637E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 04b46f661a9726c88a78cd862d1f31f486c6ea7b7ac35848738d3aa1be21f782
MD5 7e10c7b912b31f67644bd62c721d4bfe
SHA1 88f6654856b03c05708cda24921a91b65c5dd061
SHA512 17ef887f285e9fe6c8abb4a9b573abe6b8f27304562810ce11313269c53cc94ab30fa62e30555e7e93c0c39750395376662c0615c98f0fdc14ca77f4e93013c9
SSDEEP 12288:dpFtpOyJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1O+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E5E4026E32EC10E9E536917C8692D20DD6327C661B2117DF06D180BE5FB3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0f253e25f674da63cd12a5c2410a230ded40a4b651dcf4dc2357bf9a090df4f1
MD5 a341854482b47990fda78209dd4e1d2e
SHA1 8d223fc731ae910e39f6d746bff34cb140760a3b
SHA512 a0e916989d89d9785dba75eab2784f255bc3590adcdf4b21cd9f0b2b235391d27afb765541f84f72c93386a67cbe8e3a80b6d4fb5907beabbab9ad1f63f4845c
SSDEEP 24576:D7NM9YqZqmWMUkPjZM48Mv6bEhsZsqjnhMgeiCl7G0nehbGZpbD:D7cBWMpPjN8DbEh8Dmg27RnWGj
TLSH
T170659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 93041aaa51fcdf88c3449d199d41a7f4b8125bb001b13a517db8138b47c9f50e
MD5 a73606476339196a7126e8aac5d0d61f
SHA1 1161847d2a6b4f1477cc1eba209c73592ebd30d4
SHA512 a4e0681b6203b10982ae15140ebe6d80d6967a3b9b6770f744ad85dbe4899cf181229ba96131e2131cf0af23d839361c9db2a6797a3e14e0b599845e17531b6f
SSDEEP 24576:5W6BApg2YuyuNDYTabvcdvNYf8km1fsqjnhMgeiCl7G0nehbGZpbD:5F2YuHNETovAvNYf8km9Dmg27RnWGj
TLSH
T188857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 487f0b635c8d5e6b55949e5534c39173ef4e2962611c85cd22a7fc95df76d6f0
MD5 3debc9f8621e68cc300dc7a1d610c6de
SHA1 1b3b18b238bed3347535f7e925b3f0f2f1069b1c
SHA512 3423f9b1f2b7636b13aed6f4dd3c224bbd8cc515ea04d077e54c840267eeff116a0e931aa3a4c48c1709ee58f698e6aea28381b214a0b975081995bd5b469b92
SSDEEP 24576:nAFs06+Omlf3NXEbToCsqjnhMgeiCl7G0nehbGZpbD:AFs060lVXunDmg27RnWGj
TLSH
T12D65BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 0540ce5c1435024780c73616cd5765a7fdaefb3a1c3c69e71c4bbf63730a7b86
MD5 5b2db0bf07fb9d01daf491aa10aaf7a8
SHA1 42f69284bb0d33bfb1a078b3680263ce243f39c6
SHA512 b22b2a36b0a09db3e6a77ce1daad1e42806632b850827587ccaa3660de4b6c6e94856369ede7775773d28c519037569e4a65b422d1ceabbb79620e81bb70ac99
SSDEEP 24576:pJnJ5D3WXjsqjnhMgeiCl7G0nehbGZpbD:pJnJ5DGXnDmg27RnWGj
TLSH
T10C15E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3537097ec3514bcebda2974595e723c218a66d16e1f6655c0df376c6f3bf70b5
MD5 ad359bc8b984bf287871f7d1ac5de12f
SHA1 524211185dc540866ae54581f9f14f2ff0bada84
SHA512 0afdd091eef23f3631dfcb61294393c391c7cb40da9b208a414102893a3751aef48957023cea84ffa04a9d43d29c74bffc9d2bbc68df8bc7c48e5b152be598fa
SSDEEP 24576:PEPghm6/7IIXdwcXrif7qQncjlP65i3VuosqjnhMgeiCl7G0nehbGZpbD:og06DIKdwc+eQnSt65aV5Dmg27RnWGj
TLSH
T1E9955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 375bec182215f785f088d8c374ff20957b50a306e08075361dfe7b01ad74d305
MD5 17ee29377e3753682431ab68284f319b
SHA1 ba8936dcf2bda8a6553eb182db554b747e618b4f
SHA512 57f0b38b6bac71781dafaa4d0e785de3542164dd1291770b614fa8cd5c5137e42dce4221cc76c36dae05cd63d8cd7de7ddc41c7d96e3457f7fa4b36093ceecc8
SSDEEP 12288:EEP3Rn5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/n5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19BE412AE679C60DAD536907D8291C209D733F4716B2127EF16A2D17E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 a9073ff6974b14287f1305483255a4ef4baa8c9d070c42c32bec6afabba1482a
MD5 36a6d3287ca18f641575d75db45fe474
SHA1 06fbb30764556e8940d685bbe83ef83d3cec6886
SHA512 2e985a4161b8265ff56069a8724f0b1777af303e0bcf4c4397dc55b89d4cd756b32f7f0140248ac8e7fed0c69c653bbbef7d44a007fa2528e861d065a9cf2a66
SSDEEP 12288:3jky8JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3IyQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A9F41259639C50C9E9760578C6B3D1989C32BC31AF2046DF6191FA3EAF73AD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 f568c66aa2eb863ca70a2bc7ec3803584c2d34bf2a9bfa3ed93e818113f31510
MD5 07d67c9c4277f96d0e7a7d7e93afafe0
SHA1 f1f35ded8a87eeda4d0a6e2909e5a605c10ac25a
SHA512 80be2a5b291bcc0efc76667e2aa0a5738d4ae11e76b53df8a039840105e47e299d5e2e34db4171e070e52a0aa755472711c57ed4a82ed3d0d0a7273ff9b6a01d
SSDEEP 12288:DyiJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uusqjnhMgeiCl7G0nehbGZpbD
TLSH
T135D4237E525C21CAED2245B4C3A5E51DA8233D366B2018E735E7F8B9EBF24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 720f138b0c31e47f32739b9d67836c7ea40ea2374d87a563841131ff47821466
MD5 0e0a84b49898c834f968003a19b746c1
SHA1 1d142568a62d7730425f4e0fe72bce7cde506130
SHA512 b2bf72374e85d3cbf2c2f27a6b57b703d4b031534c5a4baf726c53211a84afaa94c1be0bd973669f6148f246cf09925886dd5db015895ca146182ddc8bc5d7d3
SSDEEP 24576:EQ9MxZKdcz9dw3RsqjnhMgeiCl7G0nehbGZpbD:EVKZlDmg27RnWGj
TLSH
T1F1558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 14fe8a5d6258f466b170d52eab0367b91a7b3a350bd69136af0dd4f70ffa1a32
MD5 b7edb0ec324dc3c3274005bfe39ff523
SHA1 78052908a8589a43550ea46101f90dc1d22426c9
SHA512 74e8ee8662fb16b5dad082085042c728afbf5a3a855e2d6dcaa2582e69a681140c5e0c5992195f4f7988c8c5e33d7f5f890c565e5b5072dec664690cb4c19d73
SSDEEP 12288:tyoKo2JRple9pQJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:tyocDApEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14DF4E01FB76D40E2E176813C8985C249E673B4315B2157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 01c725bd0cf5bbaeb27df99a3f9617894dc326d84fade3658c96c411a1c346e6
MD5 e92885d4bf9fe81466b1c4377300dae4
SHA1 e74e9c4c5a48aeddc9dad8321c5b8f9872034ed2
SHA512 dc82ba7ae36b573b60e052f192b31f12f887491ed8e2beddae1181c0b3a64bc2abc578d1468c27d5db18e9351a25ef3818b806ca8188c1c8df30cdf99c2f4b69
SSDEEP 49152:rWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKgDmg27RnWGj:b0zuNIeD527BWG
TLSH
T11CA57B3DA2BC00A9D8AAC375C14553A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9a59baa62fe4d304f8ccaf085defa3337469cc3988c8c6548f26e73e74be5c4b
MD5 b2c98720d30ba9295dc607b405944330
SHA1 c169f7f0f234f4e730afe04b9b143edec6b56ced
SHA512 2ac61809592ff4ae737935f7e5082207f2d4e9bf0b37e70617b7d78334dd240982f6fab03138683e4029a878ce670577b15bd280d5ba3770b8bfec0291032afa
SSDEEP 24576:p1QT7EcpfxR+N5AWAz3ooiYtjMqb5sqjnhMgeiCl7G0nehbGZpbD:8TDxR+N5YzTfjMMDmg27RnWGj
TLSH
T13355B02EA7F815E9D17E85798B23C516FA727821033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-546-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/728-322-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1404-267-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1404-269-0x0000000000600000-0x0000000000667000-memory.dmp

Download

memory/1404-273-0x0000000000600000-0x0000000000667000-memory.dmp

Download

memory/1404-325-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1496-411-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1496-295-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1496-293-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1496-287-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1952-330-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1952-612-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1964-415-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1964-280-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1964-334-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2020-284-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2020-408-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2092-31-0x0000000140000000-0x00000001402FA000-memory.dmp

Download

memory/2092-32-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2092-2-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2092-11-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/2092-0-0x0000000140000000-0x00000001402FA000-memory.dmp

Download

memory/2128-82-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2128-85-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2128-237-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2128-76-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3380-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3380-58-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3380-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3380-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3552-74-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3552-69-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3552-67-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3552-72-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3552-61-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/3632-615-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3632-412-0x000000000C980000-0x000000000C988000-memory.dmp

Download

memory/3632-374-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3632-390-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3632-406-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3632-335-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3704-611-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3704-326-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3772-430-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-417-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-442-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-440-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-454-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-443-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-452-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-445-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-446-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-447-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-448-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-439-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-444-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-453-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-455-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-456-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-458-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-451-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-436-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-438-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-437-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-459-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-450-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-457-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-418-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-441-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-419-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-420-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-421-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-422-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-423-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-426-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-428-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-449-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-432-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-431-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-429-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-427-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-425-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-424-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-433-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-434-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3772-435-0x000001F687A20000-0x000001F687A30000-memory.dmp

Download

memory/3812-37-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3812-46-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3812-45-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3812-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3872-318-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3872-481-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3956-248-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3956-317-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4184-28-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4184-27-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4184-19-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4608-329-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4608-277-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4708-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4708-313-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4760-416-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4760-310-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4812-256-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4812-257-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4812-263-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4812-321-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5044-299-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5044-306-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5044-300-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5044-414-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5064-251-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5064-244-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5104-178-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5104-15-0x0000000140000000-0x00000001400AA000-memory.dmp

Download