ae2410ec94b1c6bd18f9b231f48f51e371b879a169077b7944a83c6290a91beb

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Size 1.6MB
Sample261003-31hcssz12m
SHA256 ae2410ec94b1c6bd18f9b231f48f51e371b879a169077b7944a83c6290a91beb
MD5 ef96b04b60e40626861c321b6a663d3d
SHA1 ef25f2a21a437f903b6fb2a058e4ea69663cf390
SHA512 bb02f6f1967d4a888ab2e7cc8199d63ed56f95352215667f056579fdc5fc99b87d69d41ec46019614b995bf7052b33fac19711a2041c4c83883b5a3d7acb7cd6
SSDEEP 24576:d3oH6RhNF4Xx7AXvoKFLgYHJWwl24C15rDY:doH0FEBAXQKKYpWwl1+NY
TLSH
T1E085DF49A65840E0E1B6C27889435842E6717C015B71DBDF13E8E63A2F77BE19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
2800	alg.exe
1824	elevation_service.exe
540	elevation_service.exe
4488	maintenanceservice.exe
1592	OSE.EXE
4496	DiagnosticsHub.StandardCollector.Service.exe
4600	fxssvc.exe
4940	msdtc.exe
2284	PerceptionSimulationService.exe
2084	perfhost.exe
3284	locator.exe
3468	SensorDataService.exe
5096	snmptrap.exe
1832	spectrum.exe
4272	ssh-agent.exe
2152	TieringEngineService.exe
4812	AgentService.exe
3420	vds.exe
4036	vssvc.exe
5064	wbengine.exe
1868	WmiApSrv.exe
1252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6192073cc665fbf6.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8902f589353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd6001599353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0cb49589353dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004faa6c599353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000515634589353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac58f6579353dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b20dc579353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdd0ec579353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe\""	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1824	elevation_service.exe
1824	elevation_service.exe
1824	elevation_service.exe
1824	elevation_service.exe
1824	elevation_service.exe
1824	elevation_service.exe
1824	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2840	2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	2800	alg.exe
Token: SeDebugPrivilege	2800	alg.exe
Token: SeDebugPrivilege	2800	alg.exe
Token: SeTakeOwnershipPrivilege	1824	elevation_service.exe
Token: SeAuditPrivilege	4600	fxssvc.exe
Token: SeRestorePrivilege	2152	TieringEngineService.exe
Token: SeManageVolumePrivilege	2152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4812	AgentService.exe
Token: SeBackupPrivilege	4036	vssvc.exe
Token: SeRestorePrivilege	4036	vssvc.exe
Token: SeAuditPrivilege	4036	vssvc.exe
Token: SeBackupPrivilege	5064	wbengine.exe
Token: SeRestorePrivilege	5064	wbengine.exe
Token: SeSecurityPrivilege	5064	wbengine.exe
Token: 33	1252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeDebugPrivilege	1824	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 5480	1252	SearchIndexer.exe	134
PID 1252 wrote to memory of 5520	1252	SearchIndexer.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_ef96b04b60e40626861c321b6a663d3d_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4488

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1592

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1468

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4940

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2084

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3468

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5096

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4544

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1868

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5480
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1802a0716914b3e5df9e2799e018fcf06ed65810136c0229e9cdfb0fe80b1f0b
MD5 4af2fe3436a081427fb6ce1f8e01f76a
SHA1 ea1bbfb677e064ac8e26cb4de17fd6995e86feb5
SHA512 332ed3cafbda06562584b60d47840aff8b2da80b35e5bd9b3fa07a03c2ccf884898fd4ed5ddd3746af3885597f41504528ae1a61b8c085666431f93edd07c988
SSDEEP 49152:Lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn0QKKYpWwl1+NY:Z3q6sjBjKYpfg
TLSH
T128D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 287e4bae34ad705adc04ad04fa5221888244be61404b9ed77469dd0cdfe152fd
MD5 051de4174bd1b0dac71cc40d94fef9da
SHA1 f33842c942efd9ad2387dd60f42e714a5db7582f
SHA512 821d58c8d1b370459def7749888106624da09b6788dba7a9037237ad5f4df5e549abb8779dc11347a676483fe3bbe70e969ec580925973b53c1f0ccef2d9f5be
SSDEEP 12288:m1XLsswWkxy2lRq2czA3JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rd6:EXYfDtczA3voKFLgYHJWwl24C15rDY
TLSH
T11E65F12973E508F8ED67817DCDA28402D633BC5547A0E79B03A0A96A1F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 df5b9d02bd7776b08030e551c0a7969e51f1a257e7e5ef61ac3018e06d11ea9b
MD5 8466e4d39e47ace46aecedb1956b6a19
SHA1 e426bf4c8be63631a82192b82f8696c9a90b7c7a
SHA512 b44d8fcce6a6b5752bcd3fa7b165d5ccf5fa7096a4ebabe4fd5259867e269fee089ae510c5e141ea523d762d840f1c15b7668a5c4744e7e1c202bebc53e6f8fa
SSDEEP 24576:50Le5ji0hmxxrMsvoKFLgYHJWwl24C15rDY:5Pji0AjFQKKYpWwl1+NY
TLSH
T14985AF16F6748371D073C0B9C5D2A68EE97134865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6802cfc5b37fde71a3fccaca7a605313c430895c71b103397a57f14caa422893
MD5 b8de9e986eb9152bcd9a52b4594f3766
SHA1 a685946c5f9e2f5d1ac50ac2dacc291c906c977a
SHA512 2e508f40c24584a8f4323cba30775d8310b9dd2e35215cd1c055927f756e36ca564a84b84a787cda5cea3ccc6a047a1e47b82bb60699c85c252c6e92b1f2b418
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWn6q8wyu+voKFLgYHJWwl24C15rDY:A/ezSC6vUzPveHjypQKKYpWwl1+NY
TLSH
T135756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 29aece175c3d0c794aab353021f2fb68001a445d662f8e3e1003d2d9363f64b9
MD5 45e977743ce91508c33a27fceebaf4f4
SHA1 acac4c4c56cb418f6e49df06c541e32545840293
SHA512 f7b9bbaf0581c4deef5cb2c8d2ca3dd5ad66bc03c53c5e13ed2a66096873cae6fc4c5850c4ce58afccde028aabfcf5b8098753caece083e1932b20570073ace3
SSDEEP 24576:rVbqPb88hv/l+YzvoKFLgYHJWwl24C15rDY:rVO88hXl+GQKKYpWwl1+NY
TLSH
T195559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7674d8f00764310f340c200017a86e67ff55005330f49b2f015a18ea03ac188a
MD5 120e7a1b1b0cfac98185315c0a1855de
SHA1 95982f3696fec65ca47576a545e178772ef58d02
SHA512 489e95d33bf1756ac1eb6a2d902f224caecf137e1f1a9125415f2d3d915e6adee2b411761e514ca7d3b83e3191f981cd530cb7a4c94a449a786ee929fb6c07ec
SSDEEP 12288:sLYJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:sLYvoKFLgYHJWwl24C15rDY
TLSH
T19045230B71ED80F0FF5A0EB5BAEA64478131CF0858C84A57D4117ABF28B6EE8B71D159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 31ac1abdac6e57942bb3db6667dd09a667341ccbe8ffe58646c471b48d0bd2f6
MD5 ecd8e392e792bc670720a06d528eaf2c
SHA1 522f63f2599f43fcf3e280ef21d61cb0cf538a64
SHA512 25fe1ea58924e408994c9e2f927115bf3b9f5259ff77c42ba6cd2603abfe82d1acdee723f59d40f4087bb7ac92bcc87084de9ee999c37a122f482ee1b267aec7
SSDEEP 12288:IeBNUbTVO86ULJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:IJIULvoKFLgYHJWwl24C15rDY
TLSH
T14365CF3BEE28FCE2C67E8DB95A918600D77278304F5193CBD165830E9E235E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3966a8b4325ee8a08703ee1be047c6def1e4555ff576e8fb39faedd11132abd3
MD5 d5955acdad6dee99c40f18fdaf723363
SHA1 73672745a6a4157d4e9d1b0f84459f103320a68d
SHA512 82bceb635aa3f10b59ddba6d6addd94f639f7f9bedc49caa815baf5d1e37e3521fa0d67cb8e775f48e32ac25f67840ede9656693a3988cbb299181c1a2b121bb
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THf:nQvGAdlCEL8c/DRNw5CmKYpfg
TLSH
T116267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 884feb86a84ad2e9628059effde64637fbf7fd2b301dfbbb02d13e2d4d0c5730
MD5 26a35343ed6bed2d62e66ee4d6cced5b
SHA1 567cc1f93deba5f346393723ee64f3508f983ddd
SHA512 b6d986c1ba2b6078bd55861f7457a0a37eb44dcbbf04ea9ef27bd6e664231b6f94fe683517f9ba1386f5f5cf86bcfeccb1a84a277ca0cb2644e95d9db8c5555a
SSDEEP 12288:TAwSfxL/2Dc3RDLLmt0LDQewsAjVJlARaGdf1IrOrNhyRfLz707YH7lk9wl225Ck:M0ewsAjVvoKFLgYHJWwl24C15rDY
TLSH
T1F975E031FA74D036C77B0DB61B36D706543CBE204B911AC3E3A89E9E59706D2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3ca9de290c4c555ee2a939e1f7878edeb026372134616c69117575e0f14b6fdd
MD5 896a6b22eb44f1333c45ccd6635978e6
SHA1 b523cb542c0d7b8dfb3e0a9c3cf74a1049f7a359
SHA512 9a295bb372b4a232a572ab2df56319b3abd10713402fd72c26e67b112b8125d7cd3f8a8b7d2de67b7e871c3485d8778d28d39003593bd9f005b4da0fc26c6e9f
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHBI:YUEtQevvqc2W1cpV2tI32q
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b57f54d7806a77cfd43b034f82d4f9686375903babaf237ff8215c33409d13fb
MD5 343aa066e0085b2d84c893dbb7051a96
SHA1 5502e8e7a663c98b3d742754d8dc9297786eaf0c
SHA512 6ec45e257df06fe2f46d071fd5d7066d231136355e8806af25a86c51608d3ab78740ea1e635fd352e30261556219a0c2ef9b1a1331799e9fc5c147def948d9a0
SSDEEP 49152:SCbRquA/m2yL5zTfFiV+XenmE3/z1QKKYpWwl1+NY:3oquVjnmaKYpfg
TLSH
T101D58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2dff53afc403c79818b4f0e42561156cbb3f6bcfde7d254f165b0687653d0c84
MD5 c4da310f5ad06a3d003d8bdd8cb9554b
SHA1 02d0ee9bde62fea52b9c3457c29edeb2d4069866
SHA512 31c6b00983353b71f39da15a2766cbb1684c807d902542123d3dfa8cde28aca77542238ba8189de393555c05e457741154985fa2076f2674433fad9074cbde81
SSDEEP 24576:3AhGL3IFoiwtA5l7S53ivoKFLgYHJWwl24C15rDY:3AMUFoiq5SQKKYpWwl1+NY
TLSH
T12A35AE81E7F945D4F5B3AAB899B69171EA76BCA65E30C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 27bf18e073fea7998a9b70d9c732851cfe24ca2b715bfc755b3f86cb960deff2
MD5 aaea8ff2edaa2da3782f27742e5ab502
SHA1 d77ed93ff9383bd7070c2afc038ff292679e30cf
SHA512 3eb5629aa58a76b63ff03cda4adc311f42bc8022ad9633d6551255fb3d79241448e5d306829bc2ee9eeea68ff140fd2583fdd717260c44a0bcb1f584ff27566e
SSDEEP 12288:+mw5HEjsChNVBFgl0WDm+CeJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb+:Xwu4OWJvoKFLgYHJWwl24C15rDY
TLSH
T14665F14A72E90CF9EA678639C597C036E7B2BC012A64C71F5760C65B2F373616E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ba310945cc75ee7d4e231427a3d317b157d5ad9505c2ac9a29cb716f1e610483
MD5 cf1d8f760af0cc8354cd61addd32c4d4
SHA1 6d140ffe8ccd754372a3a74a042eba40a271006c
SHA512 824044bdb83ff28f73a4d1cd17ce388deb4d3d27c2559ff2fa9984b18f905d53dcfce754554fdee56cb5921cc40ebeeaaeb141efa2af7795cca40b8cc232bd0c
SSDEEP 12288:feZ1IylJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:GZuEvoKFLgYHJWwl24C15rDY
TLSH
T1E155124B32E860F4EAA7467CD9E55506C372BC1627B443CF512162AF2E73ED52E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b04756fd366a64af58554460e8b0cb82af6b03176f12507ed61861cff3a145a7
MD5 343a3878ca29edb72f0b5592af535992
SHA1 083457aca21ec8c42f8db1aade3c71ce6c461a22
SHA512 31dd9eed17a3c27e773f9a751415474ece47cf0233e2e279792b7dd7d05087bf72a786c5b336c997314977ca60aeab785b46b405a535154ed543419713289a4c
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ur:zQRQyi36YOcPbLvw2gAf+PN3vKYpfg
TLSH
T126667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9ee99e2195fff1dfc2711b4c4050e5f58b6fe66776183b0fe4d06bd8062cf098
MD5 cdfb79a39b4a54ddde948761a93298e9
SHA1 863b4ddafeb7987ca0de400c0f7c4ac1f55a7113
SHA512 e22104e601fe37481b4a08c5a419e2446e815201c735af57b40c2e71554f4880ee2508b1560b55095cda9762bef346dc2f7d40f647c8eddb4553e45ae409dea3
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ur:lQRQyi36YOcPbLvw2gAf+PN3vKYpfg
TLSH
T175667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e198febf7450485e1caa806bf36a9dfae97c95c28edda9191d6b1d947c2c9dc7
MD5 ec6ebf95301c855109378abf47eab93d
SHA1 752154d6e5af86950b6a820cd989e58d9592de3b
SHA512 5a674ec8d7c5787cd77d1b7c520c3afac986f92ec557706122d8744aaa31b7fb4073a9097c4ef68576efcd5d8c98e98aff583dca30ff30d28da577703194fc77
SSDEEP 49152:g68Qg55nhceWu7PNU3/FQKKYpWwl1+NY:athLRc/5KYpfg
TLSH
T191B55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6425431ad9dd884eae3dfd24d732ed41a1a6a2d3d4ce46f6ef7a75825368e0b5
MD5 a3cd6c22c51d708b85ea48bd0ff3fbcb
SHA1 26c028584f4c1a61839a4ea8cbff9bf6535faa64
SHA512 64a2c05c56d1805e1e979aed0cb992417bcc46612e40cda68632c95cf8f53ee9adb0738b5c3d73b5c2a35c01af5f3c495dc35f50a094a49fcdb91a6c79f42436
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99V:Vy5112gYy5azzVvt69nLKnhZMKYpfg
TLSH
T14B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0f8256f3f5162f1c6d23948735087a2e77284471755004b7e9baae00ce426bf8
MD5 677cc737a2524f5ba21a813d436537a2
SHA1 da4c7310b125eab5e347c431dd9a7b08d5a1156c
SHA512 a61b018efe4d95424cfb080a482fb10dc68092b4b1464109cf927e12440e391971dfeaabbdde67ed55cbb18541c17a2ed994a6713afe3e47d9e9ec6282437f94
SSDEEP 49152:8B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnQKKYpWwl1+NY:Wu6Jmdxd2dXKYpfg
TLSH
T11DD59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bdb64836f810ceb3c9ed5762dfe06b67a5b6ff4f12403a0fa2fd9d291f636b2c
MD5 9ca2e85cbb177bb340c83213dbb6a14d
SHA1 13151b49bf5316f25c4dfadaa5a08c0b78ecb906
SHA512 6b24970a204e44084b253e413498beae38dab858a6c79439f9ae614e659da98cacf3b68eca65a5c96259d7194f0f5e24f50090acb0948aaeaa14517be16cdb9d
SSDEEP 49152:G1hpsNoJpF1A63U44CwH7R4xrQKKYpWwl1+NY:GmifPWRaKYpfg
TLSH
T15FB5AE13F2D901E8D05ED17887569232EA62BC460B34A6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 90f488e0f1de248775cc34cd2f5cd22c894a3c26e9bb96f08b5c8144290f6a18
MD5 c4b4d833b799757f9bc9feea52a470df
SHA1 f96df838bd17b8b04a002338cdf254f82307be61
SHA512 97933e46c79e49e8dcb67d36c7d15d72f60e08e78dc033d40380ee9b44f54c49e0bca89039dcd61aa696e15e8f67405f02d01d1fbca58ac06e3a2ef5a4265862
SSDEEP 49152:WSuZQIY0Be2KcRVtOnks6NMHqEQKKYpWwl1+NY:45dKii614KYpfg
TLSH
T166C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 aec53b80cae9e10ff0ae7413858e77e15931ce2c2c1f91312856e655c970fa87
MD5 c15cf88f13e6d9dac71af9e9d5344ce0
SHA1 cdb6c44dae2fda5b30cacaeb7674a509c24e60c2
SHA512 7ead791b41dbf7ef0218d4b2297a762fff3360a171ffb4025f16112a851e79669d331173ea8dd996ed6a6b157b45995186532405b515616efc4d01682b291117
SSDEEP 49152:/htSn8EApI0fig3giDn0AP5w3QKKYpWwl1+NY:uX2imph+KYpfg
TLSH
T17595BE13F2D901E8D05ED178C7568632E972BC160B38AAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 dce212b6c402ff6c2050b7cf1fb9c4ee43e9d1a451c7327a5335977ca9733f2d
MD5 7d30a77c9000a59c60e6906e7e3cdc0d
SHA1 eb0e21aeb5c46e79862d479197a326ef06b18c69
SHA512 f1f85adc7c652873235cb4b24b600f3faf6472c84fa5f51acd0d0cf4f2dbd016311303de770f8d6605af51f85a2118e19c43c0a35fbe649d07d45edd21cad410
SSDEEP 12288:iQJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:iQvoKFLgYHJWwl24C15rDY
TLSH
T1B345234B70EE81F4EF054AF5AAD66047C1349F0AB8C8465BE512757F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 115bfa6be137504b3af552913b12ecd90bbe775e17d4bc7e1b33667be8a08c76
MD5 3c3b93c68f3416cf2ca2cdf8eb6bb2c5
SHA1 6c7e6f957e447f72d24d413ba16d347a8499ff2b
SHA512 1c9b5056de2dad3eb169a191d7519dc593ae34a299648b10164b213936274d00990d3589881124c7daa0618f38718e2ce4fcff40d02d0b3045f39ffba85d5fa1
SSDEEP 12288:yxJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:yxvoKFLgYHJWwl24C15rDY
TLSH
T1EC45234B70EE81F4EF054AF5AAD56047C1349F0A78C8465BE512B56F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 18cb6b4843847d61481d3654ba1ef0c5d21c5bc2ecd61f5bf67bf5e0592f91d1
MD5 ba637807168f1a3be89781674a96af89
SHA1 e5581074fd54cbeb09cace1668b56a92572b6c82
SHA512 cadece21bd86c8e77e270b1eb03dc33585ef4a9dc91c6ebbed33f1aeebbb319c546ea1fe5056623faa2d2a83a1de80bc2daa10233bb9e787da8e6cf954ed0b41
SSDEEP 12288:PjJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:PjvoKFLgYHJWwl24C15rDY
TLSH
T1B845234B74EF81F4EF054AF9AAD66047C0349F0AB8C8465BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 770aca463d45a72bee624ef70b728e87b091e708f01c467a01bf549822ab6550
MD5 d62f8d79b5f31742d96aff7123cba761
SHA1 4a246db81c08a61d6d068ef5d5c301ab40d2ca09
SHA512 bf77de5fe7e5011c4d5faf56ba67d098c48ad588c3c5b177c29676dc37f8f06e9c8342a89c78ccdab1de18ca115d56827d7dd57d6264dab71c0bb36ad392d0c3
SSDEEP 12288:8VCJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:3voKFLgYHJWwl24C15rDY
TLSH
T12C45230732EE41E0EE16C6B9D9E65003C271BE59A5A4479FD601356F1CB3BE83B3C668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0cbd374987d3605a524a1405fd1929bfaec2c13a2338494f4a0c9d397d2b9dc3
MD5 b8d00833996fce5c692a2fb7e9c66d59
SHA1 7da1419830abd4cbd2a9737221d6cd700a9f091f
SHA512 a35542e394964ed8f17a006f643f7f15ce7ac191354dd70c937aeb36dbee292b159a51aac2a59ae5086d2a15604eec68d0997b4db6322965806fc090ccb7ff77
SSDEEP 12288:LKJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:LKvoKFLgYHJWwl24C15rDY
TLSH
T1DE45234B70EE81F4EF054AF5AAD66047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f13292323df65fdc8dd29084b3d3a8c8743472683654a0d600dd37e9c980da7e
MD5 2214babd710158ae6642faf1156178a5
SHA1 d91042e95ca76cbe6956e5201478bfefe70a4bf4
SHA512 b6a79d6235ea355a1ea675345a975b8094e7e8560867a04d64caab61295295e4910b7c94c4c2a6fdd445ff8ed7fc292d8d96b9b7ea62b2571822b145f4bd7c10
SSDEEP 12288:eNJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:eNvoKFLgYHJWwl24C15rDY
TLSH
T13045234B70EE81F4EF054AF5AAD56047C1349F0AB8C8465BE512B56F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0731fb323d189fde6436e802163b651229159f7ab39a324a38526d78f85c814b
MD5 88f99529da89603de902fe676ee2936a
SHA1 f2157ab3da5b051684a5e97ec804522fbafa467d
SHA512 31eb825f495738e5b820a7567e9b401ca90bea6901d8f01bbeffca1916eded768eeba4eed2bdd7d3454bd188ad487b55bc3860a2be297bcb1b34454f4bbf27c0
SSDEEP 12288:q5JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:q5voKFLgYHJWwl24C15rDY
TLSH
T13145234B70EE81F4EF054AF5AAD56047C1349F0AB8C8465BE512B56F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f9e67e3d5771e20656cb56d33c1b4cacee63ab11337e56c8027734fcda320f75
MD5 fe713eca00dc2c06b475fe06d6e42a6e
SHA1 987ce151f4d40380c309452c626f0b43688675c0
SHA512 da083982140ded5f8ebdc3cb0ac2c4de968ba36e7c376cc334a67de7d7bb18531aba7527cc05d492cd26abcc7e52747aac53a12a4d590a67f3add99d1cc0f6b9
SSDEEP 12288:AiZwbVzzFEoS2cPvyRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:DZMRzFVSORvoKFLgYHJWwl24C15rDY
TLSH
T18F65029573A408F4ED67823ECD558806D2B27C1A0BA0C61F53A4366B1F737E11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ee8a4708a5d78a77b1fe0374a17c5cd755ee8f4faad5ffede33900d0f987b093
MD5 5da3fc9949f4c964598e2d41c98e1f8f
SHA1 f68cdd9773d41e8b8db4b2cce2fb032c2eab0e1f
SHA512 204bd07256cc1b131ed01b38819c1b3d65e234c2b912b3765600e40aa83d939d09825853d5e471c6f4c6b34abb32f2e5f22a898427018b917136c95d6493bf4e
SSDEEP 12288:lUJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:lUvoKFLgYHJWwl24C15rDY
TLSH
T10745234B70EE81F4EF054AF9AAD66047C1349F0E78C8469BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a8aa8859e8e9f32a503fb252e9218891125234697b309b6b092a85eeaafd4fe2
MD5 7bb5da035983c98934948d25a9d20c7e
SHA1 04db133717219fb8855b7588fe6102e0cdfd652b
SHA512 688951a7db44f6ad9715daf938ba9f3da88433e91f93620dedad309b749836eac982f8bec5e0478b137d0b17ad748cd88c6ea47572a0cc91970808a3c473a4cc
SSDEEP 12288:voJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:vovoKFLgYHJWwl24C15rDY
TLSH
T1F945234B70EE81F4EF054AF5AAD56047C1349F0EB8C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e101361e21686afcc184283dfbec7835255294d2cc59c19537383c3e2ae83d53
MD5 6ad0cab8e9ca5c9755fb373dbd33dc8e
SHA1 0b377cc8c1ed724b71f38a2dea9d445d5aa1e4bd
SHA512 c1285ad8f8ddcaee5a1b578d083f40125bd3317d9121e5507385c5011fb3fe38c3b4c58c9647fb6301c996db53f3161d4ad4d622ee522fd67b6c56a5eb7b3e08
SSDEEP 12288:qyPz5L8lJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:3zylvoKFLgYHJWwl24C15rDY
TLSH
T13155020773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E06F3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1c6a1400053690f932525cbf5795a48ca4b0906e4e070c6167770d174fecb131
MD5 6990e5912867f8c5c63b1bb6bdb32d65
SHA1 9a4cd119457c5a7d87aae1b1703feae232dd4140
SHA512 c7c6e60e5980e38e8ddc0aa7447b509652f981d893c461be591770b002be53b02215c43eeb88ada3c06a2de093a9b10aac746594e9ac878774d1a0d52e9ead60
SSDEEP 12288:qUJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:qUvoKFLgYHJWwl24C15rDY
TLSH
T1DA45234B70EE81F4EF054AF9AAD66047C1349F0E78C8469BE512756F28B3EE8271D198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4e2abb93269283576e18a5c99c91daca8c70309c3e6d6dbc3aa0afd6731737cb
MD5 a913370a7941ca2f68f9ee66f5099592
SHA1 84d7ed5da9839d770466ea9a061b92e7d791d414
SHA512 a551e8310ffaa34e376c7f4879547f03e667fb4ff9c038adc94a668d478ef2add39a3d8d2ef78f70ab51fb710f233e56203b08d3209f8aa1887e4ed2fe1c309c
SSDEEP 12288:eUJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:eUvoKFLgYHJWwl24C15rDY
TLSH
T11745234B70EE81F4EF054AF9AAD56047C0349F0E78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9262ebec47f0d84023bd02ef3eb332c524ff170359788737f732c8163f7a660d
MD5 310ed459e1ddf4c6c6101ac5b228e3b3
SHA1 ce8273de93bb497501eadd03ce6f87f854523ed8
SHA512 df79ff576c12a47ae326ea47f1f7b54ab1e61d388f200704ad9a8ab732e42a1a08bba43c18bc560717bb218d0bb3155bc7e857ec7cded4af6e10d83723327ede
SSDEEP 12288:GyPz5L8lJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:7zylvoKFLgYHJWwl24C15rDY
TLSH
T1EB55020773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E06F3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9d650301a1e280de68a96520a80de6bbb0352d7962c05ca61b989f285bf6d2d9
MD5 4efad927a37801b0520fe21838aa7e43
SHA1 7f75199c6e63918b67b25fad0463bbb7b835047b
SHA512 7e6b159997fba21f06e6824d6c4fa7a9d3efa79d8e972abdab8969f78bf218f38534e6178d3d624ab579c01e6a30338c9e317ccca1d5114a8c2756e1545745ea
SSDEEP 24576:OTDaLl3z0zDTvoKFLgYHJWwl24C15rDY:OTuLlj+QKKYpWwl1+NY
TLSH
T115650295B3A008F8ED67867ECD558806C2B27C1A07A0C65F53A4366B1F337E11D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 473a024770e3b6cc89dec6e260b68bed865246f5fa0902538151364e8267c4bd
MD5 449d2e5f070d91b56d32780df3970061
SHA1 24d6594b73d9caea6b63595e17bb6f939e2d3d0e
SHA512 d3a43c3737ae84d1027ac845a0d80ad43b26100ff374abe4fff207e5c174fa8e0abb30191902ebcd6490a802f694af7296bc9ba1c85e21a6cd7f919f6acdf327
SSDEEP 24576:83vd9CHKy7GZvvoKFLgYHJWwl24C15rDY:mvd9CHKyadQKKYpWwl1+NY
TLSH
T15A75CF91F3E810E4F1B79A35CD765512CA767C5A1B60CA8F03A4265A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d2924d5a5b60f642fc6a112acff24976b5d472c9c34b8f58e91ec6b28d361757
MD5 30d266d07c1f98b89cccca07b6a1bfad
SHA1 cc179802d3192b3c5ebc90262daed73022ed5fc1
SHA512 63e15307df3f21ac2b9df7999e5f1835a5954cb9b7ae6865697f0d37156c3789244e9bb20c31b5ceeda2a7a8ce9600938e89fd0ed48d035e52962b8807c46394
SSDEEP 12288:BDJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:BDvoKFLgYHJWwl24C15rDY
TLSH
T18C45234B74EF81F4EF054AF5AAD66047C0349F0AB8C8465BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 53cbc94fa97969be339737e3b84f45b93955a9c4005ab7ddeb0708103e767b3f
MD5 418746e5346f77975a72657b609447c9
SHA1 c945ded9a30e0d36fdb7c2a7d934cf4be8426eec
SHA512 9220e3bc3b9cd9c17d95b5bbebd45df00d88af610b9e6c26859bc681c8a2a3b1f1f5f935d68004576871a36ad5780d8d27f56042f33cdbf3a189aaee2f301b1b
SSDEEP 12288:bFJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:bFvoKFLgYHJWwl24C15rDY
TLSH
T1F745234B70EE81F4EF094AF9AAD65043C1349F0AB8C8465BE512757F28B7EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2946f1ce099b9431223b036e5e5ee486fe98cb401a0427acc0661aff4b9fac66
MD5 151175ebdf591933afd4ad8e85cfe31f
SHA1 a78141a604a12e1550922b7edd2d16bb93bd4fff
SHA512 848530246b3404470202d8df7432d45194b9930a052f343a0df0a04b80c23df082f2a441389c42c64e6f41ceef88a7c14fd6fcd46061ec309d10d3e67265cfa0
SSDEEP 12288:NmJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:NmvoKFLgYHJWwl24C15rDY
TLSH
T10C45234B70EE81F4EF054AF9AAD65047C0349F0A78C4469BE512756F28B7EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a4791e2cf6548c914d8b0c1333e343b59cbfb9baa09142bc841e0ad408821d68
MD5 61438c04ffa04e49bd91bc80f1bbf084
SHA1 593134658244d9eaa4cafc89e23fdab83d86f3cd
SHA512 3d0aa2d453d0a425827b4d1f9267e16ac0056b167f5f6b98e7e918adc0603aca253f3753a858b43cb0ee1e8f098d275299039f619cbfa341c559ef5e199d07aa
SSDEEP 12288:nUJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:nUvoKFLgYHJWwl24C15rDY
TLSH
T11D45234B70EE81F4EF054AF9AAD56047C1349F0E78C8469BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0e1afa04c1dca53b9c976062a3257e6f42f9cf658c80f41e0e9e52e4b5c2a96e
MD5 22df5efda21286601c9a6e3dc2a6ff83
SHA1 2c209bf135ec509e188a1e6fb60c66953c341ff3
SHA512 0388d0da58fb05b3549908ce867d61023dfc568bcc9d48613979fff7436b071f74f572c3f2714e1becdef11c8e51a87abd223f702ff9958ba23a7603f4822657
SSDEEP 12288:GDJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:GDvoKFLgYHJWwl24C15rDY
TLSH
T12B45234B70EF81F4EF054AF9AAD66047C1349F0AB8C8465BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a163113366f98c6bc0bb52e3d8b7e2cc8faea94af92daf2c3090aa42bafb8517
MD5 059b616cbab3961b7adca57285887ebb
SHA1 1d59d81e47d092e992b9b91499457375320633ea
SHA512 38fc54aac05225f8d20e305c93fbb943c2fae978ca9d1a7814f0527060db802ce0fb08018ed81c22071b6d7a2190dd138d0b2b7811d16851f2a4185616f67a75
SSDEEP 12288:1bsfEJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:QEvoKFLgYHJWwl24C15rDY
TLSH
T1F155F10AE29802E8D56E5279CB965542F3337C2597E0C3CB92C0F53E1F76AD46EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b3cd7bf4543273de25a1f18074eb1473a7535875c79d7d89a56646e1a504eb6b
MD5 1e9e26f0b6a762ac75c33a9325343d09
SHA1 453e8c673edf2089a5242cd672286bbe30a75b61
SHA512 8911cd34e42798bc26a875dadfbcee522fc80853e42a67f62c802bad63ea887bc0dcc4492212345caad5f48e77207933dae1946124d48198202eb4277cddac28
SSDEEP 12288:TJJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:TJvoKFLgYHJWwl24C15rDY
TLSH
T12C45230B72ED80E0FF3A5EB469A690178135AF196DC4869BF401727F2872EE42F2D11D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 71c2487ce3258ce51a0bf74fd53a0234b9d5a8ebea9dfe23cdd8a010014f39bd
MD5 a5c9609491d2de4f0724679bd62f16ff
SHA1 2247d691262471f53a7eb640c9ecbe55648db59e
SHA512 b5ec96f9553fb12b501db129d11f90dee7b1e161181197eddc006a0fdab178c8a074b3807a304ec56b3ebca7fd18a5ff21b647fba544568b9934b780c80d1479
SSDEEP 49152:ya0h2GEkuAe73q3pp46zwwQTQKKYpWwl1+NY:ya0hNYG4JwgKYpfg
TLSH
T1D085AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 72c8081fae1ce37c74454cb70bc37fafcf20068f5369e0b7ff112d89aabe6256
MD5 b9a5ab72c320954d9377c7b826c562fc
SHA1 5397a1f8e053bb5d3778e84bb7c5462bf179e3ea
SHA512 c82bf7f2f965b7da7943a4d6321fee31ea64cee025a587a3052ceffe3b8bdcab7a14ae75d054b148f4523096ebc7cfeb7a9c880745871a72ad3354da9b92e310
SSDEEP 12288:khbHjfXIJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:khbHjPIvoKFLgYHJWwl24C15rDY
TLSH
T1F855126E22ED10E4FA71A2BD95968407C331BD25171083EF6291927F1F37EE81E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7b8e2cb26274bb79d71b5d63503d334aac1db201c59ba7bee7020c2a1fae748e
MD5 52ac61e94e4a11146d683ba90d3c75ab
SHA1 a728ad5f9c4df6ea9638b79abea16daf3579a459
SHA512 ab4ce1b446a63503ed74187a88d53cf5daab4aae6b17a8635e8f74262dc05fb37ba115787aefaeb098fbc562c23cb61d17cf21d9ef2fe002e733c8d9a743e366
SSDEEP 24576:W3YgnJcRTk4yti+R5dpR/gvoKFLgYHJWwl24C15rDY:WIgnaTk46ppR/gQKKYpWwl1+NY
TLSH
T12145BF2EF2B910B9D8A6D136450147B5EB71782D1F209ACB0170C538AF1AEE85F39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 1c235091c50b0eb696f349d8be23b08ed0863338e09e4b295e3bc945423fcc7e
MD5 94de3e26f0fe67cf82e3320f05c219f4
SHA1 c07e97f94d3b7b465febc8bb79629ff890de46c5
SHA512 00710dee7e53ccf4ec936bf61413d2543c705d31841792f559f8311a4d1c9387adb53325453990fb0dccf5d4e75463e1fd10ba8ac19a12e735dbe5996f1d1282
SSDEEP 12288:mFJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:mFvoKFLgYHJWwl24C15rDY
TLSH
T1AF45234B71EE81F4EF154AF9AAD6500780209F096BD807E7E412B57F28B3EE9273D158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 44745912ebd272b377bee897bbc1658888cc3d88f4a326be363a4d85a9f696f1
MD5 ff4036c684a8b511a527d82619a45a76
SHA1 f940e135430310c1b0d22d4f8903354e5ff6e387
SHA512 2dea7303b3ea9367c90b8c5618011cbf7d61261e1f09e3cce5f0f4295bfae1e9720849e943d60f5bc9cc8ba583b93a04315d199922cf60e7310b7f322f8b0117
SSDEEP 12288:gObfA4LWOsvAYFTqJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:dbL3UTqvoKFLgYHJWwl24C15rDY
TLSH
T1B275F115F7A900F8ED6B823CC9A28517D272B85D0764E7DF43A84A6A1E637E14F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 47acaf3ddbe958177b084ea5fef8913b4f307855f9ab0264c4ce0709b08a424a
MD5 b7f4b91b8916ee77e554fb64c763dba8
SHA1 04a0eddfe211dbb1b38d305473f4469fe9607aec
SHA512 88fa5ae1d63382ad9a74dec7d080c87b2827d10b00630eb886c89b07afaae197233f91bb9fc7bb86a5ce871383eb3496c5fa9e54a81cb001797999543880ae95
SSDEEP 12288:1pFtIOmJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:kOmvoKFLgYHJWwl24C15rDY
TLSH
T14355021E32ED10E4E636A17D8A92420AC371BC66175147EF429091BF1FA3FF86D3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f13c6b81250faf6bdbb378ba1f9aa6778e3896edbe767c6f26016d968fe8f6da
MD5 e1963fa0d0ed41f089fe3aee2f4be7ba
SHA1 b4dce4b4169465ff4060ffa78ab3e9a2d3e47bd4
SHA512 047343f2c4a767b0a49dd20fa7fbf3816ee5edc305d9101a80c700219f4d3e4f5184e1e401c1371f6805b8ea6b35f3c42609a4e8a38041de186db9803f7854a1
SSDEEP 24576:g7NM9YmZqmWMUkPjZM48Mv6bEhs5voKFLgYHJWwl24C15rDY:g7cBWMpPjN8DbEhoQKKYpWwl1+NY
TLSH
T19D659E2E6BEC81E5D577D13DC9E28206F2B1B8611B318ACB5152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 bf1d015c7dc29524731a28e39dab585d776df19f78fd641a53741e4ed52f8a14
MD5 0a377703038709b04976cf74e55f8294
SHA1 8f238dd400da35e2b235107b548c520a4ea19457
SHA512 e981480a663f5ef3991a2cbe0368e1bdeeb9cd1fddca9bfcb6d480e7398265609493a03bad4692383e4273fc13aaa36468ab0107df0ac475376941a4e3731dd1
SSDEEP 49152:LF2YuHNETovcvNYf8kmZQKKYpWwl1+NY:q6tCf8kuKYpfg
TLSH
T14D858E2A27ED80A4E0BBD27D45B7D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 131ebcef9728f3a2a0946c380c8444099d0de443af9a7d91731eff50c84a3c53
MD5 64ca2d06b05d2a203961b390d0d173c7
SHA1 605243ca4fb4760304b91a625ce0ab0687b32ead
SHA512 9be0164e877dde0275894ec4e8e09ddbe649a6c5e5ef3b03358d626bab511452ad06f0c8f5dcf39551fb60102b19a95132ccbda76332965137f976785bc39a1d
SSDEEP 24576:EAFs06+OmlfkNXEbToSvoKFLgYHJWwl24C15rDY:JFs060lwXuzQKKYpWwl1+NY
TLSH
T17065BF2F62EC00D5D47ED17D8A97C91AF2B1786707255ACB0160863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8e3bd02b6fc695082bc89b8d372da0b70ba3c48f55b5fe1fd5885c85a5be423d
MD5 d9aca0e769ecc1a073ac665824e14352
SHA1 a1886eda6d709586bc3c6d19c93d685b615250fd
SHA512 43e79baabf82a7c42b85dc7bf8d461b53954a53931c581e6b328ef70f089a7979c8949a60fa206974568c369bc4a28d5362279c6e1a291e4e8ebac3dec19c763
SSDEEP 12288:6CJnJ5D3VkrlzxZJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:7JnJ5D3WtzvoKFLgYHJWwl24C15rDY
TLSH
T14A75D02DD2A810F4D4B7C2B4819A1656FE72383D2F226AC76474D5353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 df859de46d2297f694c2a7a6969dd6179ce9d1dc9ad187c82ef41a9139382e9a
MD5 0ddd01a9294749630978159e31c01fb9
SHA1 069ff0b5eefcc7571daa11868ddbc59e65c6e501
SHA512 23e0a2007d48ee281f911fe003a138229fecb2ec6f1d04c4d39c8a4133b7bca1f4c5b90c53a1d89e0dd1af41310fd7fe39a6d0c2c0f8c298f81f7e19a318f461
SSDEEP 49152:0o06DIKdwc+eQnSt65aVNQKKYpWwl1+NY:p3KYpfg
TLSH
T10E956C16B7EA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 00168793b59fb03898783dc82307c5c6ec566b7184462c2f3843a7fc6a7ff7a3
MD5 143fbb04287fa3bfa008a6ddd4870bd5
SHA1 055f8956a8e55383e6db14f63c8c1ca60612b05c
SHA512 885dc6530fcab9221ca3fd286cb48e6032c72f83f9adfd82aa77a8a6b44de2a34cc004d8d3e47aa0e8308e6e2c3d2649d4de2e3157761950015715f85df8daae
SSDEEP 12288:qEP3RraJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:JravoKFLgYHJWwl24C15rDY
TLSH
T14555125E37AD60E4DA2A917D95918106C372F8352B9117EF9191E23F0E73EE92E3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 0a76ddc135b9b64bbdb9ecf606b212cb04398ca815af4ee5fb47ee4f06634d3b
MD5 18d09cd22d7b038d3fb36081f83779d7
SHA1 01e0f5703a030df90f1bd88bdaaac0058363010f
SHA512 f01b3c4dc8449259111daf9f576bfc4886007a7fe4dc589ea76cae8c0082379c30dae235b9a094c79e060558164eee28bd13ac41c105764198d16f138a25da5b
SSDEEP 12288:HjkyYJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:HIyYvoKFLgYHJWwl24C15rDY
TLSH
T14955120A73D890E4EA754678DAA340958635BC206F5443DFA090F63F2E73FE46E39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 0646fe6fbab411e401db3ad190081e51e580f1bac46d4f0db933d19e1b8e778c
MD5 9956e6c0db4c1f3b168b8eb3c818c827
SHA1 07e2e13e66bffaa019288b1f9b3c6cd408d5c74a
SHA512 89ca98361b5776f3da86bbb977883df9022d4a0c10e372f1c32054ec26f637c00fe11e85f9b2b5dc6a8c520c1256a6127faa8b6b7560f7758a4f365e38f97d41
SSDEEP 12288:0F2JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:y2voKFLgYHJWwl24C15rDY
TLSH
T11045230F31AE80F4EF154AB99AA654438130BE292B8406FFE451F57F19B3EE42739958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e34e70fc92a2569ddb37eb7a2f01d9a214992003bbe58efd92192d0fdece1bee
MD5 d79d05ca4de2247e18b54721da91181d
SHA1 4ef4b85253044dfee06de6592dd686c1c8c49a75
SHA512 bc7770f4d56ec0f0e4d0ba081018d65ce63d9d3d89546dcc774eda7b231b3f1ce805f9966d6da6bc2e988a8a1d0022d82c546295e4e2fbdc64cc24419cc6395a
SSDEEP 24576:RQ9MxZKdcz97w3BvoKFLgYHJWwl24C15rDY:RVKXBQKKYpWwl1+NY
TLSH
T150558C2DABE90599E177D27995A250C3A633B4311B31C6CF2448D03D4D7BEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 d695d01b0cf5e3b656defd6ba2adb02d8aa6d7a157db5806bf0e74e25aec99f9
MD5 39f2a94dac2708d82f672e01b3ea54a4
SHA1 66ae998d407d7e3ada7378b621dccb1fe9629a68
SHA512 a73f1a57727bb7553be089f0b9293ebb5cd406b5e14b4afb1954642d9502b22bba2f914eb403210320dd5b75a404b01715907ecd7a96151e1a78d0397ea6c977
SSDEEP 12288:iyoKo2HRple9pkJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:iyocxApkvoKFLgYHJWwl24C15rDY
TLSH
T19E65E01FB7AE40E1E176813C89858245E773B4305B6253DBA591C33E4E63AECBE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2dbd70949c6711eec127aaccc02348f3da35d5712ff0976e32df0a09d35c7f23
MD5 6c88da21646598cd3e718071cdd1d5d6
SHA1 b0211ddaac6caa3cb284b2f6b7389ecdc724870a
SHA512 bd0a1c0183d23de8741543d5b03f68979d64233f9fb9488c060ac237508168b8643fed17719fc29b70e3b3c48b3d64ca03c9383068cdaf8a866e40d921931795
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKkQKKYpWwl1+NY:V0zuNI0KYpfg
TLSH
T1C9A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/540-229-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/540-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/540-41-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1252-408-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1252-508-0x000000000D2C0000-0x000000000D2C8000-memory.dmp

Download

memory/1252-488-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/1252-414-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1252-669-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1252-472-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/1252-456-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/1252-511-0x000000000D770000-0x000000000D778000-memory.dmp

Download

memory/1252-510-0x000000000D770000-0x000000000D778000-memory.dmp

Download

memory/1252-504-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1592-230-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1592-75-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1592-69-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1592-78-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1824-38-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1824-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1824-29-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1824-225-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1832-492-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1832-323-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1832-329-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1868-403-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1868-503-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1868-397-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2084-289-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2084-659-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2152-350-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2152-496-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2284-658-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2284-279-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2284-285-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2284-278-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2800-77-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2800-16-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2800-24-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2800-25-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2840-12-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2840-0-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2840-14-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/2840-9-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2840-8-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/3284-660-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3284-298-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3284-292-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3284-490-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3420-367-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3420-497-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3420-373-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3468-498-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3468-308-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3468-494-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3468-302-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4036-383-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4036-499-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4272-334-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4272-493-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4272-340-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4488-66-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4488-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4488-64-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4488-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4488-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4496-245-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4496-237-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4496-560-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4496-243-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4600-263-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4600-248-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4600-261-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4600-249-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4600-255-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4812-360-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4812-354-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4812-362-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4812-365-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4940-270-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4940-657-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4940-260-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4940-264-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5064-387-0x0000000000AC0000-0x0000000000B20000-memory.dmp

Download

memory/5064-501-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5064-393-0x0000000000AC0000-0x0000000000B20000-memory.dmp

Download

memory/5096-319-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/5096-313-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/5096-491-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5520-514-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-518-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-525-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-527-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-526-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-524-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-523-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-522-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-521-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-520-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-519-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-515-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-516-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-517-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-512-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download

memory/5520-513-0x000001EA4ECB0000-0x000001EA4ECC0000-memory.dmp

Download