8b676bc308ab1052f7ddd7ddf32aba3db5b2eafdae15f7a25117a193478490e5

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Size 1.7MB
Sample261024-e9588afx8y
SHA256 8b676bc308ab1052f7ddd7ddf32aba3db5b2eafdae15f7a25117a193478490e5
MD5 91fb0ee97b771f6a894a879be8de65c1
SHA1 e9f87c1e77c7015dcda2a7d8b425a68c7068fc2a
SHA512 e78287377cfb69e18a8fa056e378dc3d3a417c88ee2fdbbc63e008b30ba98f902129f591f8cfe6adc8c5c3dccc53601fbf749d3a6a9ad6e2f9b0c2528f9f9505
SSDEEP 24576:NMA7qy/ccqNgPgGnQ/tbw/2Mkjy6Fr7g0oh:NMALpqNotQ/lFTjN4
TLSH
T1A185CF59AB5840E1E1B6C23888539942E7727C115B71EBDF1398E23A2F377D19E3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 21 IoCs

pid	Process
4392	alg.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4336	elevation_service.exe
3800	elevation_service.exe
1036	maintenanceservice.exe
3880	OSE.EXE
2268	msdtc.exe
832	PerceptionSimulationService.exe
3976	perfhost.exe
3704	locator.exe
2296	SensorDataService.exe
212	snmptrap.exe
1232	spectrum.exe
1180	ssh-agent.exe
1200	TieringEngineService.exe
4524	AgentService.exe
4400	vds.exe
4688	vssvc.exe
3716	wbengine.exe
4752	WmiApSrv.exe
3564	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7694cd64250d612b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\javaw.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adb5f3e47163dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6f1b0e47163dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000143b3be57163dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeb5b5e47163dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009351f1e47163dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c6b2ee67163dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7aaade57163dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008947cae57163dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d8f54e67163dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe\""	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4860	DiagnosticsHub.StandardCollector.Service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1468	2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4860	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4336	elevation_service.exe
Token: SeRestorePrivilege	1200	TieringEngineService.exe
Token: SeManageVolumePrivilege	1200	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4524	AgentService.exe
Token: SeBackupPrivilege	4688	vssvc.exe
Token: SeRestorePrivilege	4688	vssvc.exe
Token: SeAuditPrivilege	4688	vssvc.exe
Token: SeBackupPrivilege	3716	wbengine.exe
Token: SeRestorePrivilege	3716	wbengine.exe
Token: SeSecurityPrivilege	3716	wbengine.exe
Token: 33	3564	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3564	SearchIndexer.exe
Token: SeDebugPrivilege	4336	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2708	3564	SearchIndexer.exe	117
PID 3564 wrote to memory of 2400	3564	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_91fb0ee97b771f6a894a879be8de65c1_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1036

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3880

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2268

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3976

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3704

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2296

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:212

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1232

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4752

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2708
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fb90fef32c02370cd32a366128be4f1afe8b760810e67003f2c179bf83253382
MD5 eef2fd4c4d3b58057fb21bf414374651
SHA1 6d72bb800f4daf0fa50836b2e6ad527afd3f368d
SHA512 8d398d996dd8e1c979da484312c337fe18f4f5e2ebc266ca444642fa00744e7ac7726256a13c808b26e046fe5c2722b217fb3164a5da630e836bb3445602a5b8
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuQ/lFTjN4:k3q6HjBCLm
TLSH
T1DED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ff38b603623ca9cc2c97c03ff8d12bd79532942c3a44587cf5a953b156c44665
MD5 3241be6d6a97cb7bb9285af03e951779
SHA1 afd3ab881861021f77731d6a4b42a06ab3d53986
SHA512 25b4231f050aeff4f4384d2c1ced200b9321751456a6d211088bc7e0e5da0e3e961e5d09938feb100b9bd9abad577da3e81a7f270278088b9a4e4cd20ad04ee8
SSDEEP 12288:m1XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:EXYfDtczABnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1D765F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9f5ac92d203fc29bddcf51178d418e8d47639b584a4908f452482085a3c5a04f
MD5 9e936760a6c49d9ba266d605af802225
SHA1 23289cc1d35b40fd154d586c152ed5ae85aa8aef
SHA512 f7908039d3071f48fd03710f4373c19169a52db22251b2ce05723af800f983aac32ca465add55f9b2cc81a7a392c356df05c2db0f2e8b87bc71a30ce7e1c7d2b
SSDEEP 24576:d0Le5ji0hmxLrMmnQ/tbw/2Mkjy6Fr7g0oS:dPji0AlTQ/lFTjN4
TLSH
T168859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f8694ce69e8d59de1cd19e9a95b08f2d3acff4be547bcb73bf683df01e0b9275
MD5 6b3f8510689417deff162fe62f7cc82f
SHA1 90c4c0071e12f34aeb5309cd518091e8395264e6
SHA512 712dd46119ca192495fdcdb08b24ad83962ca512cb2d6f4893c957965ef1bdbcc6ab58d7941c1d9ee645b7a3a6d77a0a08e07297dbc2a7afbfdb54746289aaa0
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyucnQ/tbw/2Mkjy6Fr7g0ov:1/ezSC6vUzPvxHjynQ/lFTjN4
TLSH
T184755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 66b70abdbccf7228f6a6b7256db3cae5224d75d949c9a3c94ee6b3049b6f206c
MD5 68e23b5d859e9cf60952d12079656492
SHA1 391cbb28c72f2b87870e5388530e6fb3b7959d78
SHA512 d266202ef7d2096deb3706967380161d92b24ee326e615a9292c8310fbf74385a4c20ee19321e18355dc23c875a3233b5fc7810efa654f282a12d1129b2d2426
SSDEEP 24576:cVbqPb88hv/l+69nQ/tbw/2Mkjy6Fr7g0ol:cVO88hXl+aQ/lFTjN4
TLSH
T17F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6af18fdc1daf5f82ab83653552d03381785ae9f939d135fcb535d98cbf3f7a70
MD5 31e5bc54aca72331c8fcb0be6a4145c5
SHA1 170a4725529fe8b7b662d88e0fe1ad0f22cea960
SHA512 03d5f5a6a80bc7e3a44b18439cb6eb3295de50d98c2afd5fc76ff2452c7c5f57f056f7306c4b68cc2b1c1941b05dcf340ccb9f5c97f2f29f08aec5a6873f77ad
SSDEEP 12288:wzCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:wzCnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T10C5523796A24F897FF2B06B55CC284826B3B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 00e36fa631b3c609fbf20067cb1d54aff93b9ca7da4929fa311cc7da8fc8b143
MD5 0e71b8e7e5147e8465621073799f04a6
SHA1 168f566b80802695acfe62fd96fa6e0a8588824c
SHA512 8297ce98d572610633db4140b5f6743ff516a41e8b70c2d571a73ad83d096f7898c36611652a673e376b46854c51ce93d9ae4c04cb36b9d81119490fe05277c0
SSDEEP 12288:xeBNUbTVO86UVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:xJIU1nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T11B75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 02d615b57c56b1c4c091ac54314ae04ac57c08ff8b04006853732d522655fef2
MD5 ca13fcf92208c66a319bc92995b4ed2d
SHA1 76fa1af840ab63bd1487ce57d5a92edcb94f5922
SHA512 059ff81aeb530894f6eee03f1aaf1382126d32fc68687fd0503ba78e63c161523edef29287128de531078803293156018808b5270a728d64c8e459ed7403a49a
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THt:IQvGAdlCEL8c/yRNw5CvLm
TLSH
T127267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 78369e564411e8a10923d741978420c4e157e32a5602b227b8df99323a371435
MD5 ca8d510b314bbb90507371cb050ea809
SHA1 72b9fe7d2d62b1bcfb55cc1027c5cf077f369439
SHA512 f0b1117568f4d9659ea019714541cba2ae94df408fd9a898c0c561e6d525007e14f3162d77d9a41517ca53c5951aa47dc4273ed7c056b0238879dad5601a18c5
SSDEEP 12288:YAwSfxL/2Dc39DLLmt0LDQewsAjTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg6:9QewsAjDnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T15C75E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9e0302946696b59f57e8f1725b9b7166ea803d969aedac6e126a6398af1c196c
MD5 6f2b205e3995b0a5c3bde36b9148544b
SHA1 8b5bd3fae78718ddb05da4dc9048270e661b2d3e
SHA512 82bd7c3946bbc43eb81f4939a4e49deec55b7c7df5d932be0e0580db35d9d88b933ee9e63a7978e91b745933f71fdaac934f5ebada7ebcea23c23934db607fb7
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHAL:sUEtQevvqc2W1cpV2EI32
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 247d7ee94dda6ed550f32ada9d695b2548bf6dd69decdf2e9a33fb245c8aa9f1
MD5 6d004e8b49d30f13c527e296adfbbc90
SHA1 1b407acd4c6ff6d4fc2bbfc49cacbe48b098474c
SHA512 9df7d3ac6d00b50e3628959237464bcde52a949e8f271971c6f78026640bff4084c4cc6a955a38c7e582fa71daf80bb07f09dfe6909434f4ba03c2b783fef676
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zjQ/lFTjN4:roqtVjnmTLm
TLSH
T12BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 94a1a05c7b943aaa7301993866697fa2b826e438281b90851c3d0fec54423869
MD5 17372a09d131c2a5b58b921feb43b2dd
SHA1 8403eca218ad94facb28d81efb73933d0ea02b54
SHA512 5bd2ba1fc59581671255a9b37246f3e9832ce2db524584cf213a00d7499656c5d67b5a262f40fa7d38bfe93fce2fb90fe4c301c954b243216753297468a00a2a
SSDEEP 24576:fAhGLJIFoiwtA5l7S53gnQ/tbw/2Mkjy6Fr7g0ov:fAMyFoiq5wQ/lFTjN4
TLSH
T1BD35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1da1087a5c1ffc19683cb975a44f97f5ab49423fcff7ae73b177cd3152270290
MD5 9cb0c0a1522f9d6ce07ab061c8a4f615
SHA1 09f19a7f1811d4e2df1a41866571fe122813480a
SHA512 a33028a186b852863baa1a72117cebf530a5741492eb4b713a99f6cea81a8116a33cbca6991683fa65a0d7b3e780fc4f70de10c8df94c0aaecb294edf06ac07f
SSDEEP 12288:Vmw5HEjsChN2BFgl0WDm+C8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMm:QwuHOWHnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1FC65F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 74fe19926f557c77f107774e01b344e516a09a7d34b3e5b5d64458e678a62df3
MD5 a2921de4d89af69fe3d17dfdd312d54e
SHA1 8c63ff475f0994c2f485c41a9bb6a2fb25e0e45c
SHA512 d57a3095fdab8dbd03f0cd7fe05b5f8bf84b0a793c2632efd46bc336fce78aed245d119ffb1e2c2a9c92762bc1949b511d99880c24c17bd4e1521aa3b14345af
SSDEEP 12288:OXZ1IyDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:eZuenQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1DA55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 039ef67e3514090c1465aa68469839eadf70c334556579a17de958ab672b49f5
MD5 1631361362d0adfc7917e135ee56e6fb
SHA1 bf1280511b6f0fbfb999f44d69438ad0c83c6409
SHA512 c9fc529d9141f53a00764ecf20ddb4dcd8a838d09e78697a2d7ea7e234a34646601586dc2acc76513ab8c9adaa204cdd947e2ec5c6cc154b397049778a72acc3
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:aQRQyi36YOcPQLvw2gAf+PN3uLm
TLSH
T1B2666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 05fcdb15412e054da47457837cb1103957a7a3de1d33938bbb2774968a873d3a
MD5 14fc07fabed3a541efd0a906eece3fad
SHA1 d02e8bfd8c2c32e2cdc54b06019416aaecaabaa6
SHA512 8ae737ca92577b686588edfa939d42e53498698a6f4ae0521b94516156e96e28477e4033e9eae3cac822f7768b7283c4e8d96dd63c0657ac914dc96a8c76e102
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:6QRQyi36YOcPQLvw2gAf+PN3uLm
TLSH
T1FF666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4efa7153a74fe2a7de721ba4a3d94548a8494454755e356058ac461dde6d534f
MD5 f59a71c8fa8ad7766aec70389e2314ab
SHA1 54ea7b1826f347d990baaa1a19724c906dc74298
SHA512 e52d8f77805da708d956f7ca9aad5cbd03760b7555b9e8f2e02eb04613e4b32deebb6de7438c3204b15ed4b802f021373a2f21af02da6705923a8228be0b7956
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0unQ/tbw/2Mkjy61:D68Qg55nhheWu7PNU3/TQ/lFTjN4
TLSH
T11EB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fff1a426865f0150952276f3f3f26a057d1026a89ab4b625e231698e2c75fa79
MD5 2e764322c5acc9f46dc4016d3239a8ba
SHA1 ef348b07f607c6db9c32a4d5904d7de67b367adc
SHA512 a2ebf27595dfb0af191bb3092fcb0f5bb573811d9b733358ee7ae3a68e1193617979f15efd916a2541fe722b535b9e96b2eb2c665644eee05b043acd785121c7
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:ly5112gYy5azzVvL69nLKnhZNLm
TLSH
T13E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 969372272f93f73d0b8be5d70d43ed21ef5eb717695ace626f79f1cdf75ac923
MD5 2c192a829c1a3eb61140d58366325c4b
SHA1 62e1ad321771e5eae3646021f44fd0a8d29fc64a
SHA512 3d5cce8e878a1f30b5488d99f56a32e6d66f0c2aa9269e8fea22da51c5353bc505a93f872b10a58d9596b90d9fca0c7f514c123881aac684db8c0bbe6e55518f
SSDEEP 49152:XB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRQ/lFTjN4:5u6JmVxd2d2Lm
TLSH
T1D6D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6d05aff9b8c34f7d3fca3a2c99edc4a53c402df724a4dc14a19aaa6473b5a76d
MD5 d9df9376da9c9ab6bb9e6abeb1c3da13
SHA1 734962f1eae7161cd985ce70b46984ac05aa6025
SHA512 0d754286439f7f27569399a985af8300cec059c1e06e6dcee6d9c1315251a13b16557cc859c9f4e3b5ab0c3c9a42736a7217380b7d5fe7fd18dc3743c6cb3e50
SSDEEP 49152:B1hpsNoJpF1A6UU44CwH7R4xVQ/lFTjN4:BmifPbRTLm
TLSH
T1F1B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 73ac411a55a0e8a73a6e3fb7d718ee68a41a8ffa087de128d8ee25bd35aded0a
MD5 0a07c403e3085870ab50df831152158a
SHA1 c0faacc5a1c2b4caeb9066be84ec0ea04263b052
SHA512 dade288466c39254c19d79b5c74b506b79a9649a8a81c1129fbe3e53a75471b3a446c75bdb7c09448e8d0e07fec79852c922e9e7d8704661894f5731fb3bb6bf
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqeQ/lFTjN4:L5dKTi615Lm
TLSH
T11DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fac6471d093f3650f34c19da7452bf3cc00dc3bab17401ba0af3704ec0f49f73
MD5 9e8536f2d95f38554867853d785df370
SHA1 36bf8fb4ac550de58bb0102f6881d3edcdca9348
SHA512 97e937637610331071bdec3db93ba7dbf7f293937b922db03556aa43fe3a307fd59ae4cd468dccace23000a592d039d5a5fa6718ed56c0aa97b5bf7209c6e6f4
SSDEEP 49152:chtSn8EApI0figngiDn0AP5wBQ/lFTjN4:dX2iyphnLm
TLSH
T18495BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b1ecb6d95f7528bb813d219c73890d0538abebedb1599b6616dcf8d9fdff6c85
MD5 cec7ccbd55a972b8ad898ce9e9be42a2
SHA1 314098295618c2f6a36b3a75d6e0a5e65741b33a
SHA512 b79e6511f5a60622ebeb089670629c7366c94a9c28321c7b053585c7194f845edaf98106ee064a23b97e187500b9d080af7e2ab8076f7322dbc93ad43e7d0b22
SSDEEP 12288:VaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:VanQ/tbw/2Mkjy6Fr7g0om
TLSH
T1F75523697955F98BFB1706F18C828182A73F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 78a64a023ffbc1c83bf358216ee4f57cad4a99ca63972ab30c701a715826a5be
MD5 d7fc76f974b406bde7b1bb79e51a8f20
SHA1 322b1900658fdc2c7c6dbdff633f10f0298afece
SHA512 db1283c5a9cd8faecf347bf00b2d462321e122dc9a7189dd4d5ad0ebc530d7a7690e7a3446413979f6a05527107a9f4d531fb4172f904b9aab18a15cf167e2bd
SSDEEP 12288:vPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:vvnQ/tbw/2Mkjy6Fr7g0om
TLSH
T15A5523697965F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4084814eed4eec3af2fef75aa27c8484538906d8f665ef6211d6973106a05054
MD5 61b31035e4d3ca1944f43c802c1e2983
SHA1 3f48f33fdf8201c41a9cdb33bedc8fffba7f62ba
SHA512 5231ebee976fe6f48f42fd4df3f692ae5e926bca8dcaa346a496c95474f4d310ed587e899e59c8fc061945cb21be3a0373bba1e5af9009022d705085f629b45b
SSDEEP 12288:0tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:0NnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1D75523697925F98BFB1706F54C8381829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8682c27458882003b1b353b22ec708c6d354948bfac74a5ab10a7d2e1ca49341
MD5 e9177a957aae83c2c510aec347b9c862
SHA1 07d079a5a8957c85389514445a6f7e993790c9e8
SHA512 38c390c1014b1bbc2935b382fff79a0ebc0540e6a6f007ea96360217b323370f479ecc8e5515c0a1faad72aff4b13987d96e4bffa89e9d6ad0dfbd3f8af31fd5
SSDEEP 12288:9VgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:4nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1F35523693A69F4C7F92742B4CC938142E77B3DC5BBB1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cbda89bf66540ba80de8621bdc78b4af31c60beb89e9d6d283856a3532f53ecc
MD5 fc42284e0449569da1037764714d6f4f
SHA1 f5aa124e45ff270acfa94affcd05b7025f0ad5ea
SHA512 5bf7561cff47c49a49d71ca98d379b10d1f76aeb6580872d8dfcfbba7193ffaa90b9f90bde52af6cbe261cc0e2805b0322a67e941da9c3e8893c2e8cbc5794e9
SSDEEP 12288:qoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:qonQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1355523697965F98BFB1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9d658ca792d5ed8064f25e3d2513dee38db66e7a03196d405b64c37b7ac22143
MD5 61544866dea52380f7c90db51da751d2
SHA1 c779fad27d1c71f4afb97d3d01882fa78a7aa782
SHA512 eed3293058e4b47b267b5174b02d7a199bfd5f97bde375ae78e00bfba3b5a4d80ad5e0312317a614a95e50e17a52961e4b9f56af823e26783e9055e53706ab90
SSDEEP 12288:tLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:t7nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1C35523797964F99BFB2706F14C828182973B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 37214e125000f38c0ba859fe7c5ae520b5c83edbe5137d442ed91d041302fc56
MD5 c85515279cf8806538d1935a49387f92
SHA1 eb84d12e72b05a7d5bb023c8c72374ce0b2bc94b
SHA512 f4d5b1f7a5f2be55d16637fa9f6eb086b1f15bbbfd1f5a5d2c173694a0327e2c83e7ac6590f23da738f039cb1d786ce2d094e93647316c5b646c7fe6a797ef7f
SSDEEP 12288:q3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:qXnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1EB5523797925F98BFB2706F14C828182973B0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ae468bbe9d5038f2b3073ce4f11912a82bafe5620f4304cb29c43be2d24aa22e
MD5 9d2f7f5bc71576ed5ad7b708e8c25d25
SHA1 29083a705f39a54d5a6b8be1fab9f5e45ad87283
SHA512 6428fc35032cce9000b69fa703aee2530bb42b56012375b8060544c16abb532febacc5567cdb84e21d0539c73ce68a77a39620558d7bb74eef9c33913aa72526
SSDEEP 12288:1iZwbDzzFEoS2cPvyvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:4ZM3zFVSOPnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1697501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 da79051f9b0bfb2989a8223c6faa4a145149f716b6fda3204c19f0bacee8c545
MD5 efe522d77c0120db1acdf29b08cfd952
SHA1 a7cecc0955b156cb8c9a5114f686c599509401c2
SHA512 c39f29e1ac23147fd92ef65a12cca61b68de6ba7301d008509c1057a5f942b30330449a076f856b158c16de797b71a709a420825a603f2afac693c1a69409100
SSDEEP 12288:cOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:cOnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T16C5523697965F98BFB1706F5888281829B3F0EC6BFD1938F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1ed2b7df29cc3e5f620efb5067d37f9a4edb1da5b6071dc135e991a28469a3bc
MD5 a6067e086c4402ab73d63b7a47254038
SHA1 8ed7cb576e626fa77e96df5f5d70a53fd7d09015
SHA512 537443eb8ed65a4a7c6118317ba59a088e8beb73733629fa5f3afec035340d6ec0c5918adc6b11349c4816c5578f4f451a7489e7a54a22798dcd554b0f8e77e8
SSDEEP 12288:PyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:PynQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1E45523697964F98BFB1706F5488281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b20e18b2f60a601b7357956cef0d74549d4217c2403a4ddd95895373481c8593
MD5 99c3665412c48ece4d8624634b8472f7
SHA1 23014f0199d29fbe91992dcdecdd54ccade01191
SHA512 f0d2079e71bdb29867c349d881fc895d6da20e2627960386c2cefd43fc113e62225b60b877538d49f7e99fd24ae79f923084719d08678ab35ead5e1813adb4e1
SSDEEP 12288:xyPz5L8DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:gzyznQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1B765021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 76b4380267fcfbce710c50ab1d2272281af53cab7e42374808956c07a8021cc7
MD5 44c4844169dd52d32afb1f54a6d43c5f
SHA1 a09f9aa72a0b9487d4d1b28084cd517777ff913a
SHA512 1be1dec359b2d757e8028593a23b288d00064af530ea2720aed3c1c242a2f94c2e4376d629203b25f7a085d3ae06dfda3bdc6a0cf087ade78ce72f9f147553a9
SSDEEP 12288:JOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:JOnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1DC5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e694ca39ec0517fe97a3faeb20810ed07c9ce0cffdad72e8107a8cb20a1925fc
MD5 6e57900947497a31427d7ae7fc141292
SHA1 7f27670fc9b2ee9d9e554b33cbea2d728add879a
SHA512 8f07931228f1b0c1be6375e5d1f466991e541f685f1763cca922ac965b5ddb70d670cd9e248927cbcee983e152400e4118ecc1a1809035ae94be5afc93d1558e
SSDEEP 12288:QOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:QOnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1655523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6d2d3d4be08a9c9430812c3311062ae8b6ca59113b7863cd6058d88bf9248c6b
MD5 91f1b786326eb47a7e45d0f1117ce196
SHA1 c78891bc69fddcc3957d5ec1e5d978432e2b2ede
SHA512 d0f1082f943721237755cf2f23a992f934a5a5e63b6073784417ba4198215a310c7861c1f40395d30a726e15fd128f26a25f3874309644430589d8286fc28f5c
SSDEEP 12288:byPz5L8DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:WzyznQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1B465021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c3a424396f0f8f2df8d1448c1c585770602fd311b780684a57a15ef13f95e2b5
MD5 237e2deae17d4978bef146d123e1a926
SHA1 3e15087c47bef54c4bc87d5aafdb99633d93c893
SHA512 3ed751ba514fde5033ae3cde265ea1e1e8e37d49babfe1d33b7ac24ef85e5fdc033311485c24e6d247c17d3b18bb007d8be0acc3d71c95e49b966eb0d444c818
SSDEEP 24576:yT0aLl3z0zDdnQ/tbw/2Mkjy6Fr7g0oV:yTDLljcQ/lFTjN4
TLSH
T1837501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 7df5d13f3f853e75a72c723ea785d2336a0afa5461adaa247480e748eecc347f
MD5 c78e9c7e12ff9818da418937271a62ec
SHA1 91a98d77ead43d2cd416ab3636665a588ebda2e5
SHA512 96cd1e8cba6e685193ebe1af213ddb3564be9829de45ac9a52413af4f63b1f7d3ce1c8df76841baffc96a7bf110e2a0b49955eb729fad524cc92d6b992711e05
SSDEEP 24576:i31d9CHKy7GZZnQ/tbw/2Mkjy6Fr7g0os:E1d9CHKyarQ/lFTjN4
TLSH
T11785CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ba46c8f29f25f6e694f68d17df1ad750c9cd4981693259f4d83cde6826a30c00
MD5 7f771b7431a73e59f3b80d2a37e4ec06
SHA1 3279f8abd35272b4636eb33ab35b43a6e632a5a1
SHA512 adfa09a04d5d29229ec1ab6ab87e7f52dd8a95a460c7ebf6a361e8cbb670b610a6fcc946fa0e4ef99f150b8e52806963379e3b8d335a2349a69394bbada90847
SSDEEP 12288:dNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:dtnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T15B5523697925F98BFB1706F58C8381829B3B0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 792a4b554c6249ea71b8f3a8b0ab9b48da36d3af17ce8bcd1adac6220f8d5f99
MD5 3c5cb5d3862526b27ecdec8349d7e464
SHA1 93d12e6c0a6b8b8024e7b09efcb756f2a004c047
SHA512 971724c5259f55ad5f519e6c6a89c7f16a62aea55276a855a889b99015ab9039a348df7c49aa97409358aec39f86d3704276aab5c1c812a58c0cdd897378df60
SSDEEP 12288:KjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:KTnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1245523787964F99BFA2B06F14C838182973B0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 01cd9afdf644a9e997fae95c014113beb9229d782c255bcef07e09757db8e632
MD5 044dd58a6ec570d5442195adb6dd6cae
SHA1 f84de135166bab9f7d44d20da75da740ddc1d99a
SHA512 31f09164ca7956311cb2246ef0d80889b29ca10e855e24811ecdb37f5e26fa610c270342a3257150eb9e5386f1b4ed6491edf7e11b61fb24362f9f92346d4574
SSDEEP 12288:sEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:sknQ/tbw/2Mkjy6Fr7g0og
TLSH
T1D95523797925F98BFB1706F5888281829B3F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2f14ff34eaf1e3a11ade4846d207af13cae2bbf25834ff3b1ea3d3e70667428f
MD5 f526b2c3b8caa359efce7e7088d6dde9
SHA1 f5aafd6092808fbeb135ee743e30ae069f7b3d52
SHA512 6315b5e1e2e44def88276af2110b50201004e7efcb0e74c3d5e64ec90bbe8b1556e9c50e4bb0e6d900b15ffde86165a7652beca4027d7a9fe8ea1d0da8f55f28
SSDEEP 12288:wOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:wOnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1AB5523797965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d00ce397f1e99e9825484503dcf6b40a79bfae0c805cc2afa3d07cdbe03b2c0b
MD5 f900060e81374635be96b7390a9542d1
SHA1 983676ca18c2b30833c1742e212609042e838a8c
SHA512 0c7e55463862d66143a8b9956c51f6f4f6606c7e69c70ca4bf5cb58a1da9eea25a9422042a48818f8b9d469e5c88ac6b19c91aae36a1266157556c79cfbc7645
SSDEEP 12288:KssfeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:MenQ/tbw/2Mkjy6Fr7g0o0
TLSH
T15E65F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 098117a6fc7b9422350ff2296e277139b20512a46518c2cf1be9a7e2c938654c
MD5 20cdb3c02205edc1840e4fa21fb3366a
SHA1 e238d059c1e456f6e4b096b093a926f8862ba497
SHA512 89690c6a8d08a5ecab6b07af44dabbd74571a53ac554bbda185ddd3296efc4370d003ddd3dad2a85120de03c086b47cfc805923ef7b51112e03b4563f7c7869f
SSDEEP 12288:xMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:xMnQ/tbw/2Mkjy6Fr7g0of
TLSH
T16F552369A768F94BFA3B06B05892C151673F0EC5BF90D38FB708222D957C3D40EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 76ed808794c6e631229b41ab2cc93d800ecf7f0c5083c67c8d53f8480f02664e
MD5 07efd09cc6b595009b8b3fc73a91e4c2
SHA1 6fc183941103d9cd19887709751e594cf29437d0
SHA512 98908206f556459e014ad73f73072fff950b2677942d661ed6cb6945fc549adcd1a45035bc5426fe8e9f5f48dca7f14824ac39d2da260a38a1d7221e46f787ef
SSDEEP 49152:Ga0h2GEkuAe73q3pp46zwwQ+Q/lFTjN4:Ga0hNYG4JwSLm
TLSH
T186859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 41a5a0b6d4fc2626588b2b58b8e885c22fae698a785ebe3beb8d4f6203ba80db
MD5 ad643810e633db5fbec9253a09f85805
SHA1 4fa12bfd4e773ddb65f394656d2cc8f548b21f15
SHA512 e9674966117b6040d72342d2e40cd4c4be5a0d72d2d66525ce44d87f708db4309561c7cf62d3bee692be77738b4b1990b47cc0f754812577d493afda026c4b1d
SSDEEP 12288:OhbHjfXbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:OhbHjPLnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T11A55027D26AC30DAF63692BD88928546D7327C552B11A3DF2380827D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 09c31bbbd76712797d73997643a796c238a4e1e27937d6c4a106ef09115c3437
MD5 c5019287841a2407571e9ed8e0b04a72
SHA1 6c9a2382847a67815d3e1beb5ccbce14f00dd82c
SHA512 4ea2337cd4810bb9cb255438d1f194393705e712f80106c4d0be149f668b718fac6a15c36e40617cf118ee85174e33fa8039f8efec20a24bf278bf3fc7c37ff4
SSDEEP 12288:HoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:HonQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1495523687614F98BFA2B06F54C838146673B0EC17FA193CF77482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 ca1f4472118ccacb96c8480c36aa9d43a38ce3798188f8103726796cf371d9db
MD5 956d24bc29aa8df634a5e2178e371722
SHA1 68f313f293fd955b8fa2a5150f4d08ae44c4c37b
SHA512 7a39566d0fda80370444c91d5bf3fffa16c65ef4f6e30c55c53fbd2eaedacf9d5abfe1f0343ff7af5b99551a4602416b4b1166ec989978e98e1e2a8c8dcb273d
SSDEEP 12288:IOb4A4LWOsvAYFTTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:lwL3UTDnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T16B75F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 8ebaf5ba9e0b1f1ecdd3c25c3346fc6b9f4c94c20332a25efd46ac2278310584
MD5 5ef2fa29aced8d251f6c3cb57cceb9b4
SHA1 8094785312f5e37af76dfa3810bffe00cfa5320b
SHA512 630901ff732c8771142cb2693d757dae444fc8b143d83f4e1c681d58894aeeaa61458fbc8227a2ce2dd092228910d578f5919621a0e5b238e5dccec9e0b77c65
SSDEEP 12288:HpFtCOfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:0O/nQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1EA55022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 030db3c092233ca0f5df786cfc26eb1670925ae8385426d1d701f80bd21d7915
MD5 a10748300ec05cc91ac512cbbd5711a5
SHA1 bf6c7cbd1db529954f373bc038eb7b941b85a4ad
SHA512 8312df8bb24567c275ffd77892eda4e566dfad25228790d9d3ec74410426b7981c9a904454c57fd12640458e28df3440e79b2a8de4996afaa57d9565fa266c11
SSDEEP 24576:97NM9YqZqmWMUkPjZM48Mv6bEhscnQ/tbw/2Mkjy6Fr7g0on:97cBWMpPjN8DbEhJQ/lFTjN4
TLSH
T1AE659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0ada996f5aa18f0ee8c02d0eb4126993235e779a62fd1a512996c996b7ac9b86
MD5 a1d92555cd7ba501a3ab6a21fd1626b6
SHA1 713a1fca80033d0851ef82df5d462738737d7708
SHA512 6f05a2003575e4cd665de654dc12e6f9f6d44b2d8f8f2ea80e7c0e1f740605481aadf07db11abdd20f2eb891e8fb92ed4ea3f74f64378718aab4a92cff4cf69d
SSDEEP 24576:AW6BApg2YuyuNDYTabvcdvNYf8km1CnQ/tbw/2Mkjy6Fr7g0oR:AF2YuHNETovAvNYf8km8Q/lFTjN4
TLSH
T194857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 5e42a9c7835dbece59b2e8199a7f33d23f023e24b19d69ccb23ffc3857b7f49f
MD5 282e6b41f1cab388f0c84883f5625fc8
SHA1 6ef451bac64a8f1432d9a39314cd09ed799a4a7d
SHA512 91459a51eed601539a4ecdfbaa7e0bb8e5093251ec3f81030fce270409744bcf600e81c80ef06277b9a12a655f67ac3ad95403778171d0d39fa51057822c4a04
SSDEEP 24576:WAFs06+Omlf3NXEbTobnQ/tbw/2Mkjy6Fr7g0ox:/Fs060lVXueQ/lFTjN4
TLSH
T14E65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 84310ebd7a6fd8aafcfaea0c41f2d46294e146d80d819ad1185ca6d95136fd65
MD5 0cb5b913d18fa930d9b0393b1b481304
SHA1 cff0d8a8d9fc55ad9ef13fcaf395f3791ed354f3
SHA512 8c8beb2ba4f42d6b0a0e76f0a0f915533a9a060512ef70031e1a23760ed92e1c9092e202046f895e6ae98b21e3b66bb2c47aad9426491ed3aedb149b511ad1c0
SSDEEP 12288:PCJnJ5D3Vkrqzx8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:KJnJ5D3WaenQ/tbw/2Mkjy6Fr7g0oW
TLSH
T11875D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 72574b3419b6e1512a21938ca63d269344f7d7075d55c5544f2e1ba03e98ccda
MD5 e5365e2cef02a1290f3c0024f862d73b
SHA1 9bab340341ea9203008fb3c66d8efad0e51dc23b
SHA512 8433439581a56477b99291b7afbc248c073b837338614b65eb67f0ece1dda428b075583ea5daa1610fc53ffef813dcc460bf51668821c3906c6a1f7549bae519
SSDEEP 24576:tEPghm6/7IIXdwcXrif7qQncjlP65i3VuRnQ/tbw/2Mkjy6Fr7g0oC:ag06DIKdwc+eQnSt65aVAQ/lFTjN4
TLSH
T1D6955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e2f0900995b031815e92aca1929a9fd26c45197c84022923c998969a8c5cded4
MD5 c1ea3123197c272517906fb0649fa1e0
SHA1 4efc9740a912dff6e35f39c317ad6a788a7c6405
SHA512 fae197fe226f3f507c453e8ff527df2f654ce530f8e60a8021f07d8c40206c0d43319820b19bf86ea27f3d17fe04beaa4d3e8e25290bebbe2bb450fa76a40887
SSDEEP 12288:sEP3RSwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:nSQnQ/tbw/2Mkjy6Fr7g0om
TLSH
T10055126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 42747ce3e5427b4a686ffb7041af1fa3e6775575e8721efbe1258bcd5f68c32c
MD5 a4098d84282b6db6dd2df087122034eb
SHA1 e908f8b2119005e8e0f7ecdd22bcc121a867fd58
SHA512 9f3f46f429a92098de994317c3244e2f37739a0b3f132354497bc0ccf2eb475fae37af198cdece8a0b4f10be8df203109e5ce8aeb78d1e2e4bfcd66f6d92f55c
SSDEEP 12288:YjkyJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:YIyZnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1086512186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 92f1fe56097720a2975574d488b24eb1dde13e81dce15c6024470d538721d6a8
MD5 f2c1f9b4a9c8963e0179b39a7fd825c3
SHA1 8859eab27ed2d84ffc1862f3e3400bb50b7ba783
SHA512 c24aa542c9761327552d577f853bdd60bba229913241e0572b25028fa2aa68ae1475234760402ca78aadbfbd173696c596798097878f8a2e6100018c416fc906
SSDEEP 12288:00PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:fvnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1DB55236C2625F89BFE2706F448928582973B09C17F9167EF36846239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f7125f87f443c0e5e0ecb668ffd3cea68ff225711a0e4f6e052c3f474d2659c6
MD5 4a78e89f9cfe589b2f3fabbc6ceb5ad1
SHA1 e5f91185d8d808eb1877a2c08e3eccc6c15152e0
SHA512 7a16af007fb26ae91e2efef9a55711ca2bbc26799381543b20ddc25b657fa532c5d858ab30286be9c6d99e3d649c8ec51519eb129c8d08e921678066f55d7a06
SSDEEP 24576:SQ9MxZKdcz9dw3UnQ/tbw/2Mkjy6Fr7g0o8:SVKZUQ/lFTjN4
TLSH
T19D558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 08eb4fcc5bb28acc61ee6c96f2f1141783e479e226801bae5923ee0c4a14f13f
MD5 5c59d1c2364a021a7c8e8d42660a0d29
SHA1 c99e1e01a3c9ffbe327a42cf74c73f1fa501ec1b
SHA512 34d2654b04b23b61c33ce0128a4b22f4dc31c3e68d8da55c6d1667a91c257063355df8499538ab3ad677f698313c034c580d7dff2ff96e290a300f150a1792be
SSDEEP 12288:EyoKo20Rple9pVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:EyocSAp1nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T10A65E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a8243f13c9c751f439dbe42bbacdff5b239668f68fcc24f7e828cab2562ef1d8
MD5 53499c7ae5d25a39e6988d6306bb1c54
SHA1 61c502bc8dc02cb87e92a9b97c4ca48fbabad65a
SHA512 b5aa318d47b1b9987de4ef29ff120728f56c5ef7839db98c00355d1367ff68ff5681749c62a9b76582b65279c735929bcfde1c1218ae00a60bcc4973d7db860f
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK1Q/lFTjN4:f0zuNIoLm
TLSH
T113A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6dfa3ddc71d6be2687885435fce2abcbd8bd04ed33e3f193de8a1723f25d406a
MD5 6f7f44cfad4e2142043d12a55c2a681b
SHA1 de071bf202a819e8ebf452523aa79dd8bfc54f0e
SHA512 d7e5172ecbde9c0b946219d89d216ee61a685c3bc1fa59b5c52ec6736ac4ec58248cbc75b1b0e9b2a9b326bc83c410d048aac146249d59439e21d4d853df1e73
SSDEEP 24576:g1QT7EcpfxR+N5AWAz3ooiYtjMqbQnQ/tbw/2Mkjy6Fr7g0og:dTDxR+N5YzTfjMdQ/lFTjN4
TLSH
T1DC55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 5b991158d6a878cc8819b5e5653e75e6d9429241d30fcaa07da8815b3499a9cc
MD5 95a26f8143055dc504408dca8912f615
SHA1 ee88c05f5aea721935f6a5433d4684e9bfafd3db
SHA512 76e3dabe111b90eaeca90861b5de296c25504f11420bdc13007a9b5233ce21f85fb89ff69afcc14afdb95c02c2da149c5dd997e0a66865a926367f9667921f48
SSDEEP 24576:G3YgnJcRTk4yti+R5dBR/jnQ/tbw/2Mkjy6Fr7g0oJ:GIgnaTk46pBR/jQ/lFTjN4
TLSH
T15D45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-280-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/212-405-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/832-259-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/832-253-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/832-249-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/832-317-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1036-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1036-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1036-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1036-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1036-73-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1180-302-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1180-295-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1180-296-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1180-409-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1200-306-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1200-426-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1232-283-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1232-289-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1232-291-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1232-408-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1468-9-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1468-33-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1468-0-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1468-8-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1468-32-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2268-245-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2268-313-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2296-404-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2296-329-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2296-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2400-435-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-415-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-445-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-446-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-447-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-448-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-440-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-439-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-418-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-429-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-449-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-450-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-451-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-419-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-452-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-420-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-428-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-453-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-427-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-444-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-431-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-421-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-432-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-443-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-433-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-434-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-436-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-442-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-422-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-441-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-438-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-423-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-437-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-410-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-411-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-412-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-413-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-430-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-414-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-416-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-417-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-425-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/2400-424-0x000001ACBF4B0000-0x000001ACBF4C0000-memory.dmp

Download

memory/3564-516-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3564-386-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3564-402-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3564-330-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3564-370-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3704-274-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3716-323-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3716-509-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3800-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3800-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3800-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3800-57-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3880-83-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3880-81-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3880-75-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3880-237-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3976-263-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3976-265-0x0000000000550000-0x00000000005B6000-memory.dmp

Download

memory/3976-269-0x0000000000550000-0x00000000005B6000-memory.dmp

Download

memory/3976-322-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4336-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4336-36-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4336-45-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4336-44-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4392-14-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4392-219-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4400-497-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4400-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4524-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4524-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4688-318-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4688-508-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4752-326-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4752-515-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4860-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4860-220-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4860-17-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4860-23-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4860-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download