f6076ba55f5d63de7b569fc8786a2f72c0d4d61f75692d37c21670b079ff209f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Size 2.4MB
Sample261104-2aecsavxft
SHA256 f6076ba55f5d63de7b569fc8786a2f72c0d4d61f75692d37c21670b079ff209f
MD5 43dcdda56ea78723fb60ac200b8ea379
SHA1 a6a1b3b244792402f5a64da0a2e234def1be0458
SHA512 23d8ee04f97525234854e3ea8af773d0a2a189c280fcbc51beb432e356c71b9f2ef9818d186d9ec6f039c25c6ace084e5f6374abd6efd3241b8c91aa9433e662
SSDEEP 49152:Sm5Xe6XhLNiXicJFFRGNzj3sGxubdNNVdb9IPK:Ku7wRGpj3sGINT1G
TLSH
T126C50159A64441E0E1B6C23888538846F2717C018771ABCF52D8E77E6F77BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware stealer upx

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 20 IoCs

pid	Process
1756	elevation_service.exe
6012	elevation_service.exe
5912	maintenanceservice.exe
2580	msdtc.exe
4080	OSE.EXE
4348	PerceptionSimulationService.exe
2236	perfhost.exe
6128	locator.exe
6060	SensorDataService.exe
2760	snmptrap.exe
1556	spectrum.exe
6092	ssh-agent.exe
2588	TieringEngineService.exe
2560	AgentService.exe
4680	vds.exe
2624	vssvc.exe
1580	wbengine.exe
3864	WmiApSrv.exe
224	SearchIndexer.exe
4336	alg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\75e98df3227ba850.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4528-7-0x0000000140000000-0x0000000140691000-memory.dmp	upx
behavioral1/files/0x0001000000017bd0-52.dat	upx
behavioral1/files/0x0001000000017047-51.dat	upx
behavioral1/files/0x000100000001700a-50.dat	upx
behavioral1/memory/4528-49-0x0000000140000000-0x0000000140691000-memory.dmp	upx
behavioral1/files/0x000100000001700a-473.dat	upx
behavioral1/memory/4336-474-0x0000000140000000-0x0000000140168000-memory.dmp	upx
behavioral1/memory/4336-526-0x0000000140000000-0x0000000140168000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8247102ab6cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000575e8b02ab6cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cae7a02ab6cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6d84302ab6cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015624d02ab6cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048abb802ab6cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c877302ab6cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe\""	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe
1756	elevation_service.exe
6012	elevation_service.exe
6012	elevation_service.exe
6012	elevation_service.exe
6012	elevation_service.exe
6012	elevation_service.exe
6012	elevation_service.exe
6012	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4528	2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	1756	elevation_service.exe
Token: SeRestorePrivilege	2588	TieringEngineService.exe
Token: SeManageVolumePrivilege	2588	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2560	AgentService.exe
Token: SeBackupPrivilege	2624	vssvc.exe
Token: SeRestorePrivilege	2624	vssvc.exe
Token: SeAuditPrivilege	2624	vssvc.exe
Token: SeBackupPrivilege	1580	wbengine.exe
Token: SeRestorePrivilege	1580	wbengine.exe
Token: SeSecurityPrivilege	1580	wbengine.exe
Token: 33	224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	224	SearchIndexer.exe
Token: SeDebugPrivilege	1756	elevation_service.exe
Token: SeDebugPrivilege	6012	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4384	224	SearchIndexer.exe	112
PID 224 wrote to memory of 4400	224	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_43dcdda56ea78723fb60ac200b8ea379_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6012

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2580

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4348

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2236

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6060

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2760

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1556

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4752

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3864

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4384
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4400

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 199126e7f2195d6f46644667ad6a48aae3ddf1b18e2861bd2607e4ba5d30b89f
MD5 6247f3487500ff81bc70341503e3a727
SHA1 19ae3cb9ef285f3f6bee4c3a14a785bfeaba4bb1
SHA512 bdd409f8b09705a1b2e6d59ad58bb10d31ddfbe68a8c7ab7cf0f87b85e806c002499bd763c4ae5ea4d2eca583edeaa8c09f485ffe7c60af0192c622dcd03a56c
SSDEEP 49152:Mb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnCLNiXicJFFRGNzj3:23q6mjB17wRGpj3
TLSH
T1DED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ee02ea59cee1bf20fe319a518a5492c4355491a6b44cb08f78f8af5afc5b6587
MD5 e86ef97898d48bd485b513cbd7216b1f
SHA1 8c2717c4eef60cbc1c97f156b0d25328e696f13a
SHA512 74d82dcc9ba02cb7e1334246bc608364beb0bd525596e0ff8aebe60c30f16ab07adac6dac3c2f9377eaf1b8debb08baa50b8a9cfeb0700fb5f91d087b4747833
SSDEEP 24576:0XYfDtczAJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ztcoLNiXicJFFRGNzj3
TLSH
T10D75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 21eafa30bc5b2f6b7959bfe53d66f400c3e3e5a0043cb93288a43a2c7b75a350
MD5 38ca9de67f2d2e6d7c699a7572c734b0
SHA1 3de56102db72d2a6fc3c65cd1d72650b803d1ef1
SHA512 c42fb2d26114c016bdc62428314703882ac51de5fdaa3cf98b686d434ec9f97647a3ad5d632990496e735d5c459e88b53960f6fe882d9060f10fab6b1c7b2f44
SSDEEP 24576:m0Le5ji0hmxhrMa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mPji0AzrLNiXicJFFRGNzj3
TLSH
T19785AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6c690c2e8aecae367a7b7cda9865859bb7b873e579dc62320d76dac8f9087b83
MD5 f899f10ce16f8dea7a8352acf642a0a3
SHA1 ea0b7bc3776ff246a28f0a218d5eacee1ccbfb14
SHA512 4842138a99624b2de9892d8332cac5433026959fdd34ede5d5ab3841024518fb89f5091ac6bf31fe1bf4f2f2a3509cc7e2138f9c7ed6436914d4d1cba656f690
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyuY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m/ezSC6vUzPv+Hjy/LNiXicJFFRGNzj3
TLSH
T13E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eccd4746cdecbe28ac1ef5272ce16dd5917a6b7d86eb2982a826460876c66c2f
MD5 194b50abb237b0627139dd65e4ebf422
SHA1 0adaaff0e8bf0da4b1e56c34f49bb536f46edbbb
SHA512 4d64243eaf75340a672b37fa5cb676f2bf7a5df5e3996bb8cd10ce0e88202f095dd7fda09b43f4a41c56dac601ba1adedce92ca27211d187d223c799ef43dfd9
SSDEEP 24576:XVbqPb88hv/l+Bl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XVO88hXl+LLNiXicJFFRGNzj3
TLSH
T1F6559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 69104bd91bf99c76ca8a08d207af28ef1bf55922704eaf33508021babf937b57
MD5 3565ac65c181362e8cea12ecd4c0300c
SHA1 604104932c60cb3196cc032246a8f4704b917a8b
SHA512 bfd816ce1856bac061cf2d2b673e48f6cf0cfdba5d37d666c7b292cc59053e954f066e4f82f2ed4989af71509282b0bcbf8b0b85de6ead4f4dbd8124b7b30a31
SSDEEP 24576:MGW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mLNiXicJFFRGNzj3
TLSH
T1725523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 5ee9fe116fc1684132c49015162ed8059eb28425079061afb2eb8403baec9540
MD5 523c094a4c9971860396cb9364ad91ca
SHA1 c3e55406d6c7e6f9e9646e8d3a311bbc666c8c64
SHA512 85056ae908d0cb918d31fd04e3d0f50eb4e01b17c95183e6ff1d344adc2d471a37e4f24fbd59f701b22030d073e34f7135ea09b23583e9fa83f17498700b7da2
SSDEEP 24576:IJIU9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IJIU9LNiXicJFFRGNzj3
TLSH
T11C75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e9aad204355898c30e3e29c69634c018d187aa89f3514d4cce832266689801af
MD5 761ec740ce0ce0376e15bebe4530fde0
SHA1 b57b7b5c3d1148e591b8269f939199e65e5b6c7e
SHA512 f14577920f72011d180080fe739c0d22185b6ba1c70367baecd70b4bb98a816e0944c9cc0d30725b319c82c624cf915a1588468c9d519afb08c72896b49c6d22
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THl:OQvGAdlCEL8c/WRNw5CI7wRGpj3
TLSH
T175266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 27c79bd9846b1943accdd97386a80a047bc9c01b83d1f4cb36c36e38745f0536
MD5 b38979ed1e12648180b3c12a1335ac6a
SHA1 ae7b741021c9eafadd3e735ff81b682d1213e934
SHA512 9a7f87b6c619a8a4e7fc4a1c131af7de89dfc107153f928285e3fe5d5b902b090c19f7da7adde280dddd452a6d458b4d2618ae7edbb10345152f28f1f3fb472d
SSDEEP 24576:vfewsAjb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3ljbLNiXicJFFRGNzj3
TLSH
T11C75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 62d6f9fdbb67289d56d453ef43b14dd89bd6cb0bdc9d8865f8c7e49ce3b09ad2
MD5 567a600eb1e709b55aca90981d561367
SHA1 54736d6a6df62a46076686e12757fa27842f1e86
SHA512 8a12eeab9b5d4d318d9293ef4e673caa4fcafe852c597131c17113d85de71b3aa2ae15f0465e20844c269cd8f60ce868089973f1d03f2502720e75324b7663b1
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHXF9:lUEtQevvqc2W1cpV20I32V9
TLSH
T18F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5f955e7ddd019044bd5154eaaead86bc55d1ffcfb3a25b9a642648c20a689060
MD5 1e2f0bb80004b6228f12c9911966221a
SHA1 074cc17b3f98ea1a9c0867383e90f263b316c559
SHA512 07664b9877e3d8d2937f1b63dc309a2001705806b11252161d18171d049f67161471450da2ddbcca5d525c9a58236cdc031b54e82d117fb4012890249ef30441
SSDEEP 49152:NCbRquA/m2yL5zLfFiV+XenmE3/z7LNiXicJFFRGNzj3:qoq2Vjnm87wRGpj3
TLSH
T180D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a4422f2e64b32288b0a7ef8248753d40888ebc0c63cb6f1462d37824d6e4cf61
MD5 99a73eab61fdb44fb4f58b88ef0b11b9
SHA1 3f5be2b4113370a86424c1df6201d796078dffe7
SHA512 b97fb1e262576550f160f462399a329fd6bfa2cfd7a6e199376429ab261d4a7bdfc826e786a9b4ba1030c3abb6f4fed1aec971364b0512ffe048f5e79bcc2e25
SSDEEP 24576:FAhGL6IFoiwtA5l7S53c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FAM5Foiq5sLNiXicJFFRGNzj3
TLSH
T1CB359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4a80d5d88a1064d5d5fbd1aff349e4e79528b09c45e4faafa78879fba2d344c8
MD5 30e516c458a5fb89099028df1830b9fe
SHA1 72987d1e345598cda9b13a96ff4e95eb76252e40
SHA512 e3350589769982eaba0f5e62d0ef2f609e8145ce3d9f17a2aff18a9998fbb3574bb12142883de169c7562716147beb06ac2fe2b41cd055858b2e94da3ce33ec5
SSDEEP 24576:AwuROWf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AwSOwLNiXicJFFRGNzj3
TLSH
T15D65F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d7db1fdc5fe9cef24a873327d9a307ced37ed55d396f8ef3812759de81e357a6
MD5 2c2345a373a5ccc97923b1857268336c
SHA1 548f632eee298c224f89d92a06071e95f37c87fa
SHA512 a3ea4aaab217d00967d674b856040a21647374b010a4c497a9438a1943c1376ecbd02ce59af0e97629893cd27b52f415cc636377ec9f2b3a77191b58f24555a0
SSDEEP 24576:2Zuy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mLNiXicJFFRGNzj3
TLSH
T1C655129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1953b6aa1e98d74afecbd040abca0ad095225b929cac6e5d085cd3e9b89b3650
MD5 c81367d76ebb2602b376e291c00e88e0
SHA1 32d9286c4a55b82ec32ff87418e81bd95bbc4d08
SHA512 5c64f7554f95064270c8ffc7a57c547047724cfdf41f7abb142b213b5269e1e0458fe18982840e9868c6a95cc43f33a11de27b5d916298f4c4365d052eb39024
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3h7wRGpj3:pQyiKanX+PNVF9
TLSH
T148667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8fe559ef4042335602c0868b6ae7431a3e04bc852ef73346ab4806c0c1689b0e
MD5 967056a9898dbba86745e30d6a6c795f
SHA1 2bf573a54a9fb83150f54e113c1481196b5ce868
SHA512 0ff437d712a25a1bb573809c715f1809d679a104e0e9ab87f46b24ea78b27a7e2b63f706d2dc2505bb323707a4c1fbe0802af530767722ea6fae5b1267fdda99
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3h7wRGpj3:qQyiKanX+PNVF9
TLSH
T170667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 93c453cd8607bf10d1ab81c60d024c36d9d86bb7e78235c9fbd6851463b7a90d
MD5 a965580a54a8627d23327be7fbbdc813
SHA1 2e3dfe69632ca38a203da479e0c4899ab4a8b20d
SHA512 a0da1734fd2bab30d0a8a46e4dcf4b492d5402e10e3e73d31af4b5d5feb17363b5a825a64c87cb900f23aad0f29e72fc44aafbe73e3ad020e0ac6eac37e83f16
SSDEEP 49152:e68Qg55nhkeWu7PNU3/rLNiXicJFFRGNzj3:sthTRc/r7wRGpj3
TLSH
T197B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 58c8497d10bc341883048c087a02b79d3656d98b1a805196c7597d4290e69ce1
MD5 dac029691c530b5de563450adec1f6cd
SHA1 42c763b6ba861e8bccc302d69fe001982abee681
SHA512 7b2d351988e9933c57bc85dc4ca76ff30fd256a27e4662cbd47fd963a56ad16bab48edaa741760b9ca9dcb1dc937413b32c25ca75802e0675ac38bdefcbd8c46
SSDEEP 98304:ay5112gYy5azzVvU69nLKnhZW7wRGpj3:DLIHRWhQF9
TLSH
T123167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a9de717808f540bc7f114fa570bdaaadc91fccc4d83a267d4e0bf9eca7d44593
MD5 9f053450da210f4bb8b44cf395e50891
SHA1 e1283342afb74abaf9738192cbc6fe156b14e59a
SHA512 2b1dd1c687e5aa4e4d130e3bcc122c0c24ea76f87b57985a93f20f6f965413d301d3006ad05a5cad32670b073498bea9dda636023ed6e25d351bf65357aa4c99
SSDEEP 49152:EB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glHLNiXicJFFRGNzj3:eu6JmIxd2dH7wRGpj3
TLSH
T1C6D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8b95deef62ef341fe3e20a177e91f691ab3d4257e6748c2d39e1c62dcfb31445
MD5 9ef14bb8cf39d313c6627e0da2a361b4
SHA1 2a1c2fdc40e11480b1e6b9b365abc5b6f7c67235
SHA512 338c500028ca486b78204be90e989c6eeb5ae5f4b8c096f4745f9a152c801ba4f32510c3e6b7d16b65cdfcbcb5a4abafaefc164f1c1ed97abe99201ed124df69
SSDEEP 49152:y1hpsNoJpF1A67U44CwH7R4xdLNiXicJFFRGNzj3:ymifPqR87wRGpj3
TLSH
T10AB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d146f369db60c8faf4556c3bac3cd18b080759ba79c00598b6798f6a8659e7af
MD5 55a966128b4fea26b8b8e672042cf970
SHA1 f8bd543497c53ee0a8b1cf9f4c949a879cad1afd
SHA512 c215f0eaaafae7fc71c5b17edde68dda52ab45d60a3869db4ed04d83be401773194dfac380e90eeea9fe137ed480bfd50804b1b0f826de952fcfcb3152f97f5a
SSDEEP 49152:XSuZQIY0Be2KkRVtOnks6NMHqyLNiXicJFFRGNzj3:N5dKqi61y7wRGpj3
TLSH
T1AFC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3507c22cc7029a25fe9c70ba1df3e30cefa32279f3d4b7a0bee7ac8de0b2e966
MD5 bb0590c7b65e638cea9a21e8dfe45d5a
SHA1 094cf89e6371bbaaad4a1bb26709433d9ba45e51
SHA512 44965e9ec592a1d33b49404cb2f743b36136a6d560f84f865a304c028fe6c08d9bf408fe2e88a2b01c30098569faee2482cbb146ed9dae3bdbb13633d20ebf45
SSDEEP 49152:qhtSn8EApI0figjgiDn0AP5wJLNiXicJFFRGNzj3:LX2iWphQ7wRGpj3
TLSH
T18C95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 48c958bfa2b176ecc9731928e03111e87f49d37fb86589828deb8df180e5dedf
MD5 91e1a9a904da92de6ec08dfb6c61ea66
SHA1 7f402dd6d5599b0bae0f8448496da95ae09c0cce
SHA512 58261bffd96358165400768315dab4afc16c1c72b4f15fe8ebf9a067e1c1d48269e41a14bdd50c8ab27da1865ef5ae06e52887e2d374f6dc9d14ba2d5b94242b
SSDEEP 12288:ckiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3558955B1F6FC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a372e1bebbe738eb96465d3d0a0e4fe0b6a5071fd7900cb532aa6f5616fd005b
MD5 53da838e18a1aacc3646e1af42aa9b0b
SHA1 cf94cb1c531177bd31053afdde35e5f75e020cb7
SHA512 7d9cee37601bb14a64330d139032b669dff86bb55d335ae11b5b42152f0dd9aafc715851519a1e829c83e41e6fef992a8e377fa9b983fe54cfb1c72638170dd5
SSDEEP 12288:YziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1715523D3548955B1F6BC0039C6764428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5d5c21b88c2eebbfce9dc5aa2219b135307f549ef3d49a582687bef331f278e1
MD5 db6a2672aa88b61dc3c99b098bd1f76e
SHA1 d292a80eeac13def9830614beda3974c1286d676
SHA512 7c637e9565bbd8a0d9ea535ee0459004645d8eac3539627a9cdd587a48a10a5e428b357e6b44735be190c2f57e8dedc5fd91a3f22b6f617768bfdbb2a94d1389
SSDEEP 12288:mpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E15523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 00117ae731dc5f095c27924d1dfba00a1028bc86b08c3a4a9597d831d02c8ec1
MD5 0fc46243a4ed168e4284d225085114da
SHA1 b10987ae261b16eabb81b8e6ab408dff680b81e0
SHA512 41a37dad04a2ff5b219a38abcd4849ebeacdfaa66be81fa77f9da62f4130ae4c59bab782bfa9ddd6a7ed68323f557202ce645835756f79481f6480627fd200e6
SSDEEP 12288:vVaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T119552393268900F1E9FD8039C6764424F2947D6CD7325AEBD3003D1E5A75BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7b30ebcc2b57fccbcb93eccb05af0ed89f17897f3c902474ae61f758a7901aa5
MD5 e4c11096336fc62d14a31220b340a918
SHA1 397ac05327edac776b3d5d956af21b6a7dbe2dc9
SHA512 c4007528af121b0668dce7ece4cafef89890b8925cd8dd8ba4d12596642fbfe9010dc021ae9179910ef184c3d3c099be38bef93b064b422ead356f1fdd9a6fa8
SSDEEP 12288:uiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b5746fb6d797380e8ca1aeca4028b5fc6ab4166b32fa09f3244e1f21f81d00fc
MD5 afbaaa3c332aaceca468db4fe8a86cdd
SHA1 7f18067dd07687fcc5c5ad0f308fe53c36e0d259
SHA512 2cf81a644b3450c04d4e0e6b2a5a0b5bc4079037587ed8e82e3788813dbf8be4d612227298d2be6ff5eb51ddbc9993c85a5838d7ea5454d6e2e447aeb913ca02
SSDEEP 12288:gniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1195523D3558955B1F6BC0039C6764428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 926b29a012ba1d7ba4413fa8635510200eed2e72a27d0548b1dc46709d7034c9
MD5 de2957cb9a36dee0e90175829d7224c9
SHA1 15a3c4a67b0bab9aca3ff88691f6f16506fcef4d
SHA512 ff450f94c20b762af635f091f382df2d0a04ae0d4a406574657930b82dd15580b83a1d53786dd5644fdc1cb47d34fd10d3ecdb6875b985644a4809e2633880d0
SSDEEP 12288:w7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34zV:wv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1495523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c6b66a4051eeb8c64bb78bb40dfd459615645ebd1b110c5bc9f32e6ff5c05a38
MD5 363e095a56d7ab8a541c87535d320e45
SHA1 ed1abe4a6425f73ab6e8be64c2a85675e2b67b05
SHA512 189db0e655f57ebc008d7a80bbd8b6b94df38f1b113a3c7a959987ec32a575409cc726fd2a19be1d6b28d54c80ae6bd534405af0b5a1bc1f9368a40f5073ea4d
SSDEEP 24576:OZM3zFVSOn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OZM3zfDLNiXicJFFRGNzj3
TLSH
T18C750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6643214b56187d7d4edc96a20df44bcdba579e6be229d64f842e54b9d7acdd1c
MD5 035346ceff859bf3cdf46fef58e3e6a8
SHA1 ec236156b0f9f3a3665fb0d897551e09826d3a54
SHA512 e17754162e5c382fa1fe3172920a9e354f5bc9a07085a7a66028624508ed4e4eda0194c4ac8d2e8a569cf7d43498bb415989e8e3848eaa1743b946c17a5d6c78
SSDEEP 12288:xwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E45523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7797156b6feef23c1cc7d50a75bdaf28ec68224c37fcdaae9f207b6f9fbcce28
MD5 0eb0db88d5708bc9864d835cbbd85b13
SHA1 b4de18657f086aa2dbf0890fb22eb67cd4805ed7
SHA512 929872ad9f14980b3ae355ef187e48a282de2292502de1b8a855609205a2745e0895010297b8b1b4f1e5542f624e5406c54c9d026862889baf68317656558a74
SSDEEP 12288:E8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D85523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 df2c1a44e4bc4aab8ead3a0772a459b3bb81aef48bd850ad6eddaed539753dc4
MD5 f22a858f12c58e6ede0f63134f6ee6ae
SHA1 28d7bd7fddb6ce7edbe06542a39f3f0eba826510
SHA512 4aa6a3f336d4bb429ab2b3d85cd0a75ce76b1c4aef2ba378d67f79b04d1657beb6377cac2495e5024e1386e99c9cbe4f3f370df59f51c4623f9a55dc4b1bc27c
SSDEEP 24576:RzyL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz0:RQLNiXicJFFRGNzj3Z
TLSH
T1E2650147729530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 097abf518903631c2ed92d545cc765850c4ccf6d92f49c2441a1f02a601aaee7
MD5 a1e0c528b825cc18091593e5c2f119fc
SHA1 efe4cb2513aa1b136d6f749016173bc5f9ad29fb
SHA512 c7a11a016b19f0956aa236d29f9de9d103296db5aade860ce3e3af3cf05e0abd9affe6c231535135bff55bb61d0c28827a1fefab7d2ae5c781e7884d4014bfbd
SSDEEP 24576:fi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz0:KLNiXicJFFRGNzj3Z
TLSH
T1965523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0ba616f9a861af6e0bda3bceb30becc9ee9ca5745ba5a0261839f7e3c872f20f
MD5 584caa6ee78acb1f57b73b17474bcb3e
SHA1 b03f911214de039f2106a1b2b26be304e2a22baa
SHA512 5f361bc899ce5e599209fc060cba94b5971a0d312c70f193d49fadf6e03e9bec528ea0d0bcdbea5ab91d92189db7130ff56679d28097053326a3854af38fca9c
SSDEEP 12288:FwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC5523D3548955B1F6FC003986764428F5882E2DEB5619E3E2483D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0175be5d6465c66cc9414e3d14d86a4095c7c6b2eb6a48c350f4e9b0eed5c5af
MD5 b190d1651a689670b6486eb656a724de
SHA1 6df44cfdaa87561b6a6019aebcfe5ac8883b6794
SHA512 15a9842243da0a930282a08ed50a4a86afe092177f5d0da07929b45343ed8488e2f18d3655e9f6771e269aaaf819e85ed2297ebe3cd7a45882a27fd1f24f5d7c
SSDEEP 24576:bcP4mcvIjkGOxhKP2l71nNKbrh/8KBq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QP4m4IpOO67W8KILNiXicJFFRGNzj3
TLSH
T17565AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5f64ff4837b7128d2f4f4f6e27623da48d3c9b48bd6f85ef429f9d802dafbd23
MD5 977f7c3e213de46c927c446f148ffce2
SHA1 c33e9401c2a2d6dbdcb845e2ca904504f096efd0
SHA512 b2c006a44ab170945d52ca3d105cf23ac04161b71adc398472c4499dda9e4747234f0702de219cb25269cafb213997bbeca65402c3f3131dce92c9b1277e94cd
SSDEEP 12288:MpsfgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ny/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13E65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 70c47eb45c691ee0ac14d11a0249c3761a91b834633296ffc901ae0d2ddf145d
MD5 0e2bf2cb45b96ebb154815d4e46b07c6
SHA1 a729ea561a89ae9fd7a91d462af65c98df877648
SHA512 6734c848268a92e85cdccb3e007ee70518ad7103f720623e21746e953672d57932d762021ced627499da4d65ddec26fdf7d31090887d20185b7207af7222dd5f
SSDEEP 12288:DAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B3552393568C5972F6FD1039853A8438B5497E2C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6b98177169c5dbb427ebe1be62d7b28ef42a603689bcd5e308b3d47c26ee9a58
MD5 9061b3babe278b64c78f201387d56690
SHA1 39c79646acd649bf2b8a49fd9c63fc754d42ac96
SHA512 72c2f9f7555b0292a712f524013a5fc28a55acbe512d765981e05752e004e28cc179258e84ffb9dac97be89bb633f1e3e974b82b9aa12332eb2adf55ac5e3e65
SSDEEP 49152:Va0h2GEkuAe73q3pp46zwwQkLNiXicJFFRGNzj3:Va0hNYG4Jwj7wRGpj3
TLSH
T16085AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 bae51b47fc51a1de95e7d8ec119851fd306dc5133fb2511bb8d3086f594bb554
MD5 943d4b54176629ac0e23329530d57732
SHA1 cf77fe4ea10cb02c2d38ceb5c34d21cc888b3980
SHA512 2d380cd431865c59591f7c0f976b0dfd0742f00a54919d0121f7e284d941ef052097baf789f6d5f31ca28fb5311442fec660cc18c92c66cfbf70f9dfb68857c3
SSDEEP 12288:CMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D2518959B1EAFD003D867A4428B5446F2C9B2619E3E1543E1EE27CFEFCF38162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 ce190fc73722441a34a10dc84b403d0c9dc7c2f42b6d7cea9e3f74b8456c5758
MD5 6f0cca6ef0d4503afbc53f1b73b5d4d7
SHA1 b0e7d59fd6502455830790c044678aea7d5c6648
SHA512 7d715f5c72fbef5c5eeda8133eac55215523db75a8b7465cc28503ccb1bcd4e0b6e63d4f14563bb4de6999143fdf4cfc3e7301e7003eba4266589d22473901a2
SSDEEP 24576:ZAL3UTJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZAL3U9LNiXicJFFRGNzj3
TLSH
T179750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 46dfaf85f9b84fcc8d7eb55b4a75a1cf0004177846d7de76aa696524085b369e
MD5 db81007cbed7eb245b410b4a9109a8be
SHA1 99aca37fd712bb47686a63fce691f314731906d4
SHA512 fbc52456bd74d094036e09972b8c61077ceab895ab4929d789a40b7dbe2bbe5591cd40ae29db07e1fe42519d41e9ae9ee6ad3bb087f348cc9f8ede6cbbbf7e92
SSDEEP 24576:lOd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lOdLNiXicJFFRGNzj3
TLSH
T1DE55126A32DC10F4E579903D8AA2820CE371BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2ff8f8554412603b2ce6616168be9896125da0b1958292cbd432f189ba4d0598
MD5 c5ca653bce6eec2f95c7dd87388cc9b1
SHA1 cfcce4d19c33c7b2cd0bd6760dcaa6fad3f30891
SHA512 960a0c47c6550126aa7c4d2e7a4d12d72737751c0173cc01e05473eb0a2a436b92415a992ec1ae675381dc2bd0d5343456916b405c126e303651795501976c78
SSDEEP 24576:x7NM9YqZqmWMUkPjZM48Mv6bEhsi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x7cBWMpPjN8DbEh3LNiXicJFFRGNzj3
TLSH
T18265AE2E6BEC81E5D476D13DC9A28205F6F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 290d37e5824d0baaf217dc4d1e10ccaa730310b6e4bf58db53140b520c7684dc
MD5 1fc1ef1439e79a7489753bd9e322f1f5
SHA1 aa4eef73b66027f4fac3e394aebe6a8521aa35ca
SHA512 bef44cac0d77ee502cc8a1f1cec578912a830648aced923e8856bd414867573536f8ec80fa7fd8996a5ab395be01a8522ff1344c364aba1deae346625fba644d
SSDEEP 49152:3F2YuHNETovAvNYf8kmCLNiXicJFFRGNzj3:O6BCf8kd7wRGpj3
TLSH
T1CF858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a7a225430c07ef347f82cfc69dcdb49587b9a0c990e36377350d71e8bc76f2c4
MD5 bca422c329718f487d38ab50fe9797bf
SHA1 d89538f26109d1ee2eeef10372a856128a64393d
SHA512 d5e9f777a866cb59e7c6bda3724f4c97967f106847185db850c09da0bd435f3918b0aecba4c0fb4ddbe03d5c624770cfcdeffc6062a05156c0ee2a363a6021c6
SSDEEP 24576:DAFs06+Omlf8NXEbToB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MFs060loXuELNiXicJFFRGNzj3
TLSH
T17D65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 79b94cd76dd51591f30649969e9f5bfe56e27e6d7dc4f3f16e782641c2d532d3
MD5 2418438f756bcaf0a55f00602c918f0e
SHA1 761b5bb43685eee0d4b7415ff1da3339938b9056
SHA512 8679c13c12e156f984ec97f1a73be1351f1e0c82d77fe944926e09844e3d799210cb2515fa2964d832c22091edda6b9540ca8f2807597f7dbb4ad817ee947063
SSDEEP 24576:IJnJ5D3WXE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IJnJ5DGXELNiXicJFFRGNzj3
TLSH
T16F75D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b2b10b921a4aa6c1e32856c11e1b74bb191c8ad6a691854cb338c337d2ab3c50
MD5 f8c273c18ac1dd00a3748965c6a211cd
SHA1 2a8bcb7d10f8647b07cb6a8f1e2ecdcd1fdb9e51
SHA512 6b8612924423611349ad51c0f72b0f0e6c1e28a2e871f9e31e902d457160d05fb9c62780c54bc85cdfd37196a7067fc924a099af99def25170563f2d9fd92ac4
SSDEEP 49152:og06DIKdwc+eQnSt65aVuLNiXicJFFRGNzj3:pA7wRGpj3
TLSH
T147956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 08adfa6909e05193f9346853eac86c1ee4f2304b01dc04d17474da9c4fd87d80
MD5 ca6c84e55bd8baa6b7b8ec065cdd97e5
SHA1 9287215ff001668c401a5357294d12518b96f349
SHA512 dc53cfddf5c612f10b5e5429a76365adec73a0c4fa9187fb2f8a3a402f90052e9ac401065ff8445086b85b59a45d272aa645327034b97a7ee87f988c13bef48b
SSDEEP 24576:qZAsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZbm/TwSfVcYG3K/cJHlnFR+IGNef:qZxGxubdNNVdb9IPKmLNiXicJFFRGNzb
TLSH
T1696523AED98820E1E269913D9569845CF3A0F474832B37DF52D0927EDE72BEE4F38510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 854KB
SHA256 47becbe5547162c9ba19d793336694fae18d83a35d670f0918dd6adc129db8ab
MD5 62d20251d57d8bb8ccc4d1e87f80c1eb
SHA1 a21c6a2a22d977377935d0f049c25363b3dab45e
SHA512 da72e7f6ae0062bc6b1b3ee840410f1b0411146f024cb1967174a113adcc55886cc98ec4cb5424628d86e9775bf6fb2de106b64f8c3d39cddd1c3458c72e4d5c
SSDEEP 24576:miAsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZb:mixGxubdNNVdb9IPK
TLSH
T1B815126EDA8820E5E115923D6869854DF3B1F0B0436B37DF16D0C2BE9E63AED5F38610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 59c08da2348cf7fc8cb3931c862984ef2ee0fa0b3576f06f45d0b8816887af98
MD5 4b11b40024133c83d757214531fa7302
SHA1 60c1bdaa85a5e921eb5bbf67d19cd8b832000328
SHA512 ca1e9da2d3a1b79438773fbb3d0174bfed5871e276310e442bc5ff863bbe39722427827fa67b07041b7c3cf9597b27bb10eb715e4f180c29ebbc30eaec46e0b9
SSDEEP 24576:bIyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bIULNiXicJFFRGNzj3
TLSH
T12565124553C860E5E6B9013CCA738064AA74BC349F2156EF9190BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 6e903193214d48c335b4ddb729bfcfed9297e587116628f009445b226da58d0c
MD5 d39c38db647cb0aeeff23f4b9eaa3d15
SHA1 f7b698ac7ce81f134a96933c18a4468795fdcaf0
SHA512 4bf08e9c456b54c28f20e224f2fe1ce440d6d72d74874e1e8409b80d1fa53c9d58c67ecae79ea18492302fd5fca0e207c833a1b1831a3231ec75883c69f4d1bf
SSDEEP 12288:RyhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D455239A118964B1FABD003D86364824F1543E3C9B2628F7A194793ED379FDB9F38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b077e50e6a5a096e0edd1ca02dfdaeef81d55679ac5475f3f886f2d65cd1b30a
MD5 f8f62b1ad5ae4a25ac5e16431e72b586
SHA1 8d4c00d5d2952eeecc9f745de7dc797c966664df
SHA512 36f6b47f5031efde488ff910eab3bf5afb30d92200a4890e8a2606aa6f548d521aa2a9d3e2c6672c76639081f8b0bfb85359659984628e109d27f775387a01ae
SSDEEP 24576:UQ9MxZKdcz9dw36/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UVKZ6LNiXicJFFRGNzj3
TLSH
T1BC558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f88586d03182a289f19982d7b0e0bef8eb0868d792f96b339617cfcaa17a2028
MD5 3c23b627c95cfd355dbb816af4dd7685
SHA1 dfb6794920b6a8ab37abbfbeaf552802c59ae759
SHA512 431be2991038397abc42057e13bc5392326d33c3de1a2922f7ab1321774b536096b8fe54109c85cf7d81e7df92d65e7413d64005295e8f035017f2034aa70c9b
SSDEEP 24576:hyocDApb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MocDApbLNiXicJFFRGNzj3
TLSH
T1C465E05FB76D40A2E176813C89858204E773B4345B6257CB6291C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 df8e6922aa7e4b0209f5e1f4a7a94d3b264b97f72d729e837a03cf30d6ab74e8
MD5 1b8a86620068dcd18d4984b9e527b5cf
SHA1 850c08c0ba874c8ab66e6ea71f99c39ebb46b67e
SHA512 1adfd120bc40c3d70ff8ba9cf60ffe8a79b48ed235526d5dee7b6d4beabea778e61291b0e901d195c0cd9e18563b5fca362523ee8138dfdab13881bcab0f6d25
SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKbLNiXicJFFRGNzj3:W0zuNIJ7wRGpj3
TLSH
T1DFA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 021052bd7055c2fd7beb8338f193a9f459bc9e89d8fd61edc41a29b98eba0bb2
MD5 5eac9dc928f7fd80b891c3230a03f358
SHA1 f4c9817aaef2b6f78ccaee47897ef059b699f3a1
SHA512 cd15d6a4b5a00df936056e93009e190b98a2a0872d9bdff898cc9c8dc3cf7ff0abb8563f5a4d28fa5e368f833573e22e778057f7744551e2038e854e2ce73481
SSDEEP 24576:N1QT7EcpfxR+N5AWAz3ooiYhjMqbFsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZb:4TDxR+N5YzTTjMjGxubdNNVdb9IPK
TLSH
T18175D12EA7F815E9D17EC6799A23C506FA727821033193CF42A0C17E1E679D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 853KB
SHA256 9802d31f04be0ec0c12f1adf03d2ffc69f00d9a1fe75d8c7689da6a5ab7d4175
MD5 ca57bc29cd497ddc6252c1122ef36f1a
SHA1 137af943e93859b9aa4a9116ffdd031ff1e8cc3b
SHA512 0cfe4ba7a7fb769f777a003bca5107906ffb37286763b5413670c78e7f9d3e47467f6b2518a8b0363dfa58d0fa481efb7086afeb3f745d9afcc0a9e5cb128d26
SSDEEP 24576:PhbHjPlsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZb:PhbHjWGxubdNNVdb9IPK
TLSH
T1AF05127EC99C21D4F161E27D6859894EF370B865032A63DF27D082BE9F33AD84E34A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 4e0813e9ee3b694bfdbb790e8eae3ecd83aa52f413ca2b08d022028b76ddd51e
MD5 29f3df000dac4c5bbad3fafd7c494fcb
SHA1 811a920114a29db9855ea9886acbfaf7e10cbc65
SHA512 ce62c85fe932eb9e4b6eb6f484508dee7fa1e8835cb17adc17a77932b8370f2915405d37430bf2873c773c33f20c096ca500a95a2138b53da502ef5db9e8e378
SSDEEP 24576:bTMdOz0FFS+UmSL8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J0K+UmSL8LNiXicJFFRGNzj3
TLSH
T1DC75E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75e98df3227ba850.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\75e98df3227ba850.bin
Size 12KB
SHA256 3b3b05e70f5f00d3c581e42483752ca42e9915fc976576141c8e28bab6e14044
MD5 fe20795f5407cdb3c9accdc48df434b7
SHA1 76687df2ab3377909b907b15b65ced8b0be7833a
SHA512 0f76fcfae1b68aef470739f9648f0b283edc2bc2492c080ac786a4a1b66afd89a30db3e66e573944701dea75bc8dd694030e77061651ce5c0bba1b1edf5b498f
SSDEEP 192:idJKlvPiCfCA2ZoM8Mux7wkMdRu+Y8yHONqHVC1+eoxq/rDzOVndtM47UaHJ7lMr:idFCCA247E6nNm+ITDyVnzt17s
TLSH
T15942D0D6D6B43EA8E37D80FD3A9242E7B9057BE5E840110DA4167A0EF5052AA1B4E25C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 9a242d00b957bdd9f6271ebc1a82d3c025a1582554fa2c588fc0841ed2ff4f40
MD5 ee2637835c2ae7b9801d39734903d64a
SHA1 33b8fefb717918576be5be3629ffa724daf3afb9
SHA512 7c6a0088e08aff92b3a17a6fb8342c4c1e8769e9633ca806d0c7bdfd94462742c5a19a133b36295e2ad30c627db6d997c1ea8500c92142550fbf9b949e84f583
SSDEEP 24576:H3YgnJcRTk4yti+R5dBR/v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HIgnaTk46pBR/vLNiXicJFFRGNzj3
TLSH
T12645B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 3c33cdee070b30f7cb52a0571443dc2b878ff5af2cbbd202ce39659309453adb
MD5 b7ad48606dc5d4eb8c2b7c2a998e97b5
SHA1 6bdcbb43b0dae5da9cf65cad79738c6c75081df5
SHA512 43f33d451a29e70641788a6de61783cab0d20880a9c8555a61f7bf916c5db1083183b0dabb6117a1f9d9fbeafd251f0fd94f67d2c36c9c92f984d84373dbd97e
SSDEEP 12288:84KFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF55125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0AA7E9B36FD9CE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-191-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/224-378-0x000000000D3A0000-0x000000000D3A8000-memory.dmp

Download

memory/224-464-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/224-184-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/224-207-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/224-226-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1556-355-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1556-143-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1556-135-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1556-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1580-175-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1580-462-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1756-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1756-40-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1756-48-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1756-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2236-174-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2236-113-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/2236-120-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2236-118-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/2560-162-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2560-164-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2580-84-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2580-161-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2588-374-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/2588-158-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/2624-461-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2624-171-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2760-132-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2760-328-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3864-463-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3864-179-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4080-97-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4080-88-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4080-166-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4080-94-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4336-526-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4336-474-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4348-170-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4348-99-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4348-108-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4348-105-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4400-415-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-395-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-409-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-408-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-407-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-406-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-405-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-403-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-404-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-402-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-401-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-400-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-399-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-398-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-397-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-396-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-412-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-413-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-414-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-419-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-418-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-417-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-416-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-380-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-381-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-411-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-386-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-387-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-388-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-389-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-390-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-391-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-392-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-393-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-394-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-410-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-382-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-383-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-384-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4400-385-0x0000021ECF1F0000-0x0000021ECF200000-memory.dmp

Download

memory/4528-33-0x0000000002040000-0x00000000020C4000-memory.dmp

Download

memory/4528-21-0x0000000002B30000-0x0000000002B90000-memory.dmp

Download

memory/4528-6-0x0000000002040000-0x00000000020C4000-memory.dmp

Download

memory/4528-7-0x0000000140000000-0x0000000140691000-memory.dmp

Download

memory/4528-49-0x0000000140000000-0x0000000140691000-memory.dmp

Download

memory/4528-13-0x0000000002B30000-0x0000000002B90000-memory.dmp

Download

memory/4528-0-0x0000000002040000-0x00000000020C4000-memory.dmp

Download

memory/4528-35-0x0000000002B30000-0x0000000002B90000-memory.dmp

Download

memory/4680-429-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4680-167-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5912-80-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5912-82-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5912-74-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5912-75-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5912-68-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5912-76-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/6012-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6012-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6012-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6012-65-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6060-183-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6060-127-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6060-372-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6092-155-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/6092-153-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6092-147-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6092-371-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/6128-178-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/6128-124-0x0000000140000000-0x00000001401EC000-memory.dmp

Download