e175f937e64ab55334d6d01ce310019ebe1ad76da4f4e9a48270a8bcde477f12

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
Size 936KB
Sample260703-rb89fafw4l
SHA256 e175f937e64ab55334d6d01ce310019ebe1ad76da4f4e9a48270a8bcde477f12
MD5 94ced0105bd4a9aaee558842db9a54b1
SHA1 0be5c11361ac9c01a1bb69d73897ffaec48ac7c4
SHA512 0a88fb600e60093df665be23cadfd3314b8d149e9f6e38555643de8d82310f59815c30e1c584f5aec4b496bca044d4f4533a97c4f4534cbc96a3d918f1f61861
SSDEEP 24576:+Q7onabLDVBJdLBhvn/+h1xUgXe4i7ojhsP5Lgrk1TWb4AN5:b7onabPV3xBh34Le30jaNf1TWbdz
TLSH
T1D915014677E444F9E2778238C9E24B15E5B23C915B30CB1F03A527679F33691AE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5880	elevation_service.exe
3088	elevation_service.exe
3740	maintenanceservice.exe
5964	OSE.EXE
3400	PerceptionSimulationService.exe
5828	perfhost.exe
1156	ReFsDedupSvc.exe
3668	SensorDataService.exe
4192	ssh-agent.exe
2316	AgentService.exe
576	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e2d613b80095f6d.bin	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047cfe49af40add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000510aed9af40add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000687530def40add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a27d0adef40add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd319f9bf40add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb9c289ef40add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe
3088	elevation_service.exe
3088	elevation_service.exe
3088	elevation_service.exe
3088	elevation_service.exe
3088	elevation_service.exe
3088	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4728	2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	1156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1156	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1156	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1156	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2316	AgentService.exe
Token: 33	576	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	576	SearchIndexer.exe
Token: SeDebugPrivilege	5880	elevation_service.exe
Token: SeDebugPrivilege	3088	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 1992	576	SearchIndexer.exe	99
PID 576 wrote to memory of 4220	576	SearchIndexer.exe	100
PID 576 wrote to memory of 3688	576	SearchIndexer.exe	101
PID 576 wrote to memory of 5304	576	SearchIndexer.exe	102
PID 576 wrote to memory of 3492	576	SearchIndexer.exe	104
PID 576 wrote to memory of 5292	576	SearchIndexer.exe	105
PID 576 wrote to memory of 3728	576	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_94ced0105bd4a9aaee558842db9a54b1_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3740

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5828

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4192

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2964 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5416e72d88d9bf1d0ca95d0f84d18bb92414e15afa8796540e787db37eca6659
MD5 29c0c791899f04073ce1382f279146cc
SHA1 64c86ccf3459d21a986560a902833f5c084c00f9
SHA512 a635ac485de516354d4876b3a4305d9cc8d85194c0eb75b674ccc3d327bcfda6c00ca5c488d5b7fc2d539c556772e2c51cbbea8310d18a32377bccbde448e5c0
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7e30jaNf1TWbdz:p3q6HjB2U023W
TLSH
T11FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a9bd1a95110f1fd0f4f46943c9cf00f0083a293fc29683d48ec2e8069e3d09c6
MD5 235a30f76b8fd4513c739197dd25b2a2
SHA1 6087a0c5b436f46beb4634ea6417a7324c065416
SHA512 fb02a0857177c96039f4b19660122ec4f70069cc11b186fb0cdb90cfe3b2e0d30436fbe1f486fc086eb0a8ccad509cd3c19dc11d4cc36cfbaf7d7e371438e43a
SSDEEP 24576:2XYfDtczATgXe4i7ojhsP5Lgrk1TWb4AN5:1tcJe30jaNf1TWbdz
TLSH
T19105F12867D409F9ED67827CC8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 162c919e58475ca07a24b624d2760b8fb47e27a4f1cf8f252134ef92ee0772b3
MD5 1a0750b311f637a33a0c16183ddeee4d
SHA1 a7d7e069de582b952555d8c441219bd8e63eadf2
SHA512 5cbf925f663b05a2b51f9ec3594274c3c527d66e6b583ba38adceeaf4c607f1770fefa6230ee6818772b377db1fef2f92fe69c6cd5967783e304832edf1a550f
SSDEEP 24576:h0Le5ji0hmxirMcgXe4i7ojhsP5Lgrk1TWb4AN5:hPji0AcEe30jaNf1TWbdz
TLSH
T1BB35AE16F6748735D073C0B9C5D2A69AED72308257308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1ab5f50c7d40fa69f8cf14c13b93d851c64a80284f1c05b573708f31e613bf22
MD5 70225cdef53372022ed0f3e95e327d28
SHA1 b2389d29c03435a902e133e8075eb60543df2e69
SHA512 8adb75576790409095707ffd88e845cfb5bb8da99ef6ad6a1dd186de13e9abceab907bd3087b854f7109f667bc04b732249c412e893382929e1ed107b95f9696
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyuWgXe4i7ojhsP5Lgrk1TWb4AN5:N/ezSC6vUzPvxHjyYe30jaNf1TWbdz
TLSH
T142756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f103b7c70be2ec7a2439e6d40f0357dc385acd157d46421d8d2770f8e09e2d61
MD5 7264391876eafe69b7d2d611223d9005
SHA1 93f43904f075dab477cddc194f2dccb7bb07d5ea
SHA512 68faf07e2467452289c10303efd3a94441e876b48b500b9ebb1e47646ff7e16e584d607b58112740ab8226c8a24771acfccedcb2ebdcc32aa65ad25e284685c1
SSDEEP 24576:bVbqPb88hv/l+6vgXe4i7ojhsP5Lgrk1TWb4AN5:bVO88hXl+He30jaNf1TWbdz
TLSH
T1EF559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2c5c6f9e65bdedb4a23971e7d57882b9a4508939bb2ec1fe3cbfa89ffe23741c
MD5 14924d9f7400cecf77ce018e49d50f6f
SHA1 d7dbf629d292118370621262c8be9687b5fabd38
SHA512 f3354c1c52e2cc3d7ae12a24afc9ef35682cb3d705310cb3feb87e490a57586451bea50271dc92f4d657d3be2291e13f5adce0187fc497e8c6365180d4f34dd2
SSDEEP 12288:cR70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cR4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EEC423929F5409C6E38BC3F4A0F7CB91E5E11EC171444E6B47E0FE9318BC8A9DAD8069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 bd3afd9530e168eac1dc691fe4959ed315d05166b457ce6551632e64978e6218
MD5 2665606842499c70c1fe6861d29128c5
SHA1 7791c33784a5c5cd0e5b6148bde563adc426b2c8
SHA512 599aca2de826bfd0fc43e94f281cb8d3650df3a118537b6f752f6a206cabc9f041d264a996d251500c21e08948134425c285a818dfa4ebe1bf542e1816989352
SSDEEP 12288:ceBNUbTVO86U+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cJIU3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E705CF7BEE28ECD2C27A8DB85691C740E7B278704B5293CBD164C20E9E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ab5677f2f95ca939cf2845603c9169d71bfc43a2fd76c2309bc73499108ba8f3
MD5 d4f8dfc386367d9f6ace8b597479171d
SHA1 b60edde4ccd85970923d7596626c09302be9f622
SHA512 64c0106809b874abf3f54b7d5acdea405f33e5eef6d8ec4c15660bdbdd75dbb3dae608207c3f750528f1e934f0402a0a4dc92b7c5e1a8cc315f0894264de8387
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:OQvGAdlCEL8c/yRNw5CpU023W
TLSH
T10F267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f68c4c5aa120c7922138eb135cc93d94258c9b3a56316ad0fa12fd3f49811163
MD5 986f27ea5a20432edfd7c632aa7cf831
SHA1 706d622c3e6a0d71f2b840bd92ecf867518f4521
SHA512 ec7486b972fe7b2f02a6240f53f6fc2610bb6ca7ce959d819a44c2ae9cb4953a5b3b92c6401cf7057a9cef3784b1a702e7726d61bcc51aa33287d923412d66e3
SSDEEP 24576:+dewsAjJgXe4i7ojhsP5Lgrk1TWb4AN5:2lj0e30jaNf1TWbdz
TLSH
T14015E031FE74E032C3BB0DB21B76C712587C6A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 157845a41a15d45c0df7880d561c47134eb0c289a5696091205af62d9df485d6
MD5 13f0af4a5b7a3600196abafb0c3fc4c5
SHA1 167aef42902903f5a0e71d082b3e4e51c6a8d0d9
SHA512 707a1973ca9964262bd55c86ae357a7dad5dd7c08a799c3f1b7fe9d835894fb9974eec2ebb9fe36ba55b48777e27e9061e7dc553de322797a7581e9920670f83
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8p4W:GUEtQevvqc2W1cpV2EI32c4W
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f678105aa00d4bfee7cd7f21aa72c66558c00e23bfff0708d4437cf771fe4a06
MD5 4683168cc7110094b68a10c3f71d7798
SHA1 8a7378e0092e35d3b0e002b98cadd4b421a74b8c
SHA512 49f301fedfc0a97088c6fa67403178f741df8ad9958f5551bc081848949f88203acb82c62a5eacb21178ffa01f7ea2fa0b1b9bf4b1f4a022220f5ffbb22a0f3b
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zUe30jaNf1TWbdz:moqtVjnm9U023W
TLSH
T11FD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dada70d02e7b89edd4fe2e83fa3469731bd77762271ccccdbbf794a5d3576217
MD5 618c662a8961ed8cc8ffca8725cd90eb
SHA1 fa03bb0cd0205f88f786b6cb91c8fdab695d8190
SHA512 bf77562d7553679fe549060097e36a919d1c3e9d9785e5d5734baf4d030d8065025be74cc04043aca6b79a903d143e783c29e1e93cbbf84416d51c0e195e648e
SSDEEP 24576:bAhGLJIFoiwtA5l7S53agXe4i7ojhsP5Lgrk1TWb4AN5:bAMyFoiq5te30jaNf1TWbdz
TLSH
T10C359D81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c9d199befef1ffa04c8707f5eda23db7e36f97ec9a2e6450639de3ebd794ef5e
MD5 bc9b8a5d97b5875a5aff5eb871523851
SHA1 e9b289c2d0efa3bc49571f783024336da257dcd0
SHA512 7939b7aff6fcd3f580d5394a654813128f63f56ceccaf7bc196cc89eb36bd8ae3826aeeeee11f0015d76976631c41205ff186b917b3025aaa41a54d61467198d
SSDEEP 12288:lmw5HEjsChNVBFgl0WDm+Cp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:AwuoOWdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12505F14676A40CF9E5A78278C597C632F7F2BC412A21CB1F07A0C65B5F77261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 2eb058a80a17476ffddfa818ff32b14b849fda1c2fcbbe2ca7fb9783cc6a4402
MD5 9db0e90d67253014ea421c55cda082b0
SHA1 bda734de2311ed73caf71559d6419a66db7e95fc
SHA512 567abf0ebf1a4079b5a10fca63232d68cbc6d1a25e118c9eb49f8cf51ed8ae77ac3a2fd833dc7741b0073db040afc13347ee2d764428615d8e14e8faa0191970
SSDEEP 12288:PBZ1IyY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZZuEgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T114E4129637D420F9E2978278D4F68B41E7B23892233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a7e2f164b648e03c68529f6a309a65cf3c91f59ccb96a0c10ea9aad28e02f245
MD5 9ddc28a9fc2c55bd80a2317d072d43ad
SHA1 44468a7b458a7bccbd9f9c5fc6effb681615af97
SHA512 37e04e771c3b59b46734083096bfe90247afffdb354de614ed00187f0d6d33f85822f3a1bac29107fdd4e42ca7de96446813ed2bff4c67631dc9793e23456cd1
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:wQRQyi36YOcPQLvw2gAf+PN3iU023W
TLSH
T188667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a48ddc682168c1185a1c9b9ff90627cda71adf44c442286fd58048f0ff87e53d
MD5 6fb436e56397c9a7d60da57582150f13
SHA1 67a7b9447905df3dd51c3219c7238ce5f0a2fc4c
SHA512 f3d5af3bc8f53d41602acbca7b5778265d7958a86c752440b061390799d3ca79f7b565cd426bfeb3d980f1aa80c406a1c0241cb8d2222b0eb54c106162e9f907
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:HQRQyi36YOcPQLvw2gAf+PN3iU023W
TLSH
T1C6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6a9890a583ceb86164062cb04ed147de4304dc1189f5a4743d7f65f48a3effec
MD5 7ec66b686d54042f8c8baf94caa756d3
SHA1 de0efb23aa0b5e405953dd8070227219a369ae76
SHA512 110642dcc14c130ffd7601bd16ccb61b2677149627a717b87afd0b33037e3dcd4f7a30ec1e3b8033e09e44c92a704c16af856343b7de71889c3f98c10523fba6
SSDEEP 49152:G68Qg55nhheWu7PNU3/Ee30jaNf1TWbdz:kthWRc/EU023W
TLSH
T158B54933B2F20099C04DE1769F4A873196E27C758FE0E7DB855172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0c08ae3690c640ffb2ad361bb1eb4505fe879c0c9a2d4e7b4be53378dcd878f5
MD5 a875b965c767d4504b4937c5163a95d5
SHA1 610802a4d6ba61f1c0634c5a691e72154c08ca38
SHA512 bcb6967024c563b041ae0f35f19b603e955f20eddd3e1fac8fd1b2c4764306391dc4d362ff628cce86378cb12ed69950b75ec9afe77b72fb80d58c0cf241c285
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:4y5112gYy5azzVvL69nLKnhZPU023W
TLSH
T1BB168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1f075307a8c112aa7b7bbff11ee09a4ac49e0616d88d16ae06e65f3cd4d289c8
MD5 b51c6cb5fc519b7609aad343c0df5023
SHA1 e5bf8e88fe64b4146eb300d8451823b2d3b167a4
SHA512 c7e9cc84e1ad6fd367985a2f4ee52e64e4c7cb4cdd26e78563a82af7cb73a813402564c745ff380f4334e08d978d6e4cec6f1eb58bf5668de4348a15e4a714fb
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6e30jaNf1TWbdz:ou6JmVxd2d6U023W
TLSH
T1CCD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 28da9f3ecc595cef9909f32aafd8a6f954c508a04872b0e297503b6c04794092
MD5 703f18e136c4cea155f6b64061bebd0c
SHA1 e2eaff75cdc2ce55f290736fb8400d0f00d39c4c
SHA512 6642f3ebfbd6a14062cdbe508d60fa44698a0591ac97213875fa894f59f0e97b3a940a5f8ad1794289f71ac07c207887dc98f6a618e321a3ded03fb02d066628
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xee30jaNf1TWbdz:DmifPbR9U023W
TLSH
T1BDB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fd59d3aab92c490c4384ce205250d7333eb06682171ba721425dbba288d33434
MD5 b678bceddff1c1560c4db4dcdb4ca140
SHA1 d05f707bf44dfa3e5aa049dcefd60a04bba5c42d
SHA512 27de9677ba38ce3be8e25b95906cf1d287a1e1dee268c9fee1027556c1801f0cf146ec2c1c9975994836d69f1585b2a4631490ae22f8011c2e99fd9382f9a849
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqre30jaNf1TWbdz:S5dKTi61rU023W
TLSH
T1A7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2302efa8fdba39792a22c4772c2cd440506f3954142af2b0dc2f907e281558aa
MD5 f7524cf5939339596cb0e096848fb585
SHA1 5a30e206113decd011be256501b4216b3eb9de1e
SHA512 675fce7d7a9ca396e1ff27e65c2323728c7db70c879f1c61580ffeecd7879d5189c32ab8a2e39c3d32fb5bd0ad4426cf30c53803a585272a3ae8cf79d77a6f9d
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wqe30jaNf1TWbdz:zX2iyphRU023W
TLSH
T17595BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b6f00823c37473d7bc76f4875eec3d6d3ef67804e9a22e7e1938bb743d6c6f30
MD5 14cd0cf1c08402f7e1bbf332c67e68cc
SHA1 a37aeb026466d219db27b14b888372c6ce43e6cb
SHA512 80ad9e5c0fea563e7ba00494c57e078189c89cf98750dc1aa9bd9427dcf5aa82720654f441be2abbfc8891bea482181a4daf2ba97e0dea52ed9cdbd1ea1d6137
SSDEEP 12288:Mj0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MAgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C2C42395AD5509C6E34BC3F0D0F7CBD1E5E11EC272404E6B17E0F9531AFCCAA6A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2135269c598f7bbe24918e413563642a2cd5f86c6a242ea78db47c9eb6d4f2ab
MD5 40ed27d19a5960ac8718f633cb1bacc2
SHA1 c6349e283ba5a1f0300b7887a1457589c8c39ce7
SHA512 c7abfd5b27767687f636198f8cc47814bfc70d7a587c7e3f063830e8efed5fa19b66796495ad4a3aae7b064af2ccdfd07fde00cf5ebfa1ca94138acfef8ff03c
SSDEEP 12288:tU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:t1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15CC423A5AD5509C6E34BC3F0D0E7CBD1E9E11FC272404E6B17E0F95319FCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 1755312a4b7db4ca52b3b7d28a666a53ee9a95aa30f4ae32964d5bfff2977bbe
MD5 afadf61ca8febed14326edccac7452b8
SHA1 ab6e52eb06c43b9ef93387a8d57d4b06d278202c
SHA512 8d80be12d453d1ed1371857d9c45f37d42acb79588dc44f10f4e5997b208cd20d1d022b4be1456abb1ea9bd657f04ba724eb74a791afbaa12bebd709dada0af8
SSDEEP 12288:YG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BCC42391AD5509C6E34BC3F0D0E7CBD1E9E11EC272404E6B57E0F95319FCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c7483a1ca775dc9c6de60d5933f23a8ec7dbbaf06ea57c676dfc391dabc6d549
MD5 a01f774a5f843c8b596dc7ee4e1e7902
SHA1 faa3c403f4d9d01e459bf7ad26a5568f79e9c868
SHA512 96bc903ee8850d31f428f7c89f74912248c356446a2779c4af47d580f0b3650135e82b916cb1b27bb573dfd9d821d07d5cac8396d6777e55a3959f6ee5d416d3
SSDEEP 12288:pVt0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17AD423926F5505C6E287C3F4D0F38791E6F13DC173114BAF47D069530EB4AE8AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4254e32f79843c2b08dae3bd1c197f7bd8dff376be839d453e633ba7e0214ce4
MD5 a6fa24a93871fd7d3b253351743a6d2e
SHA1 0bd8bc4eafe06047f7306509d7628de03cad8fdf
SHA512 5ed0a950f59880f96e588201ae6ce3b3c83d1d49c7749bd2a8d84185362f3535131e2c0f2764edd42fd474e902eb346cfa1e587ed0727d2c411e6aa3ef20b4a6
SSDEEP 12288:Vl0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14EC42391AD5509C6E34BC3F0E0E7CBD1E9E11EC272404E6B57E0F9531DFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b79e2743f218ca40ea4a2db602fd1c2571a08059f87faed139e7f47806ac70cd
MD5 4b6e2420243757775b9dda3c1ea77b5b
SHA1 0fae0e04c7739d8e498fbee804ef5735c24a8056
SHA512 487dbbd43e8f2f0cb64baee96420e5c332efdfa55edb398c32ad55ed2fa2bb457daef9ec08e1a392569770f6c91f9259c8f9f9adb6ec1ecd4f83c01e994e4c83
SSDEEP 12288:1w0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1RgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12EC42395AD5509C6E34BC3F0E0F7CBD1E5A11FC672404E6B17E0F9531AFCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 dfc1c51fa5ca65d22889be622d51852023f9044c8b3593d71011092441ac0161
MD5 acd85417f24d8a737123fb2c3e5a00ba
SHA1 6f570a37ea7299b9709c2e82ce6a53ca1ee34e51
SHA512 69206944923b443a354f0011cb2e2a0969c0c4ddddc9a83ea4438ab78b14a10fa0ba7a91aa1b7a8ff0594c4f11e3acd1d6bd97667fb37807b1087749a252acc6
SSDEEP 12288:Us0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T150C423A19D5509C6E34BC3F0D0E7CBD1E5E11FC272404E6B57E0F9532AFCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 9814fd59df2cf0ed07a7a9310907309ea25ed93a944ea4d8a24db2df7ca46359
MD5 7634a9c65a0519bb675cb51b32c110ca
SHA1 7af815765b9cfff4ef6850a1e65a707c05e816d3
SHA512 c3a4bef334a6630336d8c3c4fb7cd3e9ecd7b48e2787f4a45222245c9b12cd42beb4a20286693759bb175940320b203245be73c5c5cf21438d4c0943942e47e8
SSDEEP 24576:YZMSzFVSOVgXe4i7ojhsP5Lgrk1TWb4AN5:YZMSzfce30jaNf1TWbdz
TLSH
T1FC050195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03E436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 286ea022f1291badc1c96fcca542a16e593e98e39eedb5d777e8a4dac8aecbea
MD5 06e3d0c03139495a9641d4248c91100d
SHA1 a649e1320cc21aafb20ccc14ba9d0acad3234e57
SHA512 f9a1e8805e7055a3062883bb6a5f594baa45f530ae118ae20061ae0fc12a7c52b0d33700fd70063c460e702d99d6bb7548aa9c9e327597ae4631ce38b2b52480
SSDEEP 12288:zH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:zUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T128C42395AD5509C6E34BC3F4D0E7CBD1E8E11FC672404E6B47E0F95319FCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 0cbd08096b49438abf2e66522be2c7a37f6bb21ab75bbc614c057fd5af48cc61
MD5 6d14dcee77aa9c493a73aa7d10a62293
SHA1 b02f1cfc3d6af9c621f0c637116bce732bec3963
SHA512 2bbb826fcbb9fa02354bd84574d05e515b312ea91e7a702641d4da6104abf171158278bb643092d58b566d02dbc1d014528ae12eb7e0d32c51becd722c285ab6
SSDEEP 12288:cr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B9C42395AD5509C6E34BC3F0D0E7CBD1E9E11FC272404E6B57E0F95319FCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 2826f631c36990cc73e88f0578d99cdb989a590cdbaa1d163ae246fa333184ae
MD5 80df1f613056513fe898d02a2543678c
SHA1 12ced8485bca135165b0884b98df232eae7ddca6
SHA512 99b944651d9df22de97172cb12bd0e979a418945e34ecda6138444ed7ba73105fa48e94d35ef06681a7373b09e84f74f5b619ef53adbe735a2b533088a9bdffb
SSDEEP 12288:xyPz5L8Y0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gzyZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T164F4025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 b65a50ce9bdf778ba07e92622bd0342647b38334871f72022a1ad5a713fa0d72
MD5 86980876ddf24ebbc8a1cc3cb0a708aa
SHA1 d712c6ff65ed14579a3d7a792c373b5d6f7413d7
SHA512 110926f3ca382ce76662c939f868abd22f44a12ad3cf333f48be1d0e078a8166e223095733e4dc046ed98b26266579ca09be420077752d3a95f669871bdcd9bb
SSDEEP 12288:9H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9UgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CDC42395AD5509C6E34BC3F0D0E7CBD1E8E11EC672404E6B57E0F9531DFCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 42419a72760cc54ffa117ec514fa3c1707d93ae2e4ff6bf57913be0f0e824ad0
MD5 fa711714e7dfeb10da2a820ba842f6bc
SHA1 ad5288425be09247fff42c131a87e18e004b8bda
SHA512 ca64d0f5d98cfb9835cb6a9773e00fe786b6732be33397a1a98ba658b1bf4c7a9119555c1039e86be41f441fe48f6029d11864ac9aa2ab2e199ddc957dfd2d1e
SSDEEP 12288:IH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T183C42395AD5509C6E34BC3F0D0E7CBD1E8E11EC672404E6B57E0F9531DFCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b519b4158e57869593b42e6c52eff96d6ff578d6a8e0d2632dfda76a91a7526a
MD5 32177231da508e24d45c571afed72480
SHA1 29a005199b2480aa1f608dade0fe9ae3b9c545ff
SHA512 a214bb0c723bc466466744072f2244ec75a6f92e7154b1a58f8057e516938864918e02b0549b584b60f7390184982437fd1bcc307617aad9053d495a750258bd
SSDEEP 12288:yyPz5L8Y0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vzyZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A5F4025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 28277e8df3a5cb08dfa32b12a58e490ad9e7f9de7ea832be193788e556c94e36
MD5 10f33c48e770dce55af60bebae744b42
SHA1 793fcfd989a9325922b7cce915cc6b2611a32fed
SHA512 ffce0c18f08c2c3bfd46918d1e7e869106513349569a1b5ba77cb7f5144035a495f51cc40b434ab21b212fe6af922ef54996b6c32b5e586c059f51fc9b56c4d7
SSDEEP 24576:3THaLl3z0zDPgXe4i7ojhsP5Lgrk1TWb4AN5:3T6Llj5e30jaNf1TWbdz
TLSH
T12B0502A5B3500CF8ED67827EC8A68A02D6F27C561760CA1F03E436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2c94123fcc29f824aefa3cfc845cdbcd51f69973703c1a08461bc287ebee9d8d
MD5 fbc91ac5957208baea08384e1a615cea
SHA1 e746ca14e5175ef0d5ed1b013f43f7da362902f2
SHA512 79099f595d59160424919eee74e35380529900e6e95084c74ecc42f5fdf5eee7ac87f6caef4228c43908d59d3d8457aa29d6074357845801aead0cecac59689f
SSDEEP 24576:F37d9CHKy7GZbgXe4i7ojhsP5Lgrk1TWb4AN5:l7d9CHKyace30jaNf1TWbdz
TLSH
T1A125CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 c72d098ecc91a2c7b7ab490f41d87d2ead7daab67ffb194573f82ff5b6e85193
MD5 89d2d59207abd05870766d7be62f6c38
SHA1 460305db6d0fd66a5c070e2a3f94c4c113eadf90
SHA512 6552b2f3c2048fe0418871a1af41c48ed86fa85dd51f6abf792d472e18f72c42bd1a1a676de1c0a4721b15751abe560449be874894efbf96c76edb53e5629e3b
SSDEEP 12288:Xm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:X/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10CC42391AD5509C6E34BC3F0D0E7CBD1E9E11EC272404E6B57E0F9531DFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 3595dae04f2ccf7c1f9653d0d611a77a558f54da18183948cced968a1e6a4147
MD5 21dc93dd9843df5dae9731bb84f96f8a
SHA1 2bf55527c8e73fb9e7070323c63a3553d45d16f4
SHA512 63ea3920c6449015c691e5a35ecb403dacc03b7ad87cd2f7bd283ea5a22c72efd77b76eb27ed0b69874913c7b5119fa9ed9888536f0ea64cfbbc23c22920fb3d
SSDEEP 12288:V40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:V5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E8C423A19E5509C6E24BC3F0E0F7CBD1E9E11FC272404E6B57E0F95319FCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 737e2a159647109a589b17e149ef5697b0ec1b517553f25860c0ce0821ee2eaa
MD5 c2517af3f677f27deb952c1860f67ee2
SHA1 33fd7848bfbfc800aca29efc8efbebb49bc00a2b
SHA512 c7313953939544b84892c8e5d25f33135331e650edf62659946592b2ac440bb0b69c9bc95d63c6f4529eb07d42184758928ce32e19777b0df1441a626c8f329f
SSDEEP 12288:oh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T192C42391AD5509C6E34BC3F0D0E7CBD1E8E11EC672404E6B57E0F9531DFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 de856313c87cc643a9c06be2b5a21a399f28afaf4d4f58960163432de724c4b6
MD5 4746c064f3a6c006aceaa99edc9802e0
SHA1 148be7164bb6b239250d61fb061a23ea40f82ca1
SHA512 6b16460fa691d893a8b67040dbaaea4720a323bd45a84a9314d95e4110cdf824c9f1672e70abd7cb19a3f2972d0dc509c741ef2b65e2ddb320cce5e8b7ae8e7f
SSDEEP 12288:YH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T175C42395AD5509C6E34BC3F0D0E7CBD1E9E11EC272404E6B57E0F9531DFCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 b0f34b137e4ba2607147b2491fd489ac94c4026dd0978ce6e21a83bfd3c3bbfb
MD5 fd260614f7b903144f577a2fc7ab3d7f
SHA1 ba508a2a9d975f8b25109a1bd27da6d3b1b8f6dc
SHA512 4dae59ad4dfdc994c412cc28c5722d2eceeb4b8e469e7e2c2835d56171393b4b5a59ca1caa8ca31214e757b22e9e3c75e8ea1d1b9f195aaa05d1cd1c3a15ef96
SSDEEP 12288:wm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:w/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12CC42391AD5509C6E34BC3F0E0E7CBD1E9E11EC272404E6B57E0F9531DFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 7ac1df385ca38a69f60e9766000e6e0162f8d006788ef48047103da524f1c3d7
MD5 055ad48ebc98fed212c7cae893c247d1
SHA1 3a3a4ef1b074f4505f3c3cfc88b3927506f17cec
SHA512 427719ac933c29735a90fa21d0f8dd83cfa97a77487852a6cf5beadff5e67f400aeaae174ac771fe6b4064f8bad8e7eece4106bfd6d796a865a7a3d6eb8a9c4a
SSDEEP 12288:af0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E4C42395AD5509C6E34BC3F0D0E7CBD1E8E11FC272414E6B57E0F9531EFC8AA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 29697856efe2a21e4d6da9a1d6821df006b15553e432447a7c4b66a7c8f4ec64
MD5 ad134c74f1c1b98700256ebaaddbb9a9
SHA1 f4ce6d33c17039cd0bbe47cd16897378216421ff
SHA512 f863a94b0a939e18b06dac433a1c5ad561c6ba40ddfb473b894e1151faf188e180e61cd950bff2bec6d50da2d86e48d4e07d8dd561051468bde1fc2dcc7f5639
SSDEEP 12288:tl0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DAC423A1AD5509C6E34BC3F0D0E7CBD1E9E11EC272404E6B57E0F9531DFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 14ec8baf39146ff27d27a7d6343449cccf25983f36602cdd9ed6009388344fee
MD5 0e7e5650b0a7ac318af1203e7f99fa3c
SHA1 3f86487a35433465aa533c8ee9dce26ade824b08
SHA512 2faec1a5ccb0a400e4f614631445ec774f668eddd4473966c303ceb65a1cd7d08dc4583b9ce10ed472372921e4da3e9dfe5bc79ca2070402acf0621341bd8df2
SSDEEP 12288:Lu0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LHgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T123C423A5AD5509C6E34BC3F0D0E7CBD1E8E11FC272414E6B57E0F9531AFCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 fa2aeda9f566706318b3e4bc8ea9ab9ffff81f449271ff2d15b7209fc977f6d1
MD5 8db668a37af354dc5e58fd6d8bca529f
SHA1 3e04fe26eb34e9346c05faa5a05f3396f58d3e71
SHA512 e42c7087ba78cafcc7ae2cadba8da7927a8003b71faa6fb291c278b8389e861e870876243e584e9a0658ee8968ef40aa1483213dbe9a948b54719a42a7bdc48a
SSDEEP 24576:Rfwvok9RX6wkyAIYgXe4i7ojhsP5Lgrk1TWb4AN5:3MnYIve30jaNf1TWbdz
TLSH
T10735DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5a592cd262aa6f7e8fe7e8c3eeebe0158aee4a07b5deaea781457460674b4cde
MD5 2ad1ae347e1595262796b797e9e3ce6e
SHA1 c0c1f59e1f8cb9a7a345bc6b0ccae220fb1dee46
SHA512 7f7e0624ed887c30abbaeb3b75e5a21a8db111f3c0caa1d69bafbf2f17fca05d98aa5002c025606c24f4a9676d2a05c1ae0e64e931ffbf225f457e061496a9f9
SSDEEP 49152:eYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ke30jaNf1TWbp:QySzPCU023W
TLSH
T1A8067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1a9004991f1a590f24082105ff673b68aa50d985ddb0e54a1753588bd203c0be
MD5 acaa81a2da71d2fed14728315086a956
SHA1 0fb4ad8396c2fa798165241e41645b3727acea23
SHA512 6281a783d707ae07ebc3bc158c5f89c9b2c2489fb820fa34b92fb4f5251b4123f769daf62118b0858140a578d49757152afdbc1e2f2714f8a320a29992fa6812
SSDEEP 24576:u47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYlgXe4i7ojhsP5Lgrk1TWb4AN5:u47JUQj1irIhCnDHUPfF/6e30jaNf1Te
TLSH
T14865AE1DA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0db4d3b295a16a01fac213d402c02b60fb97c5b952cd286eb4a0234f1fbfe2ec
MD5 3204f5b41e7d6228ae6f678eb539b96e
SHA1 8ce6674f908e12d59f63b5c8d59ea117ecba8b06
SHA512 57e00cef6773b4cc590c633740d0f9807b80a4bdbf8966adb0b3faec73c15b8fcd5d3983d308c8f5c57e64eec5727f3a9f1515f82c9a8644b33dcba9e3e33552
SSDEEP 12288:ONsfX0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3EgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B6E4F15AD29802D8C16E92B5C3968A41F3733C5193E1C7CB13D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 799797251c42ef1ffcd5e427f25507af1b9528b734cc26edf787ec06519e5a68
MD5 1bd015759382b89987b5afe049b86d64
SHA1 35077a28d39adb7cf820054ade279547699212de
SHA512 2241a95eab5bbb9285ffefa7870cc2b5b15510a6d54404521f36ee8f18d33b34e6f8a2ee4a40bd6dc24b4a8ea6fa319ad4277c2516f005425788ec9507d070d4
SSDEEP 24576:Z4wuUPNOG6yqIMWvBqYf2guaRM3WvRyhGX:juUVVg+BqgWaRM3W5yhGX
TLSH
T1DB451601B626C78FC6A950325E32D6CCA7707D41FE04AF1773C9873F9476658BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 4d66f1f76d6f0dedec5456427d697a9c786b8aa07f03cf8e54e233cc07a4944f
MD5 b9daf123bd331d69a77839ceac53f428
SHA1 137836b9a0158a707e76b1661cdadcde56550171
SHA512 967d086dc4620bd3425f841de4a375c997b4d45b57ac49f76ad8fd2e4db21af5a3a9aa685a8b5edc726f22444cf820da6872d1db665c551eb8a46f8594078dab
SSDEEP 12288:mkKT7jgR3Cy/MQ+R0D6Bxj0+/fL6VlKAvyXFvpPthUHWjbQF6KhZH+Dns42a5:m9BR0OrYmT6VMAvIFxvKhJ+rs42a5
TLSH
T11F450801E5B7E34FC96A9037073296CE7B745C02BB453F057344893C9867AAEB6E6392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 cc1b5363af3de72324032e391b10187277a6305f182656cda7491ed7edb11c8b
MD5 ed1b0c75177b738c4dd9a8d4027fc019
SHA1 45d910c19b8aeceaf0c868e6db275dba7477c205
SHA512 a4c852ec8c78ef0bf740f953b1718fd17864983bdeee8cf27d0645cde8fc2b04c406503ac91e1d0a752e810b5a73d83b68d6c0ef30942dcfc500a787ae9da0ca
SSDEEP 12288:PM7v0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:k8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C0D423629F580DC6F29BC3F090FBC760F5663EC1270089EB56D0B69329B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 34befd109fce5c03e22f307485647f45103b661b92280f34b124f35efd4bc39b
MD5 101da30d445e35032cd9326cfd561dfa
SHA1 51e69e8558eb227e2095c1e22c0c5af949f1f807
SHA512 fadca886210d9f7b8bf0b07df7d6ced9176651bc19e7ba7d5b7fab8ad70c54c775567bac19dd3563164975b7efa7e57e512f1cc2885193ef35e6b44a223e86c2
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYWgXe4i7ojhsP5Lgrk1TWb4AN5:Xgb4mBIBhGFwe30jaNf1TWbdz
TLSH
T10565AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 09e143292ce089ce7f06f8c6dcd022cb7885fdc2bc56bcf4baaebf1359e14450
MD5 401602172886637a2aab27a71162f8e5
SHA1 886a563e8d154b3e016592b1624e28167f81d570
SHA512 2b1a370bca87e50d7ddc6db68efc6489788b496d4e09eb2674f4e184d24b702142d6e09d862111d4698a274da8d0417d22c523ced51e14a6d273612d8a4d638d
SSDEEP 24576:MG88u8FpJqH1bzria7/mVgXe4i7ojhsP5Lgrk1TWb4AN5:v7ZFPqVea7/he30jaNf1TWbdz
TLSH
T1BB35F16576E101F1D07BD138898246A3F6B2B8151364EFDF07E88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4d9890f5e7dbe0620be939cf7c2acbb1e236d18b994535d7572ae85563994e6f
MD5 26dab5926175efc1fc82b4d90269569e
SHA1 96b156f234d28641ed2e5f2d8afe367eab4d3dfd
SHA512 55953d85b742fcc716b3e5aa94122c8bb756d9c438f8bf29ff92a34b64240f83aa41a77dab06fe7820467a3692b8fa00c9840d08e6ac842a3d4f059389f4d242
SSDEEP 24576:JPUr+NQhgXe4i7ojhsP5Lgrk1TWb4AN5:JJQce30jaNf1TWbdz
TLSH
T17605E12F66A818E5E67AE17C85828719F7717852131196CF02E0817E4F77DE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 38656428f5c58469a4abdb21732637f2385b382d63d091451a5be7361571d524
MD5 881349ec96fb534ff57391a38dc7238a
SHA1 a7c62e8e2fc4ec17a07e9a1c61a327e7a89ab085
SHA512 abfef6bff817c04bfbe92864d0da629e91e5ca26d65421f2ef0876f2d3a4b30e0b3ccd627f2a5f0479969045ba07daa6af79b1b9bf7090850ed2dcaab1eb0e90
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjse30jaNf1TWbdz:9G05lO43b3U023W
TLSH
T14CD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6ddbfa4890582b9609103b504fdfbffe389fedd28523420c12100f83b7928f8b
MD5 d70ddd393b6293ec0881dd9f136a8e22
SHA1 89996dc6e7ccb23d354dfb996994adea7eb4cd70
SHA512 17fdbbdfde7e29fc760240a7fd9dc3f52384cb06e6d870693c77085df2b2841b5b59daf83155b88443b84e987796befb7d23bc727305f1684ffec069025749c6
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnzgXe4i7ojhsP5Lgrk1TWb4AN5:ya5POZ3+Jt2pasx2+mEe30jaNf1TWbdz
TLSH
T15865AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a54a625c54cf6d4f69befb07f3d8edbdf662289437b9362ea6a9f24f4533aa31
MD5 5cc68640cff1db20208a47fde8aecbfd
SHA1 afccf09cd01a68e3913fd7496c27dd0a32b6c703
SHA512 23af0a7bd320b854caaed43653845ca23b4cdfc99415848304dbd72e693aa8884b1e4bd5e630ce2f00b20dfada3a1b5537e4970763a7ca7a0051aa3b6cdf9a05
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7Fk9gXe4i7ojhsP5Lgrk1TWb4AN5:GNc/zEOVHFBe30jaNf1TWbdz
TLSH
T10C858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 010f936545f93a9b34ef3c73e7495f0a3ec9b346bbb45a87298735ee88f9029a
MD5 3fa94b3e45a9420909c789afe1cc3835
SHA1 01d01829e36a17c1ba37fa46883ab68a05814d76
SHA512 4fb1c1bf7def1a436c0161720a7df5fae5356ef17ae2ceef7fae2aab0cd063f022e176f3d48bde507b9961dab7a868a01acb32d3fc09ee23e225799d3055e5b5
SSDEEP 24576:c8kNvNnaFeYhJNtmZBmHgXe4i7ojhsP5Lgrk1TWb4AN5:c8MwBtOmue30jaNf1TWbdz
TLSH
T11155AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 2f80cdca04695f3a76bf4795073647e53225f1fd67e86954c8e099b2b6b1d63c
MD5 2d8e888a4e7e699cce6456bc49b71823
SHA1 532495b1da2ce46f821c48b3f268c50b640d3d96
SHA512 3f6b2509035f82d501124f1ba1c2abf285b932bea5ddce87fe5334ecbde0db5a9a584865dc105caeb916b7fe94f23bcd6541277c72559dd8d2d7834d714c1f22
SSDEEP 24576:9D3FHshBIYQgAggXe4i7ojhsP5Lgrk1TWb4AN5:9DVHeBIAAne30jaNf1TWbdz
TLSH
T13225E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/576-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/576-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/576-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/576-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1156-381-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1156-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1156-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1156-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1156-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1156-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2316-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2316-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2316-133-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2316-127-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2316-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3088-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3088-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3088-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3088-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3088-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3400-72-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3400-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3400-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3668-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3668-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3668-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3668-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3668-313-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3668-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3740-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3740-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3740-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3740-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3740-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4192-120-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4192-119-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4192-113-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4192-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4728-0-0x0000000140000000-0x00000001400F8000-memory.dmp

Download

memory/4728-86-0x0000000140000000-0x00000001400F8000-memory.dmp

Download

memory/4728-320-0x0000000140000000-0x00000001400F8000-memory.dmp

Download

memory/4728-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4728-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4728-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4728-317-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5828-82-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5828-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5828-77-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5828-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5880-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5880-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5880-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5880-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5964-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5964-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5964-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5964-306-0x0000000140000000-0x00000001400CF000-memory.dmp

Download