e51cd2e60131061fb4baef881bd90424365eae60d938b2928e6975246c3ac5da

Analysis

max time kernel
137s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260718-krhcbsev2q
SHA256 e51cd2e60131061fb4baef881bd90424365eae60d938b2928e6975246c3ac5da
MD5 107604831b6a8b5da8f7ec3819285eca
SHA1 dc3d16770a2759944ec0dfb5cb45e814ffb11169
SHA512 1646b40e183a98f7f45f3a5d769cbde2a1013e254fad9e08345d66f9a34421bcafc1c19ee7e72d7aad79ebc23f758de0325bfc58bea9442abfe33f2e6c9e59a5
SSDEEP 24576:t9oH6ThNF4Xx7APlt3qs2MpfvlY1D/fjxX:noHGFEBAtBqBMFveDTZ
TLSH
T11835DF48AB4440E1E1B6C27889535902F6717C105B71DBDF13E8E27A2F77AE19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
4228	alg.exe
5228	elevation_service.exe
4364	elevation_service.exe
6088	maintenanceservice.exe
5756	OSE.EXE
3764	GameInputSvc.exe
4592	GameInputSvc.exe
2188	msdtc.exe
2256	PerceptionSimulationService.exe
1552	perfhost.exe
3712	ReFsDedupSvc.exe
3048	locator.exe
4356	SensorDataService.exe
6088	snmptrap.exe
1364	ssh-agent.exe
4412	TieringEngineService.exe
2840	AgentService.exe
1808	vds.exe
4076	vssvc.exe
6004	wbengine.exe
704	WmiApSrv.exe
2184	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c7a2f80f238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4592	GameInputSvc.exe
4592	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	936	2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4228	alg.exe
Token: SeDebugPrivilege	4228	alg.exe
Token: SeTakeOwnershipPrivilege	5228	elevation_service.exe
Token: SeTcbPrivilege	3764	GameInputSvc.exe
Token: SeBackupPrivilege	3712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4412	TieringEngineService.exe
Token: SeManageVolumePrivilege	4412	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2840	AgentService.exe
Token: SeBackupPrivilege	4076	vssvc.exe
Token: SeRestorePrivilege	4076	vssvc.exe
Token: SeAuditPrivilege	4076	vssvc.exe
Token: SeBackupPrivilege	6004	wbengine.exe
Token: SeRestorePrivilege	6004	wbengine.exe
Token: SeSecurityPrivilege	6004	wbengine.exe
Token: 33	2184	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2184	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2184	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 4592	3764	GameInputSvc.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_107604831b6a8b5da8f7ec3819285eca_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4364

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6088

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5756

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2188

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4356

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:704

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b4dbbb1f2d615d0ac3fac2861e247e1ebb4df3b3a863be02554b2648b34ebf9d
MD5 aacf8064c486a6d006b2930e315b2d58
SHA1 2570ecdbebf23fb363853f9b00976796904ec9f7
SHA512 b1510a01e6ba836aa639401c1bb1ce9d3375b4c0f46bebd1f9bd3d3ba78856eedcd08e3cb9c234425f3be1b9b447b6943d45be305d5fc7ead02fd0a29cafcf9c
SSDEEP 49152:zIR632BuPkFKRrdE6oh7stBhuXjfS4LWxnPBqBMFveDTZ:H3q6gjBoBqBMFveDTZ
TLSH
T102D59D03F29900E9E06ED178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 00c0803208d2a80fc56075826e16742d4779f9e99e5a0b2a48d201af11dd7271
MD5 cdcaa39db87cac2d2aef850231a4a21c
SHA1 1aba3c766f8d442b6fae6842879f087fbeae21f3
SHA512 178a2a6e556b6d429fa43143203e22d2680c81c2b919b5ebf26e9258277fa0da9607fdd1e901d643f11cdd0974dafbd4e6749244a8a7fc80f33453d6e788c79e
SSDEEP 12288:p1XLs1MC2x1ExVz2czA8uj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnZ:nXY6VVczA8lt3qs2MpfvlY1D/fjxX
TLSH
T1F8050128779109F9EC6B827DCCB28611E673B85047A0E75B03E495691F237C85E3EF62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 077446d32698d7fd4d0939db2ae966c1baa5ef72e775156fb00f81bcd2bda2f4
MD5 9b7147aef1b50b42a4303434782e5e38
SHA1 1605e3bc5a1907081a676b25644e3d53d76841ab
SHA512 11c31f4743e82f892e5ddd3c8aa742931b223c1410182f35e3099ef222bf3512ef3a2e893fbcf112c6fbe2adeac6355be851331a2c0f811c425d3725f0bd3f2c
SSDEEP 24576:B0DeXWe0hgxOrMklt3qs2MpfvlY1D/fjxX:BJWe0SovBqBMFveDTZ
TLSH
T19635AE16F6748335D073C0B9C5D2A79AE97130825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1fbf35b48806bfd3dd29e50350e44620d90d46b366fd62194bd99dae6d60c85c
MD5 e0815a2953698782d92b00d3dc7a1965
SHA1 84efdc64ecf55509991109734d89bce773fc8477
SHA512 1a66efe024188e418223b95d4cd2bf700eb2f9bb59f14f2d91257c135e4dc5ca1623db697a145302833b9fdb0c5a7a4e640133f146f12694ab57d3e32f231d7c
SSDEEP 24576:PU4/ezSC6vUyD/aqgrvW/6q8wyuklt3qs2MpfvlY1D/fjxX:L/ezSC6vUzPvuHjyZBqBMFveDTZ
TLSH
T179756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9699a6507ccb0e09a62b2331ea01f74933dd8854cc590cde6424f0a5fab5aecd
MD5 16dff09b5472b14c3b0709c05b4df022
SHA1 7c6b6d5dc17ab4111a815340202a7dfb51d14e0c
SHA512 aaf4705bbda2c4815edf078bfb63c55a83d778cc619b9922f5f27c6474270ec9254fa99cbb24568eb18725999371f88b9d6fa47e9ce3c3c15560f6767d387889
SSDEEP 24576:vAbbPk7QIv/l+dwlt3qs2MpfvlY1D/fjxX:vAc7QIXl+IBqBMFveDTZ
TLSH
T125559E66F6748331D073C0BAC5D2AA9AEE3234415B31CACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 a0e9aa03d438244ff8a9b0a6172ac3f882d2c9a2ee0fcf84a0464a12360714a1
MD5 c6e23790dcd56660287338b54f5cf529
SHA1 947e4c3c6bce37c9a7c05699081ae4143b12feba
SHA512 81f23c324326deba172df55ea6d998acd57e7acad7ed103141beb4bc4d6e0b84e31af401cc318157537065641c332e9ca751d22addc73959f8df812f293cad5e
SSDEEP 12288:QC1Fuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:QC3lt3qs2MpfvlY1D/fjxX
TLSH
T1A9D423409B0316A6E77D46FBBD7E6725B0D0B9209883C530CFABB1A95C589C5E0D5C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 5dd7b1fd0e23dc64dee13d45cfda1a680d6d5eeff69e595b1896ff107f7debd5
MD5 10f6d7affbe00046945c405a73a791cf
SHA1 76874b8309212c43a4747fd49c9b104ebbe97884
SHA512 214845be03f314c9853a3e72f8348c84379100de33640d9e84eb4f35dad4eb313a3a58fe19f8c55a5e7aad4795a727637b11f3836ec1e6cac44772ec2dc446dd
SSDEEP 12288:WeBNUbTVO86UZ0uj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:WJIUZ0lt3qs2MpfvlY1D/fjxX
TLSH
T10315CF7BEE28FCE2C27E8DB95A918700E7B274304B5293CBD265820EDE135E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 38e75ba02226dc2e645d14449da75d8ca4756ab3df84612ad7d9bfff25e3aae2
MD5 3600a9fe4208cce34de6e35f7fbbd317
SHA1 4d26c992cee9c79cc4edf3e9d1451fb151ffbd0a
SHA512 4b577576c4467df8db56df5fb6d1aa4f157c14be706d43dff39a4753f395bb356adf5825c331e24ee1780dd6d8a9d43bc841a49962fcc77184e9a0dd5892720d
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ19DN5JrNRV3THy:XQvGAdlCEL8c/1RNX5CGBqBMFveDTZ
TLSH
T14B366C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 b275d83550f1776d42d7ebe461088e5203ebb52cab9083c78d6f2e4bb84b9eb3
MD5 51c1d007c33b1c05d32b9b7560d6baf9
SHA1 7d5bee1caa8dcbf612e56f35195f939846c5a81d
SHA512 0ee01a41f0d8788e1a3a995f159b62d95264b70b5664f37e3ee98cc5f05df3c72e73f59304b70c1ed12c0cf1b548b17c75f92a5845591e4f31ffe893236bdb07
SSDEEP 12288:W8wSfxL/2Dc3bDLLmt0LDQewsAjpuj6PoGX11bqtq2nKncB/85O8mICpgllz+4Xo:nmewsAjplt3qs2MpfvlY1D/fjxX
TLSH
T15D15E030FE75E036C37F0DB62B36D716646CB9204B9219C3E3E8999D59242D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4681514d4cd0d70289e69593796db7b53923cc53bd8a52b1f655c1ed18f472f7
MD5 b7018c84a0eab610b7536c46db7349c0
SHA1 deb064484aeb64f7b3fd86708c5d174465323b13
SHA512 97935547a5a605d7b9f14ef8d13c15d9e0abccb16fcf8b77b153be5af85c778dfcbd68f377ec9d8f24584438307901f4533397f2c78a4df731f600ef526abdff
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHB3kl:FUEtQevvqc2W1cpV2X132Gl
TLSH
T1B3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0ecc4be5cd39ef0211f3404c6629780c83ff6faa0163f07a8b01dcce790f3735
MD5 469deb080d868989455652f883235ae6
SHA1 cdddbb1200cb584c22b256f0c8b1814e1009ab63
SHA512 c61056ec58efcf345c0a715e61de5310be339a396018a936d621dd602d6df29aec46021bd42336258cb73883ed8d15adb5c822f7f0a9bb2dab2edca3d5b1a4a8
SSDEEP 49152:6qbRquA/m2yL5zMfFiV+XenmE3/zZBqBMFveDTZ:Loq1VjnmKBqBMFveDTZ
TLSH
T1EBD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1d369bae9342420e1797f8e7c57ce3f63cde37d3725144eed3b6c0c5ebe31275
MD5 6d7efdfaaea0124cf012f86461d3b473
SHA1 dfc7f27d491c86ab1d7e7634e6f744b04348e260
SHA512 bada9e36834083d2ad6b6f3db287fee05a19becdf3494b2750ef668d36a8e0d1564910a9b9010d0e7b41cf30b6a0fa0fa3ad0606b8638b3952cd0c1d180e996e
SSDEEP 24576:BAhGLvFFoiwtA5l7S53zlt3qs2MpfvlY1D/fjxX:BAMBFoiq5RBqBMFveDTZ
TLSH
T15645AE80EBF955D4F5B7AAB899B69171EA72BCA55E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 6d72640b6acb53eea2d37a74523720008eda09443dde2d1fe7053f0029459972
MD5 7fdf99e3eef2bc0b6cae570819dec8a3
SHA1 521c851090d41d4e8917ab6e3ebcda1dce0ba73a
SHA512 0a407c751b4a638f7464c3c76cbcbd4a7a1d46c713992839c9293d6fd0c0f971a157981947aa825c962f556f34d18c5b747e959ff14bbb046d9ea980a174775b
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CWMuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fbl:Owu+OWelt3qs2MpfvlY1D/fjxX
TLSH
T14505F14577A50CF9E96A8279C957C236F7F2B8112A22C72F07A0C25B5F27351AD2DB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 288179b80a89b4b3d56264363aa507e2937ab4cd45644e6c0c7d7be2f8311a9d
MD5 246aa3f4e6f9e8a7d4c47661ce27ea13
SHA1 13d1f32339a311f91529eb85dc5095276532fd2e
SHA512 ddfda8fd5e6b66572dc24c093a6e61495a8138fe34a880b186da3111e69fb82aa50df8c8b046837069d1378b2ab9ee5d2d0d8f2d0c59427d773fe668b7aacea6
SSDEEP 12288:mCb1ImFuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:7buIlt3qs2MpfvlY1D/fjxX
TLSH
T170E42245379121F9E16A42BDECF91701E3B17421676383DF4B6692AA1F22EC16C39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2483f85c1573eef1996b8c9076d5763bafdbcd2dc6d28ee57aeb9d4a0cba04aa
MD5 ad1e6954b6b182f6b3fe34914501d857
SHA1 249e3c70bdd656b66a27aea22c3caf5d5efe0106
SHA512 c7a0da663b17d994a644fd235833694dbd23eb8270264d520dc39b7d53f9a8a8ac46eb7eb4d58d975a2ce60ac8c04c031784844227b2a33357959ba25511e4f1
SSDEEP 98304:xQRQyi36YOcP8Lvw2gAf+PN3lBqBMFveDTZ:oQyiKa+X+PNj3kl
TLSH
T1CE667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ac3b5d2802be768ded06c1e61e5a08e4efc339941291d053286575ea2d5388d0
MD5 56d2be013cb70fb553d4aaedd71ea6a7
SHA1 0c9292d51513939a4d871754aa5a9242af5bb80a
SHA512 c57b2c200b1dfbd21f08cc9517925ff407b5acb4fa719921c6b38fbbcba22d2d335c27981622e42c1f0fa9f40f16ed212aece34a153924cc106415e4e2641c87
SSDEEP 98304:xQRQyi36YOcP8Lvw2gAf+PN35BqBMFveDTZ:oQyiKa+X+PNX3kl
TLSH
T15E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 af90e58c6ad0da479bed8079aae8697442eb01bce583eae920bea0ce55f415ae
MD5 594428a3d48eeee5ac04c36f6e4c8a87
SHA1 5d0f1686e047cf8f82af50934453aa12ac37ddd8
SHA512 5e3d7ef9b507aca26d074d77490b53141b86240dcc80dd74d80ce2a9a5442eb45551edebd22bad85312d6e8e75dd0dfc4bafcfd211e58afd8303d72f52482ee3
SSDEEP 24576:HwvaGf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0glt3qs2MpfvlY1R:K68Qg55nhMeWu7PNU3/XBqBMFveDTZ
TLSH
T12FB55933B2F200A9C44DE1769F4A972196D17C718FE1E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 320eeb97c39ab55a51b5b3aebbf84500034aebb71d49272eea6f263e4879cde1
MD5 b08f00f357d128242a20d639cb195d3a
SHA1 aa5df64913af3e258eb8756f96270c1c25693ac3
SHA512 47093a42e0b5d69375f66ec317430106e4148dd6e5e6be35a0857bc21fc193dacb462c6849badc27a6aad70b03756882f1c4138bac0d7d7767497df2192c93c5
SSDEEP 98304:Vy5112gYy5azzVv569nLKnhZ+BqBMFveDTZ:4LIHAWhg3kl
TLSH
T1AC168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a0c152174d4a987ee30d353253c5a6f6dda64128907458ed2a206c361405f65a
MD5 c6b8c30d8a75a95a42078934dd7afd83
SHA1 fc839485246df839bc2c35e5bb387cf7df426f29
SHA512 7f13159713e6b1129ea1f34b78fcee10e6688920b3dd5127e09a4767e408fb7ae1f1144062958f634adb197cc21a048c2c3d53360bc577efdb3e544f43bdd4dd
SSDEEP 49152:es+taZ3usBWOBr4tEGp0bqx0z+n217aau1glcBqBMFveDTZ:Nu6JmTxd2dcBqBMFveDTZ
TLSH
T199D59D13F1DA01E8D06ED478974A9233F962BC490B35B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8fa9cc5a0dfd8415fed102d7837acf08a30fd051422d94ba75a47e6d3bf4bef3
MD5 1d710319f438bac6796a844a9e6943cb
SHA1 ace506be83c43c7daf50bad7e114561ffbdad310
SHA512 bb499cc19af56d6334205b5a779b915363d96ede1b4aa5222891512a579a3c90c84277f7015159dcf258688db28efdd61c8494a1c5d1290ed88ab2b71b4c79a9
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xfBqBMFveDTZ:DmifPbRaBqBMFveDTZ
TLSH
T1BCB5BE13F29901E8D06DC17887569232EA62BC450B35B6DF0A90B7961F7BFE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a19b9f885a04ca65cf257a47fa830a40a22d58c19f2a9adaae045e152391b0d5
MD5 85c733a28aab5bd644e96b4a3e204930
SHA1 1ea4d5ec52b3be3ddddabf609df0953510befbe7
SHA512 13382fb5349bd2cc03da9810782b44d77384e3019ee73c1c8d62d2441ac537d5a30252bfca1e94c0108c65dfcdb40553c255c6e2861ea3135a95a5513b8facfd
SSDEEP 49152:uSuZQIY0Be2K6RVtOnks6NMHqbBqBMFveDTZ:g5dKoi61bBqBMFveDTZ
TLSH
T199C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c36708f8c1236a0868031695f3255695cb5697a23cdef10e0c698fccad58a220
MD5 97201a9abac46001c1ea6896d54e6ab6
SHA1 6eb38ba8176dc37ed6d33bac179f4182a7f6bcb6
SHA512 58e1cd58595aa1cc3b4fb4ca90a87478642d4f0d8eb420b499322c03943de8f7d0a20a07d9e423139060ed6ca6fcb7ea52104b832958ab9401a79f93305af8ad
SSDEEP 49152:39vSn8EApI0figTgiDn0AP5wIBqBMFveDTZ:wX2iyphtBqBMFveDTZ
TLSH
T1C4A5CF13F2D900E8D05EC178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 5237cffc5417366eff34ac96cde27b07f0e52a7f2cfa386400c5fd32eb279a89
MD5 60a808a075d3efb5622340ebc391b4b2
SHA1 32ea124e4bdf96ee6568bfd63ad9eae8994483cc
SHA512 61b18ea2248ea725284ae9250620336c08fe3d3e587d0a476528da1d1b81f3e407fb02c3a48825cd0076ae0c9a3a3f15bc45bf172641895908cacbfab6d0ef3a
SSDEEP 12288:7Puj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:7Plt3qs2MpfvlY1D/fjxX
TLSH
T191D42340AF0316E6E62C46FBFD7E6715B0D0B560B9C38130DFAFB0A95D88A8560D5C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 b0d9e079ba901e512fe8be66ec89b99baf5686e962c87e87760c85417be4ac24
MD5 c15800b32f8eba9872520fd50d71cec1
SHA1 bc4f6e066b4a92e495045688ccd4791d6755bbc5
SHA512 31e9a465f9fdc8be456c4fa8711b00383d4b8334b1aa948e8e85f1b1b76ad6d6c034a42489ef88a357711088ac5080510d3c66686f20417edf005e47754db393
SSDEEP 12288:5Auj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:5Alt3qs2MpfvlY1D/fjxX
TLSH
T180D42340AF0316A6E62C46FBBD7E6715B0D0B560B9C38130DFAFF0A95D88AC560D5C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 eef782fffb8abae53455d3ce7910f4b3f0689452819cfb6887019adeb3ca89f3
MD5 41f0489a1d16557a0124c9102e309742
SHA1 f8252ac318c9991b2e41f3480d2ce3eae5b2a3a2
SHA512 1450e06616c38aa5ecc24f923b7e76036c4c175fef76d83e650ad434749e38507c4067aa7a323db46859f9520b85138c39cd4933b40cda778054e8dea8e90ff3
SSDEEP 12288:zuuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:zult3qs2MpfvlY1D/fjxX
TLSH
T12AD42340AF1316A6E62C46FBBD7E6725B0D0B560B9C38130DFAFF0A95D48AC560D4C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 24ac5cc2f32a5a55d5afe89ffd62b3c0a5a532176280c7cfdce000daa273d08b
MD5 52ecfd6bf8de81c820e0a56d990009d6
SHA1 5cb8922a8b584e9685518ddd23fc0e5d68268dc6
SHA512 8d4fc14b3c43e4a94c676fd7b003e08e96f79dbb1b7ecb2778fb8b8dcd946166945ca6c3efc7be0b7d6dcf6b2e6257295f62954bee497ac29777e4d8fc693c53
SSDEEP 12288:FlZuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:Zlt3qs2MpfvlY1D/fjxX
TLSH
T14BD423406B1702D6E53D82FEED7A6725F1F0F860A983C23ADF5770AA1E50B8070A4E75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 9fb115a3e07ed925be43a5c231c38b89566e3890c173583248eb58d0b7df1eaa
MD5 92ffafafb4485e7a40719ae9e2964413
SHA1 8732f27f455da159abdbf381e452bb58c6b126ae
SHA512 1b233c8d06bf483080d2327aef4ee06c4bbfd4bb893b37cdf5a47e5c4bb5dbb593981dcd3257a081e22a32040b2c2765ddd57609c6566132a019c3684005f0f3
SSDEEP 12288:iCuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:iClt3qs2MpfvlY1D/fjxX
TLSH
T120D42340AF07169AE62C46FBBD7E6725B0D0B560B9C38130DFAFF0A96D48AC560D4C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 6eae9e078a088c87469439b1339b8f44aa9a8e9ab4d827e3490bc7e59bc5bbfb
MD5 550858a050f43a339abc3646c5678615
SHA1 fc4e18c07ce6b373442af6ca88aa70c0b52e5011
SHA512 7bd141c41ed2d31c279c318cabcaa8ff0f59466ef03045454e378475c76eba6d31e11753f342dea4398c92eeccd88d5a0f091bb1a71200e07c02576527bd3326
SSDEEP 12288:5Suj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:5Slt3qs2MpfvlY1D/fjxX
TLSH
T1E0D42340AF0716A6E62C46FBBD7E6715B0D0B520B9C38130DFAFF0696D88AD560D4C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 18b672a8123c8e35228135ee43522f4da731f76df33ec5d3e7afc513a4caf05e
MD5 30625aa23aab58cc3d373a886f709a4b
SHA1 c10862914a78c6fb79de1e96cbdd49f594406f14
SHA512 e866fb564396f68cee6f280262432d3cfbff15b9f48c3695ffc0fecf32b3fad21b38fa19d4b0218fea434e40ce0a8a48b72f063accff4ff8f0895d95907696f0
SSDEEP 12288:Kwuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:Kwlt3qs2MpfvlY1D/fjxX
TLSH
T13DD42340AF0316A6E62C46FBBD7E6715B0D0B560B9C7C130DFAFF0A96D84A8560D4C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 357ed62a252a06abe412f7511a15f50ad93e3b51cf5f6fa866dae56a615f8dbd
MD5 259e568e242601cedfc58b7b126f146e
SHA1 bcf393a9b08184d59ab108e87411ffd943169264
SHA512 f95971c5abd638053e6e3a7f03987bb15853c4af27c29ac3e5170bd4b2b2ed3f17fc78271d0e2ecd9b56d523f2a8840f9396e613ea9f367c47229e9bc0d59960
SSDEEP 12288:eiZwbYyzFyNSYcPvypuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:BZM5zFGSMplt3qs2MpfvlY1D/fjxX
TLSH
T1C8150194B35118F4EC67817ECD659A16E2B2BC150AA0C61F07F9326B5F33391182DFBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 04d089a3cef9317140b5269b45f399e9398b540945a4a009b37d21c41f2ffcbe
MD5 2b9cabae0fefa9b5cda99eea9e4fa0b9
SHA1 483668c412ee80e03c09fba80b9c21dfb711cca8
SHA512 19c1393509b8c982ce8400d52777c95b23ce126e79b03aa8ac0f727a2930f5a669aad716a8b854b601c7b64168da31dab7860ab95faff74a56d04d35be6066f6
SSDEEP 12288:lwuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:lwlt3qs2MpfvlY1D/fjxX
TLSH
T1B9D42340AF0316A6E62C46FBBD7E6725B0D0B560B9C38130DFAFF0A96D44AC560D5C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 60ad5df7284c0024e4d177c5d58dd11bf6bd5e9d5d4f8c5031a981e29fde4ba6
MD5 758f91c08de1e5748e2c66fcd7184e23
SHA1 381ac7681a54091aa0b3a89faf4b1995ef4b11ee
SHA512 0f8c4a59b7f1186b1c048999088a941b2f0f3a40fb1e50d161d1aa81ca9071b2e44e6ccdfb0ef9eed73796c6f56ebd9602287549b55e69bcecb8b4cb758340e6
SSDEEP 12288:fMuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:fMlt3qs2MpfvlY1D/fjxX
TLSH
T118D42340AF0716A6E62C46FBBD7E6715B0D0B560B9C38130DFAFF0695D88AC560D8C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 2e4d5062d8753e0c321fb6bc26ba3eb877086418434ea31baf9d33a5a4a10f43
MD5 1f29ccac7a79d32b785e7aec040c9591
SHA1 b8b17b70a290605eba3e2a3a5e8d2ebb5d4f8f11
SHA512 badf9fe7244ef0bb5d32db58dd49251ec5cc47167387099408ceb06ac52994d066acb71402ac4ccb6f4b3230ea40595d82a7671f9f553e067d1566fec3c2ebbe
SSDEEP 12288:zbPQkLSOuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:XQPOlt3qs2MpfvlY1D/fjxX
TLSH
T198F41203776230F9D13A8279DC661B02F3B1B8315751CA2E5BA5527A2F27690AD6EF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 8c5386d12c814976361ac0f8c6cd3dbcaec1c5623e4d7ba2bfa6b46699792666
MD5 d62b68bcfb4b026100e98cc48a783d9f
SHA1 52e1981bb429c90c6ad1fb18df6d649e0f29e97c
SHA512 24bc5d30e9cfec92e2d89b5cebf7f9ccf740e3bc3248c8c9c9a3533614252d35fc8a5244b72be70078ec8c0b1fabdbde97963b3d512dd3a2bf4d32de5c7ab7dc
SSDEEP 12288:x5uj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:x5lt3qs2MpfvlY1D/fjxX
TLSH
T133D42340AF0316A6E62C46FBBD7E6715B0D0B560B9C3C130DFAFF0696D49A8560D8C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 0987096980fe3c14ffec857e639479d0741589471d2fa45540118081e8535e01
MD5 9bed0ca2675f997f8aba2bfa3dd721f4
SHA1 d4a14d465e1a23fe042912acd498fd2a40a07c92
SHA512 c8d0c1febb8c22124f09051a991f3e4938b152085954591bc48b4eb40306d07a17b54381eb64a5d651edb97b64693eb33de7cc5f07ee9b492950234756dd1927
SSDEEP 12288:9Guj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:9Glt3qs2MpfvlY1D/fjxX
TLSH
T149D42340AF0316A6E62C46FBBD7E6725B0D0B560B9C38130DFAFF0A96D49E8560D4C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 625aeab9a5552389bb8cf96d0f656fc7a851cc5b5491c76d74e2dd297e797ecf
MD5 ad3969d7cfa64aee24e4d1e54ef334bd
SHA1 050ca65eeff88e89094bc7f423d9fbc873fd984f
SHA512 5283bb7300f444d473d44a08b1f308d8ecd6528fdf0f45fd706f8e3885c3117bdf74e29f7bce1607ec173d5b0f7fe72b201619dc2e640776b2051226cd5cd40b
SSDEEP 12288:qbPQkLSduj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:SQPdlt3qs2MpfvlY1D/fjxX
TLSH
T185F41203776231F9D13A8279CC661B02F3B1B8315B518A3F57A5527A2F27690AD6EF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 95b7495f3196b75a30b2b39ffb51ee59276abed391005aa2eb7d5d9dcaf436f1
MD5 0f574739df272979e076d2a9c914d07e
SHA1 b14e6e84efbb48880ccc504e3b4dda182d3c5b7e
SHA512 156a740051da323396cba820bb3caa12d0f2b8e6dda778cec2536c64c743f435510fb188b1296c8e6049d33d6909feab426a349644874cd4289175174abe135b
SSDEEP 12288:hCd9q0KdaLrB3z0zn4PDvhfuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/d:cTmaLV3z0zOflt3qs2MpfvlY1D/fjxX
TLSH
T114150194B35118F8EC6B817ECD654A16E2F2BC150660C62F07F9366A5F33391182DFBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 9d8f46d0e7158c1d594131f3694f1a0d9a8a822e11e1f5c14f68ebfebac440b8
MD5 9460b3ec3bdc480fb17d4f2b46f7612a
SHA1 151c43b3bdad9f886e6dbbf40f29a6d00c13cb83
SHA512 0d8d9de19d1107c0a39c0f96538ec0cb158f797f914ad169260ecb518b810613f6e2fdb33c10f8f96f09b2ca3401bd2703dfddcb82404c593b3ecedacf87d3d4
SSDEEP 24576:03jdnCHAy7C/9lt3qs2MpfvlY1D/fjxX:+jdnCHAyeXBqBMFveDTZ
TLSH
T1B735CF90F3E410E8F0B78A758D765611DAB67C591B61CA8F03A8665A1F33BD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 f19972c429c4e2cec32e6fe4ac00abc8885d6b9816c773dd686367fa1fe16f4f
MD5 e632277939e14f7be1ac5e6c3c1a8937
SHA1 e1466b65c2633a39bf18a4592b6ab537753b889e
SHA512 1f2fbecbd8cd226f1023bb08d2d2290be7453ba9018ff343ca986dc96d01d560c6bd2c41acd3bbc65c11d8bfa39c2d0a721cf4bcb08f6ba3c01e1a395ab50aee
SSDEEP 12288:ltvuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:ltlt3qs2MpfvlY1D/fjxX
TLSH
T142D42340AF0316A6E62C46FBBD7E6715B0D0B560B9C38130DFAFF0A95D88A8570D5C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 4ada747a054c36704bba06ad0c04e6a734fb3fce7a6684b124172aa9596a6896
MD5 d8e1db134f1e53c1bb889874e03923c4
SHA1 bc1d921b46157407da547f31ab112e2476ee6bd7
SHA512 77a6aa88ec44ea52477363c51ac99dc94ccfbb317a097111ce8f22e3f52f314b71cf9c183a84a62b862fefc2161733c1e63f53d3887b62291e4734078caa2c69
SSDEEP 12288:9suj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:9slt3qs2MpfvlY1D/fjxX
TLSH
T1CDD42340AF1316EAE52C46FBBD7E6715B0D0B520F9838130DFAFB0696D88AC560D5C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 77b368d96074a952cb5a2c17a536de8b09362318f55d26f3a746181be7ff08dd
MD5 f573ef75ee19bf37bccd056de40a1b11
SHA1 1006224fe351c059db26fffde4501c396da83514
SHA512 5285d72d59df2fee4cfe6e9a21a29f1c725ca9cf48583e84c8bce84aff4daebf200bf9c4f44739e162a71a7e6d82826e892ace7765952bb49020c062214cd3eb
SSDEEP 12288:YQuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:YQlt3qs2MpfvlY1D/fjxX
TLSH
T194D42340AF0716A6E62C46FBBD7E6715B0D0B560B9C38130DFAFB0A96D44EC560D8C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 02d5b386e044084b5263d03caa3c43eae0ef97a2892072540d99c8844a40ee45
MD5 d7631e1b8efee3b244bb0288972049c5
SHA1 6f50e8a1795991f96a09f4937c2871c5c0ddcf98
SHA512 a467a234c6855e8449001545e316aa8ad0dd2b144b1e3639f8046401c238dcbb6771c4dfed7c705547fbbf711acc0c1c13d3a9673546c77f8e495f9abdbc2d29
SSDEEP 12288:XKuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:XKlt3qs2MpfvlY1D/fjxX
TLSH
T12DD42340AF0716A6E62C46FBBD7E6715B0D0B560B9C38130DFAFB0A96D44EC560D8C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 bc40bfbcaf00cca4bca088c8d9c65556d5f46d6aed8d69a315dea4d1733df697
MD5 d03a800247594cd6b8be1b1e136ee0da
SHA1 c8bb6cffb22cebdfe7dc03bd13ab94504e173cb1
SHA512 974dec0027fbd90e5a719c7fb961286f8547869a64c8c6b97aab0ddc8e607b243cc5f3b3541f40683e502601973ee36cafdb0d8f247e35fd4dc8a48f256f16b9
SSDEEP 12288:yEsfMuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:oMlt3qs2MpfvlY1D/fjxX
TLSH
T182F40109D34502E8C06E52BADB6A5B01F3737C2096E2C39A97D1F17E1F766806DD9B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 a3f091e956b308a33d2b9c81388fff93bd7f2b60527da71ecfe201921a11e356
MD5 2f690ee67ef6eff1774b1873bd832d85
SHA1 165423f9a3511cce599d0fc96a5b63dc66f27029
SHA512 ea6268192750e0ed43d2a0838a1f16cd08288eef1f8382531352a392ddaf023431b5fe9aed86b840742e9128254a6f95ca2baafa076bf0ad14ef47580030574f
SSDEEP 12288:B37luj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:Fllt3qs2MpfvlY1D/fjxX
TLSH
T1A5D42340AB071696F53C46FAB97E63207191B530AF83C032EF5BB1A96D54EC4A4E4D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f5a627cf3bad6c499eff5651ee2605690cb14e2c73bdd6bc0d3c4f6b4446a647
MD5 ebd9afa0d5be021d727dcff00f8cb3c1
SHA1 81688fd438a54eb9d864e8b12051608519751faa
SHA512 68e968a27f4cfefbad5eb53e2b121edc7c0001a3d06582b76c188f4d026879db1a9a2af55c1bd0fc36f7335a8a1175d1b583cf4e8a0f6071feccbd2c11d540ee
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYLlt3qs2MpfvlY1D/fjxX:4gb4mBIBhGFSBqBMFveDTZ
TLSH
T1E065AF1E22E802F5E0F9D2B8DDAA4417D6B278160732D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 09f48f31224f4808cd3d80c66366c32eaf8cc4c8d76a1d7ba635bbe4b4136cc8
MD5 b57e00bf19a9069026efd17b9bfe0bf1
SHA1 e18df23d847d675e99099a8e2dae95b33962b3e8
SHA512 f3ac643efe49d4aa9e1dde0af82a701707ca6d6648490c8491e2521a7adaa59d63220aa4317706d5974f28c9162fc492d40e48a007ba01e704c66a925b6c5c01
SSDEEP 12288:7uGLuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:yGLlt3qs2MpfvlY1D/fjxX
TLSH
T1C2E42218666731E8C53D82BAA87A6722B0F07070A74251FF8EE6F0799F54AD07178C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 cb0107641513cafb6175f7ad622888325795bccd893008b30b8f496c694f8c33
MD5 e3c42d7fc54785381f18ea98a9badcb8
SHA1 e50e396a402e670839ae458d18f082f9166647b2
SHA512 d2fd41acd2cc6a54b8e90e8b744469b8ca13a805608f474e06731d50e886eb385a8dab29917582c255ddfd520d8c85f6e62159490e2a255424aa0733ed1e1e68
SSDEEP 12288:gzIuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:gElt3qs2MpfvlY1D/fjxX
TLSH
T11AD42340AB071695D53C46FB7D7E672170D0B520A78381F3DFABB0A95D88AC560F4C7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fb34f5749ce77cd076902cde5bec202b86dd5db5c7b4706f023da933c958faa3
MD5 c17d4ca46378ba2de0d8cc00412d8e1d
SHA1 5ecf62244ea455272bc6885fb36a77e09867a605
SHA512 853f7765bd0ee33652e1899f82e1f233c407dc85b1dedac3756583d77a51ce6445ff07482f9eea05a227d69e2c8e12c04be7b0261a8346347b9b793b4a2a7794
SSDEEP 24576:Kmm8W8n4JqH1Mzria7/m6lt3qs2MpfvlY1D/fjxX:5lBnwqVra7/zBqBMFveDTZ
TLSH
T1B535F16577E102F0D47BD13889964763F6B2B4210361EBEF0BA88A551F23AD14B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 597a8f807ba7f621eede407b22a647de08435ba9f88a4c819add641a02a20f4c
MD5 fb217bd8dd0708fffcf06287dcf8ac86
SHA1 6e30d3e99a7e7ba8d4ce531b22eab763a0732069
SHA512 e01796112467bf5153c9a112d0ee7715bbd9f8ba9eb4895b267636aedb18f7a46c9b36aceab5666235e70a9c8e03aff3dac3d0dcdcbe333c1e2cbfdbd9929337
SSDEEP 12288:jHvUrBFrEjwaQUuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:jPUr+NQUlt3qs2MpfvlY1D/fjxX
TLSH
T13D05F11E26A918E5E67AA17D89864709F371B4621702D2DF03E1817E4E67ED8BC3DF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8ec08e90ad0a2a423d8a4b3c779113184d7982e70ab83edb69d75ba97e74c8c5
MD5 b954be9b10376af7ef381aaeb24454f0
SHA1 0a068feffa90a63beb7037c40a40d5aa6bb78234
SHA512 9fe4f8b39c342ddb47151fc30fdb2d3cd69f1e665a8aefe1c7df291c978992b56fcfce524dac7799a185d4419ef05da510484d82df6200030975d8d444d79fc3
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHmBqBMFveDTZ:jG05lO43bumBqBMFveDTZ
TLSH
T173D5C06E62EC11F9D1BBC17CDAC6460BEBB23425032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 1dad740aa8259f15ae8f8cf5bede2868eb24cf64a0496a17c416ba35857fa59b
MD5 4147ba374ea5f399f5686302e16eb648
SHA1 53a9a80902a61596d5b01a0c074aa7d3fd0901e0
SHA512 e041429b74e2b478101f70e506278edd70e942fe75ae149066f37242cce1da5f2bbbe0f6a0fc6001ad1b9d0e18f2c835ffd9999f8c53e3e04222e73431fcc368
SSDEEP 24576:kEa5POZ3dpbWVM50JicR2hG0lasx2+47eidn5lt3qs2MpfvlY1D/fjxX:7a5POZ3wJt2pasx2+mlBqBMFveDTZ
TLSH
T1AD65BF5EA7F801D5D5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e9939e2396deff25df3c29e859733a58f577013906297ea705d8b3aee44ec1f7
MD5 24f55a4fc1ecd5b31c30d579db9e07a1
SHA1 3362dc52c6409251fad43f06416686b31b686838
SHA512 5d26dec640a8b98ae420c38495a5f20f1353bf63fc88c380161dd42b70861f12dc39c609baf9e356a9295a735df4dff62b620ca8039f06b6f63d9dd826a247ff
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7FkJlt3qs2MpfvlY1D/fjxX:yNc/zEOVHFgBqBMFveDTZ
TLSH
T161857B1623E901E4F5BBE1BE89779646FAB17865533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 55770102e8e892a9dc42056ed4326f774484e445f7170546e771188745fcadd5
MD5 5b598b5269dfae2fb1930e9ccf5121b9
SHA1 dc007635d396b064f628c8a32b620e49fb3c3435
SHA512 388db5631e1d420bb16b1ea159d19aa378b4a8d1baf06ce236f1f446721443b88ad4a24da2dd1d550c8b22c25e4ed2a16e8703436ff4eda75a2d8365abc2a27a
SSDEEP 12288:QnHPJnJP6szeCs6Rl28d3uj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTZ:SJnJPbzB4S3lt3qs2MpfvlY1D/fjxX
TLSH
T17515E03DD2A810E8E4B7C2B4815A175AFE71387C2F1269D759B4E4343F12ED0A979F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b321c3bee86c388067f9520023ed8586350f3a14bff497666c3d9160b9bd3bcc
MD5 b91dec639cc14d6519fa7763bccbc2ed
SHA1 649ded3334a18cbc12cc6a48ffae91f8d0a2bcee
SHA512 eca3e47aa272839995b69223dfabd45dd5656ea3943acde7069adefd74371f9137ff223a5dddab7d5b8cbb96ea534ca69faa975c38d2545d3f8a2590cc4c133e
SSDEEP 24576:YCLHGL0MoeVtFumTijCmlKQWDkVlt3qs2MpfvlY1D/fjxX:YCLHGeeV5ijCmlDWDknBqBMFveDTZ
TLSH
T150A56B05A7EB5184E8F3CAF5CA2694169A327C509B34F7EF4E80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 fd27159617bf42b06f3134963db43ada335b29ce7b9c114db04d09524b5dd2e7
MD5 29992fdacbc87d4d3b9599d0629974e4
SHA1 3d9f6335c11cfda9d395dfbcc21d095743e90ca6
SHA512 410696b48b844862940491746a27e9b012a8e4bce40ba6a2ce9a44345e17151033cca32945edfa0c35847e328a13b25f1648d84da7dc1ea491a484ee44b708ee
SSDEEP 12288:npHck6j5ZI7Kuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:/6DIOlt3qs2MpfvlY1D/fjxX
TLSH
T175F4014C236B10F5D17BC07E96930212E2B2B070975259EF4BD9D1BE5EA3EC8B538E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 dac5464215abe2822cfad6384d0c62e27229b8de3c301c3903d44d79f82b2686
MD5 3562061d2e67f59d79157a8a48bbf8b1
SHA1 a3da9e3112598d4b201e1e7be8a6de7b2dc6648d
SHA512 89dad23d5d86fd668b31196a06038b6929b985fc27e48180c7668b1f814966c64f4992f693b116cfa05435f7a773810ce59d1043fdfbd62482534fee7c368022
SSDEEP 12288:FG6kyAuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:8tyAlt3qs2MpfvlY1D/fjxX
TLSH
T187F41200675521D5E67D02B9AE774360A670BC205B4282EF9AE2F27E6F35BD0B470F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 79df60cf1720944951e3f356050dae6e013f39476063dff1de4ce0a9dcc88b31
MD5 e04b074e5b78a11116c81621f78e5067
SHA1 efa6f086ab519a36523550f83fee5dfe955eae95
SHA512 182d00e9bebe7835be6d7566c6a8b6e36cbb7dde9b8a1ebf88f19a2123f3d31bc3cc6e495a3b138c4dee9a574125a175de38676653990255f8e95b4e04430c10
SSDEEP 12288:5liuj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:zilt3qs2MpfvlY1D/fjxX
TLSH
T133D42344AB032295D52C46FAB97E5711B0A0B1306B8385F79FEBF1B99E49AC160B4C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 ccf2a787fb4c7e52ca510192278b0949f18f18a2589d9eaa1c163e10adaf968b
MD5 3a192b4d726b6a0ee12fbe89f418635e
SHA1 05c7a030d0a9525adcba610239e4927e468a9db1
SHA512 5b96ff19241ba8b9c757ad3c047b2b31e72b52b4b9f9c6962f061f3ae37c80ba8a7c9a01b257a3f7a33642209041943ecac2c81103b751756897d482a123bfb2
SSDEEP 24576:MZgpWoTfaidZDlt3qs2MpfvlY1D/fjxX:Ug1TrZRBqBMFveDTZ
TLSH
T11B559D1D67EA05CAE2B2D279D8721493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 2f8203ca48947bbae78a895b576e85fb5a3328ef93c99daac8a3e110b372d993
MD5 1c47570168096c70ca07744b413b465f
SHA1 ce216d16a0d3cb4286d57272c279b9b06c33f6db
SHA512 d19eb405d83f2470996702186cde95ce0209746ac25c571958daa44c74baa0cf2bcdd30ba8c5e256d2db97c368988793e8330d094a70047e2fa52ad7b3554fb5
SSDEEP 12288:1pJcm8CN7uj6PoGX11bqtq2nKncB/85O8mICpgllz+4XY1fb/fTnGQX:1rcmR7lt3qs2MpfvlY1D/fjxX
TLSH
T18805F14EB76B00E6E1BB817C88564615F2B3B030674253EF46A2C37E4E57AD97938F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3524388792ae9348cc0277fccabb53408253ad912bdb5c61fc479d1ae57f43e2
MD5 fc76e468e89ee25e7ef185c92294b195
SHA1 5f05911f66c6ed57c4dead6a41e03bba268f9a7a
SHA512 6620aff1da0093c0564636a0451cc03e59435d7e08b7bc5bfdbcbe6dcb0a50db9fd747ded6124d5a44826f207828cce4ce2c4369cbe806b741ac29845e51f2d7
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3HBqBMFveDTZ:j3Upow8sBOBqBMFveDTZ
TLSH
T1A8A58C3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C178BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-448-0x00007FF76BEC0000-0x00007FF76BFEE000-memory.dmp

Download

memory/704-378-0x000001DEAAE30000-0x000001DEAAE96000-memory.dmp

Download

memory/704-379-0x000001DEAAE30000-0x000001DEAAE96000-memory.dmp

Download

memory/704-377-0x00007FF76BEC0000-0x00007FF76BFEE000-memory.dmp

Download

memory/936-2-0x00000162ABE00000-0x00000162ABE66000-memory.dmp

Download

memory/936-1-0x00000162ABE00000-0x00000162ABE66000-memory.dmp

Download

memory/936-3-0x00000162ABE00000-0x00000162ABE66000-memory.dmp

Download

memory/936-0-0x00007FF746510000-0x00007FF746712000-memory.dmp

Download

memory/936-19-0x00000162ABE00000-0x00000162ABE66000-memory.dmp

Download

memory/936-22-0x00007FF746510000-0x00007FF746712000-memory.dmp

Download

memory/1364-401-0x00007FF72D230000-0x00007FF72D4D2000-memory.dmp

Download

memory/1364-322-0x000002074C000000-0x000002074C066000-memory.dmp

Download

memory/1364-320-0x00007FF72D230000-0x00007FF72D4D2000-memory.dmp

Download

memory/1364-321-0x000002074C000000-0x000002074C066000-memory.dmp

Download

memory/1552-349-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1552-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1552-271-0x0000000000830000-0x0000000000899000-memory.dmp

Download

memory/1552-276-0x0000000000830000-0x0000000000899000-memory.dmp

Download

memory/1808-350-0x00007FF639DB0000-0x00007FF63A03A000-memory.dmp

Download

memory/1808-352-0x0000028335160000-0x00000283351C6000-memory.dmp

Download

memory/1808-351-0x0000028335160000-0x00000283351C6000-memory.dmp

Download

memory/1808-445-0x00007FF639DB0000-0x00007FF63A03A000-memory.dmp

Download

memory/2184-389-0x000002A3750D0000-0x000002A375136000-memory.dmp

Download

memory/2184-449-0x00007FF67C350000-0x00007FF67C68E000-memory.dmp

Download

memory/2184-388-0x00007FF67C350000-0x00007FF67C68E000-memory.dmp

Download

memory/2184-390-0x000002A3750D0000-0x000002A375136000-memory.dmp

Download

memory/2188-249-0x00007FF70B4A0000-0x00007FF70B5B9000-memory.dmp

Download

memory/2188-251-0x000001E7FF5D0000-0x000001E7FF636000-memory.dmp

Download

memory/2188-250-0x000001E7FF5D0000-0x000001E7FF636000-memory.dmp

Download

memory/2188-328-0x00007FF70B4A0000-0x00007FF70B5B9000-memory.dmp

Download

memory/2256-263-0x000001ECBA4D0000-0x000001ECBA536000-memory.dmp

Download

memory/2256-264-0x000001ECBA4D0000-0x000001ECBA536000-memory.dmp

Download

memory/2256-261-0x00007FF6B25F0000-0x00007FF6B2739000-memory.dmp

Download

memory/2256-337-0x00007FF6B25F0000-0x00007FF6B2739000-memory.dmp

Download

memory/2840-338-0x00007FF7F7B20000-0x00007FF7F7E40000-memory.dmp

Download

memory/2840-339-0x000001C1BD9E0000-0x000001C1BDA46000-memory.dmp

Download

memory/2840-344-0x000001C1BD9E0000-0x000001C1BDA46000-memory.dmp

Download

memory/2840-346-0x00007FF7F7B20000-0x00007FF7F7E40000-memory.dmp

Download

memory/2840-340-0x000001C1BD9E0000-0x000001C1BDA46000-memory.dmp

Download

memory/3048-290-0x00007FF6ACCE0000-0x00007FF6ACD8D000-memory.dmp

Download

memory/3048-292-0x0000025791CE0000-0x0000025791D46000-memory.dmp

Download

memory/3048-291-0x0000025791CE0000-0x0000025791D46000-memory.dmp

Download

memory/3048-373-0x00007FF6ACCE0000-0x00007FF6ACD8D000-memory.dmp

Download

memory/3712-283-0x000002243D8A0000-0x000002243D906000-memory.dmp

Download

memory/3712-282-0x00007FF76C660000-0x00007FF76CDA3000-memory.dmp

Download

memory/3712-367-0x00007FF76C660000-0x00007FF76CDA3000-memory.dmp

Download

memory/3712-284-0x000002243D8A0000-0x000002243D906000-memory.dmp

Download

memory/3764-232-0x00007FF7B68B0000-0x00007FF7B6978000-memory.dmp

Download

memory/3764-309-0x00007FF7B68B0000-0x00007FF7B6978000-memory.dmp

Download

memory/3764-234-0x000001B3BA150000-0x000001B3BA1B6000-memory.dmp

Download

memory/3764-233-0x000001B3BA150000-0x000001B3BA1B6000-memory.dmp

Download

memory/4076-446-0x00007FF656E10000-0x00007FF6572E0000-memory.dmp

Download

memory/4076-358-0x00007FF656E10000-0x00007FF6572E0000-memory.dmp

Download

memory/4076-359-0x000001E4CBF80000-0x000001E4CBFE6000-memory.dmp

Download

memory/4076-360-0x000001E4CBF80000-0x000001E4CBFE6000-memory.dmp

Download

memory/4228-12-0x000001ECBCDB0000-0x000001ECBCE16000-memory.dmp

Download

memory/4228-43-0x00007FF7B8070000-0x00007FF7B8192000-memory.dmp

Download

memory/4228-13-0x000001ECBCDB0000-0x000001ECBCE16000-memory.dmp

Download

memory/4228-14-0x000001ECBCDB0000-0x000001ECBCE16000-memory.dmp

Download

memory/4228-11-0x00007FF7B8070000-0x00007FF7B8192000-memory.dmp

Download

memory/4356-385-0x00007FF694310000-0x00007FF694726000-memory.dmp

Download

memory/4356-442-0x00000273DB4B0000-0x00000273DB516000-memory.dmp

Download

memory/4356-299-0x00007FF694310000-0x00007FF694726000-memory.dmp

Download

memory/4356-300-0x00000273DB4B0000-0x00000273DB516000-memory.dmp

Download

memory/4356-301-0x00000273DB4B0000-0x00000273DB516000-memory.dmp

Download

memory/4356-444-0x00007FF694310000-0x00007FF694726000-memory.dmp

Download

memory/4364-37-0x0000020E2ADA0000-0x0000020E2AE06000-memory.dmp

Download

memory/4364-36-0x0000020E2ADA0000-0x0000020E2AE06000-memory.dmp

Download

memory/4364-35-0x0000020E2ADA0000-0x0000020E2AE06000-memory.dmp

Download

memory/4364-34-0x0000020E2AB50000-0x0000020E2AC74000-memory.dmp

Download

memory/4412-329-0x00007FF6957C0000-0x00007FF695954000-memory.dmp

Download

memory/4412-331-0x0000021E9F570000-0x0000021E9F5D6000-memory.dmp

Download

memory/4412-408-0x00007FF6957C0000-0x00007FF695954000-memory.dmp

Download

memory/4412-330-0x0000021E9F570000-0x0000021E9F5D6000-memory.dmp

Download

memory/4592-243-0x0000027328840000-0x00000273288A6000-memory.dmp

Download

memory/4592-241-0x00007FF7B68B0000-0x00007FF7B6978000-memory.dmp

Download

memory/4592-318-0x00007FF7B68B0000-0x00007FF7B6978000-memory.dmp

Download

memory/4592-242-0x0000027328840000-0x00000273288A6000-memory.dmp

Download

memory/5228-26-0x000001C43F050000-0x000001C43F0B6000-memory.dmp

Download

memory/5228-25-0x000001C43EE50000-0x000001C43EF74000-memory.dmp

Download

memory/5228-28-0x000001C43F050000-0x000001C43F0B6000-memory.dmp

Download

memory/5228-27-0x000001C43F050000-0x000001C43F0B6000-memory.dmp

Download

memory/5756-57-0x000001B9B1060000-0x000001B9B10C6000-memory.dmp

Download

memory/5756-58-0x000001B9B1060000-0x000001B9B10C6000-memory.dmp

Download

memory/5756-56-0x000001B9B0E10000-0x000001B9B0F34000-memory.dmp

Download

memory/6004-447-0x00007FF766370000-0x00007FF766876000-memory.dmp

Download

memory/6004-368-0x0000021F81340000-0x0000021F813A6000-memory.dmp

Download

memory/6004-366-0x0000021F81340000-0x0000021F813A6000-memory.dmp

Download

memory/6004-369-0x00007FF766370000-0x00007FF766876000-memory.dmp

Download

memory/6088-312-0x000002C5F8E30000-0x000002C5F8E96000-memory.dmp

Download

memory/6088-45-0x000001DEFC8F0000-0x000001DEFC956000-memory.dmp

Download

memory/6088-46-0x000001DEFC8F0000-0x000001DEFC956000-memory.dmp

Download

memory/6088-44-0x00007FF773BC0000-0x00007FF773D27000-memory.dmp

Download

memory/6088-52-0x000001DEFC8F0000-0x000001DEFC956000-memory.dmp

Download

memory/6088-54-0x00007FF773BC0000-0x00007FF773D27000-memory.dmp

Download

memory/6088-387-0x00007FF6455A0000-0x00007FF645653000-memory.dmp

Download

memory/6088-311-0x000002C5F8E30000-0x000002C5F8E96000-memory.dmp

Download

memory/6088-310-0x00007FF6455A0000-0x00007FF645653000-memory.dmp

Download