c091de60947692f4665c4e2a2c52fe4bbea439b5ca979908c640eb432dbc7ed6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260720-drvt4adw9j
SHA256 c091de60947692f4665c4e2a2c52fe4bbea439b5ca979908c640eb432dbc7ed6
MD5 4476f3b40827ff45175d7743582d5375
SHA1 78fb4e93a37a08a7c9e855762f9f49d7d087519c
SHA512 3620513b8d57f495e7d5cb44aa78bf580b5ccf83f118bf88451d75490915ff90a73bcad7b61615f548dfde8ce4878e133e77da092e9cdb73b5ea6cd12fc932cd
SSDEEP 24576:IFoH6ThNF4Xx7A0t/px5fIW7guzjGB7HtTlK7/g:goHGFEBAY/LpIgpzjGB7N5K7/g
TLSH
T14935D058AA4440E1D1B6C23889439946E6717C015B71DBDF13E8E73A2F37AE19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
1496	alg.exe
2532	elevation_service.exe
3396	elevation_service.exe
4700	maintenanceservice.exe
2744	OSE.EXE
2888	GameInputSvc.exe
4416	GameInputSvc.exe
4512	msdtc.exe
6020	PerceptionSimulationService.exe
2828	perfhost.exe
3472	ReFsDedupSvc.exe
3620	locator.exe
2484	SensorDataService.exe
1076	snmptrap.exe
200	ssh-agent.exe
4432	TieringEngineService.exe
1752	AgentService.exe
6052	vds.exe
4272	vssvc.exe
5828	wbengine.exe
3504	WmiApSrv.exe
4280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8e466c0423e529ce.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4416	GameInputSvc.exe
4416	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5064	2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1496	alg.exe
Token: SeDebugPrivilege	1496	alg.exe
Token: SeTakeOwnershipPrivilege	2532	elevation_service.exe
Token: SeTcbPrivilege	2888	GameInputSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4432	TieringEngineService.exe
Token: SeManageVolumePrivilege	4432	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1752	AgentService.exe
Token: SeBackupPrivilege	4272	vssvc.exe
Token: SeRestorePrivilege	4272	vssvc.exe
Token: SeAuditPrivilege	4272	vssvc.exe
Token: SeBackupPrivilege	5828	wbengine.exe
Token: SeRestorePrivilege	5828	wbengine.exe
Token: SeSecurityPrivilege	5828	wbengine.exe
Token: 33	4280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4416	2888	GameInputSvc.exe	96
PID 4280 wrote to memory of 2580	4280	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_4476f3b40827ff45175d7743582d5375_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3396

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4700

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4416

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6020

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2484

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:200

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:6052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3227be6750f803bed5596254b8f58b4bc04fa925725856f4980901bcda09fc33
MD5 537df82fbcdc952570906a749319d8dc
SHA1 5bf16eaf252cab6e04ea4786a2c54774ba73c277
SHA512 63c3397ac4ffa6f422f151230aff42742a408f853581c4dc3f1a27af4ef9263627826fceac02a8aff131861feed7bee5d627afa000175e8790c5eb4a229b4a2e
SSDEEP 49152:Yb+632BuPkFKRrdE6oh7stBhuXjfS4LWxna/LpIgpzjGB7N5K7/g:y3q6gjBZxzj1/
TLSH
T10DD59C03F2DA00E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 013e3e91fae8625ef5c10974a81fa72f2d9ecb9c66b8c5784b6d25ac16c9cf82
MD5 e4bd007ac004bb3fea5ae2d572fe2a6a
SHA1 5b4e0b4254f282a87e246bc3a9bd523d885a503b
SHA512 147e1a0af69b5c6dc04bc2040572b65b0ced626e735a63405f699d51700fa711f27bd7061c86d11b2eabd2ed373b77ef413292b1454ef19e1a2b7af5e81f1970
SSDEEP 24576:AXYPEtczAqt/px5fIW7guzjGB7HtTlK7/g:Atc3/LpIgpzjGB7N5K7/g
TLSH
T19E050128B7D505F9DD6BC23DC9A18505E63378454760EB9F03F89A691F233881E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e17f992649f33112cbc7e9b600b975f282b1d3f336a17e907295e6fa509fcd22
MD5 8e732df3e5d47416b68eb265edcd33d6
SHA1 aa4003e75dcfa4734d42bb3a675e9460dffd55f3
SHA512 e871784609bb0bb7bdcf69aa513f37258fe873024294c6421e1584d8736e07c71499db793c96c6a056ab61a4eabbe37151789fecb9d6465e2e87233bcfde5c93
SSDEEP 24576:r0NebuS0gmxOrMdt/px5fIW7guzjGB7HtTlK7/g:rLuS0voy/LpIgpzjGB7N5K7/g
TLSH
T1FF35AE56F6748331D073C0BAC5D2A68EE97130865B308ACB0296D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6e0c8d20bde14988343b490765265e481ef46b0674cda060357909adb2f8f3c3
MD5 385f4091c12ba787a3f0cdbc18fd6b01
SHA1 3b5f934810b1a5a5fa0d3df65f563cef36a3bb6c
SHA512 997680ff467f7864cabcd0be02407ef6e97175690c6bd088d5e0918d82a42d7c16f69b1139c40cc0477b3898e2d67cdb2b6192117ddb2ac8a179d2a40959a12b
SSDEEP 49152:6/ezSC6vUzPvuHjy//LpIgpzjGB7N5K7/g:uezSC6v2XuH6xzj1/
TLSH
T12B756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bbd2c6e18051dc629ff671acd33207bfb77801202487c557e2beee4c854f84ff
MD5 cd3a98f52e2e91488f63c0c048699828
SHA1 305caea24070982813471cbaf3dead6a0e34169b
SHA512 253192917c1d7108dd0874f167a90c9abd35060ee0bbfd6d56c5ab5f8900525a1c7724c6b001ea13070d6ba33dab2582fa84ab914a6c77e3bab8d1355e9ba7bd
SSDEEP 24576:7AbNPV4R9v/l+dYt/px5fIW7guzjGB7HtTlK7/g:7An4R9Xl+y/LpIgpzjGB7N5K7/g
TLSH
T11F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2F677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 450065705f6e90d07c75aa148bd291642cd5ba02453b4218ae3e8af3c3c30cc9
MD5 217fd5a4d0d00ba8ee0097907ce0904f
SHA1 1e66abf3bbeb081cf5f8bbcd89276b5076d26d2b
SHA512 383b7ea68c4da908c0848fecb71fd577b7036e525d31f66713929d1edaf69c47bbf05bb1cd415c1208f5c541d257938b683012af72eabbf47059f2ae72561a0d
SSDEEP 12288:QkUUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:Qket/px5fIW7guzjGB7HtTlK7/g
TLSH
T14CD423DDE94A1211CB2CDF3F4B94585D14303E066624CF5F2EB87EA81F6E10D41AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 c1ca4af85fcb590ce671f97520d5fa0fd3751fd5a71c69786075c9e5cdfc7ab2
MD5 81e90df388c413a37dedfcda880d23f3
SHA1 2c669249c7c4087103e693c75ca6301e2af481f3
SHA512 91a8bcfc2fe6b777f8cc9dddc0cf905232df1420ce0c7e4d07e801540e67462d53dfeb840c9a26cf5a10fc13f4031a6404eec04a48f2971ed30db176b1168492
SSDEEP 12288:SeBNUbTVO86UvUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:SJIUvt/px5fIW7guzjGB7HtTlK7/g
TLSH
T18215CF7BEE28FCE2C27E8DB95B918600977278304B61A3CBD174830D9E135E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 ed3519a2b6489fa0cb7bd24d8855573eff62f6e14f9c540fb9533c383b1e5120
MD5 dba91e008abeccb4328ee11c79a21431
SHA1 0df63a5562e57602667c8acde4f6bc2b0ee11c9a
SHA512 53e916a90ab34e44b40e61b62d94e37e820be0a683d9f26681d7178d440af4b1ac36502037bb92baff220f5ea71e10b005d47458ebe2884bdfb20168fcd38da4
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5JYNRV3THW:XQvGAdlCEL8c/bRNM5C4xzj1/
TLSH
T1CD367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 8d4fd000787afc1d2af37951e94e7bfb283305df54c659f74c8c3e96adfd9a61
MD5 6ba5dd03eaf4efbcefa418e87a7714f2
SHA1 7fddcc6411bdfe93595a238618378bd2d533a0f6
SHA512 f80ce9992bcb2918dbe6f9d829167b1fee58fa250aabb975aff02d163c673517661a2778502b33e5ac01c76b36210cf9393acb622172324c886b953ddc907193
SSDEEP 24576:SmewsAjQt/px5fIW7guzjGB7HtTlK7/g:Zljc/LpIgpzjGB7N5K7/g
TLSH
T1AE15E031FE75E032C77F0DB61B25C71A143C7A204B611AC7E3E85E9D5A242D22376A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6a209afbcc9e706946bd9fded11c68944b4f5bbb76dba101921dda9384a13e2c
MD5 0509427b3b35f5fa59e1a61dd5da781e
SHA1 e24152ea4c3771c2840dc971e62d75ee4d2ca58c
SHA512 08f33de69c628c90a30338fdc4c613a19ba6a5911d3b21bfcea3df8821d1f4c9b16fefdbf718ece9cb0bd330dbb2c2cb42e55577874e6d95ef65b69bc62ef580
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrfdPlbuJHLxzj1:xUEtQevvqc2W1cpV2Xr12P
TLSH
T14B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f133949f9b318078fba39ac5b46fd0dd40ae227aff4473fb6089b4433240cd95
MD5 abe88f0102c86ad4d2f20fbd82dd6c63
SHA1 a7f493eb1cc213ca42d07f512ff2717dc8734a1b
SHA512 1bfc3cdf81d1720a686371dd0dc00a823479beed45e106ab3587851377afca2ce2c29bb15b2b898aba57c07b74d23517874e676886fdb797960e0d6432205e5c
SSDEEP 49152:e+bRquA/m2yL5zMfFiV+XenmE3/zX/LpIgpzjGB7N5K7/g:Loq1Vjnm4xzj1/
TLSH
T1C8D58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2e35bcddfc833b847035c1aedb172d948843adc61208da1377d14b7392d5ff81
MD5 a1ae651e6336a454f7dc5383d4cf79f3
SHA1 2a1512d33f5de38e5385faa4505cdaf6de5029cb
SHA512 ebb28f44689910bde8cfcad54199235e3a787035f833f677029067826b23f60e371679323b782abacc9857372958dd1b04280ff1ca0e61496c0d6d244371c7cb
SSDEEP 24576:BAhGLv1FoiwtA5l7S53vt/px5fIW7guzjGB7HtTlK7/g:BAM5Foiq5l/LpIgpzjGB7N5K7/g
TLSH
T12B45AE81EBF951D4F5B3AB7899B69570EA76BCA65E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 bdaff757464d8bbda961aa8572db8a8f6365f01a1c8cd914c7343d50b6ccfe00
MD5 756763c322899e17e5896224720306de
SHA1 4c81f2f3383b23be29a764a080d0e0b1be856c99
SHA512 9829c5df45b9245408a7811b584b4b1c2269b4d299d87c33ec883f354d25df8b3c2dc7901507a212e3959e4ca41357accc64e97161b57af595c7cbacd8b2258c
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+ChUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGpV:Owu+OW0t/px5fIW7guzjGB7HtTlK7/g
TLSH
T1FC05014976D40CF9DA67863D8697C536F7B2B8022B21CB1F1770C65A2F273216D2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 319cd81265f34a1e3662bb0236b35b001ee1820b5fef246612a8dc3f9f0c3460
MD5 19ea56016546ca5b06cee2f4ae45ab90
SHA1 7e4c05f57b9e1cb503c89d1aaea0933d5514cd13
SHA512 0216f0cd5176ad2d248990af39ffabce235024c353c749db9b6052878ad5e7829c15c796e7399cf6cb2ab12543c829c2f7d3f4e906e19a6db1813e4b4019278e
SSDEEP 12288:6rF1I9BUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:CFuvt/px5fIW7guzjGB7HtTlK7/g
TLSH
T180E4129D76D821B5C366DA3ECEE05949D3713407273583CF2A784AA82F276C90E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 80ac8d85bf2fcf05f8cd75cd0ca43d5302352d5f4759f3ed1d12731bc260bdef
MD5 e36b6f58d83ba48b430ebb43e68f3c9b
SHA1 3199870386719a2de48c2120b4e49181e0ce668c
SHA512 5de017169cd69ceb7cb165ab3e6a170b8174488ebcc4d19a2a7fa0abfcba5bc35807fc378db35252466dfadc4f8646d1962a2285aae35c2c453375b06d829f61
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U2:+QRQyi36YOcP8Lvw2gAf+PN35xzj1/
TLSH
T1AF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ef3cb2b2e46a743e16ed905065263b9013476be7feadf970e458e828abb8c624
MD5 76a233e88b217fad036481edee9e0570
SHA1 633c5c5168dc39851b3fc91335d95645efbd6c93
SHA512 706b0894136f4744e28caec27408bdae8f2d09698612d8fb5a216920a0a707e6c5b5e94d5309bc9415a910d83d76cdd13081778fbf03864c40d6bfbc3192d85c
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UB:+QRQyi36YOcP8Lvw2gAf+PN3Wxzj1/
TLSH
T120667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fa1cf36b3566e1bc7fefb5d8ecee9b38018ce4468b7e03fad21e0d8e26e7c542
MD5 aa9aa59ae98694212beac5b128134bbf
SHA1 923ca846966f30880494ea2251651ce0110c402b
SHA512 805ec253effae1fdeed0b7b936336a3bf59abf7f946a49e9e4667b8f6a8146b26d6f0b301289e05c80eb2347f05cf51c3b19f22e2825b53f9fbd1ada3387d41c
SSDEEP 49152:W68Qg55nhMeWu7PNU3/5/LpIgpzjGB7N5K7/g:0thbRc/pxzj1/
TLSH
T14EB55A33B2F600A9C44DE1769F4A872196E17C758FE0E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a53cd84689bf26b6a79a4f48327a19e370316dcbb72632fe73bcd2d5f5967311
MD5 65bba6cd63521decbb84481a80befb21
SHA1 ecdd6a53c7d81405ccbcee0570f278724393540c
SHA512 2dbb67025e56447095a7f3881e0803764a411d3155405f23d0c158f8061ec77c26bb0be58f105c9bed6bd2492271921a49c78f86562b2b02637188fd642c551a
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99o:ny5112gYy5azzVv569nLKnhZixzj1/
TLSH
T103168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3e1ec514c224e979206efacf252d5ed59f2a9bd5366410fb825622ed59540042
MD5 e9581f6e81a8864255d88ebd22fada2d
SHA1 1672fd47c47ab1815a4df131984c7a1ee9ac1e4a
SHA512 0112e7465a49fb20f437c5b75f71505514e374a35e15f8d44880fc1e498f5b16123f56a2ef676e156243b8fd739e7e6adbd1b043f00d2fdb6819909e3db6a479
SSDEEP 49152:SB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glU/LpIgpzjGB7N5K7/g:gu6JmTxd2dIxzj1/
TLSH
T12CD59D13F1DA01E8D06ED479974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 176333dd50ea7b70756c2692b84322a95d2b83ef6d6e21b5883f488dc4ab1b30
MD5 5b0e6ab11a6b75865efadc0787e73dfb
SHA1 f11fc721fe7315a52e7b7a9b7c452994f76edddf
SHA512 c27334a54af490ad3292c6ab79855a965fc226e9d921252939897702b70a5bcec323621ecf08fccaa2d996d4044ba2a0760f5cae6ede39383d2ffdd8caee91e1
SSDEEP 24576:yhv8E1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx34HnI5/UPvOxeT54:61hpsNoJpF1A6UU44CwH7R4xIHIuZ
TLSH
T1B4B5BE13F2D800E8D05ED178875A9232EA62BC450B35B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3518fed81a336bac3c986c77121d22637a4a8d695b16fd28ff614375042308a6
MD5 73a836824ebcf4cda457aeddca7cfaec
SHA1 cd4d262f2fed3974f0a30380fab2b82a9dd78ad2
SHA512 463ba6293dc0ef3c4b8b476a0b50d2efd1fd4b20c76d041d4be0cd7682d79d147889c6b051906a57977524047d96ef87cb9023c969b8ae2d84629bb03bd986ee
SSDEEP 24576:M4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6lR04FxGgVG2Onks6xt4bSMHnqwHnI5/UI:MSuZQIY0Be2K6RVtOnks6NMHqwHIuZ
TLSH
T157C5BE03F2E940E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 746cc38821e18b4b95b15bca6a12fbde975b2be975dc427a2d9afcce10e30fd3
MD5 7b69f75763e47e6544484b28426c6d8a
SHA1 f031e03e4a2b071dac964355a7d65081699fbbb2
SHA512 c89f75a59ab18b7e63393afdf7dbe71c2f3c0a049904e3fe8489c10557d9b12f560effedd39e69f46832c6a310b402da9b177977077f97dd9c12548c60be6826
SSDEEP 24576:/hiavrPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5+2QLkHnI5/UPvOxeT5PsH:/htSn8EApI0figTgiDn0AP5wwHIuZ
TLSH
T101A5BE13F2D900E8D05ED179C7468632EA62BC150B39AAEF0A90B7561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 1721d5cb9a480238727ae37bdc94254d80faa86a5c2857c35949cc36bb643c51
MD5 b54665b127f3d429dc521cd29f66465f
SHA1 06f9d52156f3a0834a0c64b3bd5c5911dd715f2c
SHA512 507b97a9d9bf6cc465202fe68d76961c45b552e36ef426e7678af3341fa6f7177f818a09b0c781e56c440b021014d9e3108beca9ccce2b21a805641c6eb67d98
SSDEEP 12288:Ff47WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:F9HnI5/UPvOxeT5PsH
TLSH
T111D4235E464585CEE796E7FB6A2D295CCE232D4C1D2BDF4913F0B920398A968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 5d9b2a5ee6e6b8c872c0b0818026ceb11add170a42c02aaee9dbba16cd895f67
MD5 3e3c15dea7c9da47809a2ea93630c321
SHA1 20d212a53112bde507aade6913d0a9cfaeeeddb1
SHA512 39ab626e6ca9fd911a2596f1217bd32771890f710dd979f1401537949a72d0fc26b6c2fc211c3fe25342c488941e493924271b33ade9b6f6b1a06e581b032cb2
SSDEEP 12288:j147WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:jzHnI5/UPvOxeT5PsH
TLSH
T1E2D4235D464585CEE79AE7FB5A2D295CCE232D4C1D2BDF8913F0B920398E968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 28d58ebc0857e682a8251dc68c93a92f22922642841cd62cb92fe4a4811561e6
MD5 2b518ed2b3879bab320516854fdf4fce
SHA1 8cd28d82dfe5eb585d69b9a690eced66b012c409
SHA512 1b6b16abbd7c9002f8ba0da0a5faa6528dfbd99bf3c92b6a3bc3cf88c53ec90ba0f1c9dbd83c86f4f541389eb841ff8e4ec6c5d8aa7394ad38d322de8375541a
SSDEEP 12288:Zg27WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:ZKHnI5/UPvOxeT5PsH
TLSH
T14ED4235D464585CEE79AE7FB5A2D295CCE23294C1D2BDF8D13F0B920398E968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 13b9cf0e27c4da5365a1f9fab5624a2c05229dc1fec9df11202d6380807ff4e3
MD5 5eb999aa7dc82ba7b98e0a21b42a5a1d
SHA1 65a47815e35c37d8fe26b3780316f73f7c512b9a
SHA512 9dcb0c6adb83a2fc78731cfb689bcc91e77dfc029e826658de40f839d3955c759f0ca48ef2e679b17af9175a36d54cd8bdf7a51ac5b81cd84de732ed78acf2cc
SSDEEP 12288:ylCK7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:hHnI5/UPvOxeT5PsH
TLSH
T13AD42359075540CEE6A6E3FB9A2D6818DF733C980E37CF4F03B069142E966649B1CB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 8bb6351cb60c5db23c569cc960df80dd5ed360b9c73fb40329099517766d9757
MD5 d5ff844b3cb62674d44f4ebaa2d92df5
SHA1 10740400deecdd8cfa1c9cfc8ea6a80ea1e99768
SHA512 80907786d0f663500d81dfaac4d99450a7103edd29fd4ef332437e3a848dba36bbf0c50a724491527806859e8f6e26f4b4ea23c190686b138688b865af51938e
SSDEEP 12288:4zR7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:4sHnI5/UPvOxeT5PsH
TLSH
T109D4235D464585CEE79AE7FB5A2D295CCE232D4C1D2BDF8D13F0B920398A968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 b4f4d5e2b4dfce74168f2ad5d108e1ffda915510bb82a00d6035538935f52f50
MD5 ce70980fb0588abeacdb5f4ffa39d07b
SHA1 c30dbb0167e32f0d870fc8aeb3a96ea1b958892c
SHA512 efd65dce29cbf12a90af0f127d6b32c67f150ec263abaf93492afeb5c63e905635cbafd29bd747f41aa0a8e94fb859751bf0a442c3680d3fbca15ca127c013ab
SSDEEP 12288:DoR7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:DlHnI5/UPvOxeT5PsH
TLSH
T103D4235D464585CEE79AE7FB5A2D295CCE232D5C1D2BCF8D13F0B920398A968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 31d75cd42fc3ced65bac53893d193606c91ccb33b50372d13a4e0e56dfcd8953
MD5 cf6f6564e363a28e7fffd6dd554e02af
SHA1 05f4fe389ac5fe81fd47b93486dce6f233b75dde
SHA512 a1dc3df001615d9ca95cd33302a43fabeef7af17e95346b36a791e3ad73361f142994477b496c216850129be95cb66f29b1877a8167cb0bfd8f1c45365b8441c
SSDEEP 12288:GJPpG7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:wFHnI5/UPvOxeT5PsH
TLSH
T1A6D4235D464585CEE79AE7FB5A2D295CCE232D9C1D2BCF4913F0B92039CA968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 00e9939907cf46d14d9f66c1ad5b350e7211f97cca27a502ac9bb3e965561f2e
MD5 005ec1689f9908900fd58f2297364e4b
SHA1 910dad954ef9b4239d86ac27d9120e40dc0d5d8a
SHA512 6341b38524259581a66858eb08fd1a5f697d83820b938727911abe71dbdfa3def408871557ff757fbc4331e521039cc9a51376d209b0fd0918f6fac265ac83db
SSDEEP 12288:eiZwbStz6rNSncPvyIy7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:BZMsz6pSvuHnI5/UPvOxeT5PsH
TLSH
T131150299B35018F8EDA7827ECD295905DAB27C590A70CB1F03F436262F733605E2DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 782899a321f5d2995d4d85494c0d600445988dba291185d8f75ddd3c64d92767
MD5 23d26a44c3240cbef09c9e37c41893e2
SHA1 33d05c9a2d837814bfe21b6e1d61c5a60d90175e
SHA512 852311fdba2fb1f2f886de7a558fe3b027b26e9d1a34128cba053ca00cfe3200bc0dd4fe73543c5a1e1800de9974bb521acd8eaae09b259357c9e375e55abc30
SSDEEP 12288:77Xu37WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:v+CHnI5/UPvOxeT5PsH
TLSH
T1EBD4235D474584CEE79AA7FB5A2D295CCE232D4C1D2BCF8D13F4B920398A968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 2733d322fd3624b076a0029eee6c8b5bc6e85e5102a3c70bbfa9c04a5faf3153
MD5 a3b18f85ba8eecbe18a0a44f5d9273c4
SHA1 a0eac8eec42ba493a54edbc89f89362020588760
SHA512 6acacac3e2d1bbae9502c1ed35564f6bb7ba5f97eb0b4437dcd6f2e97bcd0292e5e28669a3babb673e12320a8b206503e7bec80f11a79946df255046b66d707c
SSDEEP 12288:nVdu37WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:VMCHnI5/UPvOxeT5PsH
TLSH
T14BD4235D474585CEE79AA7FB5A2D295CCE232D4C1D2BCF8913F0B92039DA968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 1bcfde5258ae42bdc584d080a56e89fa4be15cc47569286ff5473f0a1b018fdf
MD5 76daff3a0f00409b54b0da46d303ab78
SHA1 2af1cd7708f99de355f65b2b97997ed0c47a5941
SHA512 d29ecf47acd00a48d2a2e4c45e2c5def7ff9fc839635342edfc1d4b356f6bfa7d40612d6b058367ffe41d9e9172dcc9d13ff5ceeb37f9487ba205e15a9387c11
SSDEEP 12288:5GPz5L817H7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:Mzy1SHnI5/UPvOxeT5PsH
TLSH
T113F4120B63A130FDD277927989661A05EB7278350B25CF9F03B057762F276A09F2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 0ddf1008f6bb93485ebddd593a7b418e98ab8bcc29678cefc5d8ae08b19008f9
MD5 7a9f5686c31c483f80799ef43e7fb469
SHA1 f5751eed4daa164e5f9c950268f1f42c195ac8f7
SHA512 c3614b4a340c2f6c55816d78c827a975900be4b2156e769031d1652ffa42f7e42e9ffc9fac1562db315f80ab836d5a7713119ee3aa12b5f93e06a47986b5083e
SSDEEP 12288:ltcbH7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:zeSHnI5/UPvOxeT5PsH
TLSH
T157D4235E464584CEE796A7FB5A2D295CCE232D5C1D2BDF8D13F0B920398E968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 c3d095b9b6c447e56fecf2ce6944082d755903aa99fd6847bbcbb13b2e871593
MD5 e9b220a927e7f1bc270106a1cdf430ea
SHA1 2e8eb09963a61ba86df0aa55b5623b31bde3a162
SHA512 60e2ccafea6509a36f723ef1aa54e3a51da47341307b3ff9a93601311f1088adbad95cebf1666cb61ffeb2b849fb9aab09ef8f451e304df5d95b2aa275339795
SSDEEP 12288:SkEZ7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:bRHnI5/UPvOxeT5PsH
TLSH
T120D4235E465585CEE79AE7FB5A2D295CCE231D8C1D2BCF8913F0792039CA968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 c2fa3a78d34dde6ebc498a186af9e49de51495a1e7d46bd8b0fcef359df06f1a
MD5 ebd3b1c7dd54b672a2729853740e9d7f
SHA1 d58904cd2a08ee71880d0d42c0225ff11ba5f195
SHA512 e5f145c2dfc0dabd9177e44b1c670bd518e22cfe1daadcb3e8c17b366a6bd23085e0f6fbd9f83ce5ad9a530a798d536b77f9324fc9a3dca0e54175bac1b05a2b
SSDEEP 12288:wGPz5L8DB7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:FzysHnI5/UPvOxeT5PsH
TLSH
T1AAF4120B63A120FDD277927989661905FB7278350B25CF9F03B017762F676A09F2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 3964d2ab1ada6df7079f5e2725229cf8cc193e88471100305deb63ac81a6d172
MD5 8f14478543a1e3d9f24ea8509b264854
SHA1 c5fea77740857eaf9a9b3e9a86a8b8b1dce1d6b6
SHA512 5a244daa02bef8c81e1dff8cdc48f7f233e0520a9b2eed68064f48ec738ed3001537fb2b499a90387ca8b084414044a7a722b22cd43d8d83244f6a20b23173b4
SSDEEP 12288:hCd9EM7EaLnV3z0z/4PDvh2z7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+Ps+:cT6aLV3z0zG1HnI5/UPvOxeT5PsH
TLSH
T17C150299B35018F8ED67827ECD294906DAB27C590A70CB1F03F436662F733605E2DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 95c512318b6e61dc42d0f696d6b99f081fcb41e6d2c833d86fdb72169019af67
MD5 3c06897e420abe3ebea77e7676a988c6
SHA1 c3721c2ca58146f86fe83cae69cc088e73f16874
SHA512 64c869f293f8e47c0b8045f77940d5a46c07f7c26d5e019b4f8593bc0ab3e22c03e6ddcf8718dd6a09c0a0325b45170411949c6f1dd64224341d7a8ef2e3293e
SSDEEP 12288:Pi4e7VFdqfgwCfTy7rLbbdIvZO7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+9:P3mdUCfTy7rZ6HnI5/UPvOxeT5PsH
TLSH
T18435CF90E3E410E8F1B7DA758D765511DA767C991B31CE8F03A4261A2F33AD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 a3b360c733c682986d6b08d2c64d22746a0434a1ac2ebc65f04b0a9f0dd50d54
MD5 7b2e19e2ad5682a489093214af90112c
SHA1 847a44407ebbc13944d3837d1a5145a420f6674e
SHA512 ac0eea4fc23eb7f30c4ec3b8d85f7d2ddb6544bfecb1dbb1a8d60b9c9122f55dd7fe4f66e348be13150a470bf7e75450a699caaccd01b528c297e072ded201f1
SSDEEP 12288:3Gk7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:3WHnI5/UPvOxeT5PsH
TLSH
T1B2D4235D464585CEE79AE7FB5A2D295CCE232D5C1D2BCF8D13F0B920398A968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 ecdd95f854170845be98800689026e1696a4b21d782cae1e4b255a1a5b71da60
MD5 96ca21de3c3776db5bf73932499f6d38
SHA1 2ab8e73cc7ab07e67cca636d734f4235fd381a1e
SHA512 9ea875b13900ab250204f194153b6a381ca7014798a6fdf1c8ebff81a2fa26ceda4b08c1c889868cd8a5a285c8488104fe92b1f76a773d33dbe0c28400a4d9c8
SSDEEP 12288:Nxz7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:NxOHnI5/UPvOxeT5PsH
TLSH
T12CD4235D464585DEE79AA7FB5A2D295CCE232D4C1D2BCF8913F079203ACE968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 319e763ef50c23cd8e955c6ee9d3fc20d22903cd223d5906ebff1a83d364e909
MD5 c4e97403649fb9261c70658e92417bc3
SHA1 8344aa5bda8c7cb92ee0813e9b866af5a866bdc7
SHA512 3b3a5964f6ecd938c9f7953a705ff91df23396af21d333b3e892f27c3fdb387f1dda37ada2ad54eadea54aa2096a5634f112966b6989e5ac8cc1bfce1d537120
SSDEEP 12288:g79z7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:W9OHnI5/UPvOxeT5PsH
TLSH
T156D4235E464585CEE79AA7FB5A2D295CCE232D4C1D2BCF8D13F47910398E968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 be4a06e069a9da8451cee9a9b6487ccfafcf500435a09f2c3702ad18ef87a5d8
MD5 4d5b04914f70efc8129f1929fd27dd99
SHA1 2a81c1a7592926e310aed13a35c37717f30fd733
SHA512 052111eafad3e2bc82b6e3977c1d09f1c8dbedf0be0b63134b24fbc0d9211bd4fab009e304be7b61862f8944caaead4b01689b5380cb11a07e819cfb44ce389e
SSDEEP 12288:5fX7WcsnSBnP32EXbS0qboDfsx4gnvOZbeT1z4H+PsHe:ZiHnI5/UPvOxeT5PsH
TLSH
T1A2D4235E464584CEE796E7FB5A2D295CCE232D8C1D2BDF8D13F07920398A968870C60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 ed3c4ba9eac6ef3dc641cd62a54ebf07b0be790a4412e8f444c9970fb5fa698a
MD5 9d3467ed73117ddea859b11e4be1e2cb
SHA1 d26bc87c1aa7f8184570eae8d421e7c601b566dc
SHA512 e783ea6683d6b8c8c15ce8b391792242100b1edc28ba23a32ce77d01b38721ff6e26d5ac9c106140c22e10d50e806c2b6efe0e8e4ff76d488d668ef54950bd6f
SSDEEP 12288:6PsfUUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:Ret/px5fIW7guzjGB7HtTlK7/g
TLSH
T14EF4F059E28802A8C12EA67ACB514A44B3333C1697E1D3CF27D0F93D1F7A2545DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 a0f92926d34c72363ee343084484bfb530bdc1cc8a77b5b7b14ce8d75eaa928b
MD5 22b69f91981577022f47e291ddc53104
SHA1 54f07273572cdc452afacae21fd81e0c6c3bd80f
SHA512 ba6200460559852c53bcf11128bf47d773cf242f5e23a9c2fcac8ad49615e5fa82603c08a78e874bbddde3e98ce07fab733770f05981af96fb6802b901e5ff53
SSDEEP 12288:Bp74UXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:PKt/px5fIW7guzjGB7HtTlK7/g
TLSH
T17AD4239DEA8E5211CB3CDF7F475454182035371A5B14CADF3A6C2A682F2A14C09BABFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e7ad13e069ae072d9775153c7df9fd3844430dc9fa45c5cc4fffeab0cbba72a3
MD5 427bcbb9299e20f548da259c3e6bda7e
SHA1 bd9c3ff627b66e4f8b4a40ccb773c6302d00935a
SHA512 ff5249bd00511708fe1298cb4d4149aaf22f24a590ad91eb46e79d40d5d3b6d43f70e713aa563d24e5a8ea23176d2951cc94142f6d758a9fb21d8dcef057fb44
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYtt/px5fIW7guzjGB7HtTlK7/g:7gb4mBIBhGFI/LpIgpzjGB7N5K7/g
TLSH
T17365AE1E22EC02F5E1F9E2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 c496fffd395fe10d8ca5409186d3f20ebca415cc85eae95bc305fdedbb1164c5
MD5 bcb646f652fa5a8a4beb99dc42c4c877
SHA1 ffce9e57b4dd5f4e7e53a4414d50af23a67e496a
SHA512 93cbf4f4e29032400b2748c68650dd728d86f0f7b363aee61ed2bfd1b8d592df58730440a66afd05579ed7c8ac9fd5d92ead10e5639743efb0340ee446010eb4
SSDEEP 12288:KsGOUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:PG8t/px5fIW7guzjGB7HtTlK7/g
TLSH
T14AE423ACB4DA3154CB3CCF3F4A60585A7470321167245AFF0DE8A9785F1A1D8223EEE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 0cd15a5ca5e74ce203c743d345addc55225a6c81676a952651bea216e78421e4
MD5 51fa3c00c0b4218a83826dfc7f9720ef
SHA1 c32d7519688bdbc555379d9ffb21e57d29922ccf
SHA512 b4b779f91a77a3dbd85e47c7d9db738e40be9a1ac1fae9b860b224a9cc959f2c34d4183e07af0faf5b7e6ff120d430f8340246049d3fa9903e00ba3390cd5eec
SSDEEP 12288:5hUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:5lt/px5fIW7guzjGB7HtTlK7/g
TLSH
T183D423DCE94A5211CB28DF7F4B50595C1030370667258BDF3EAC2A682F4E1DD16BAAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 585aa97372822c7bb86f4d0fb612f6ae9c33cf63271ee468d23d22ed216d9f08
MD5 ae66c0e10ac686ef0b2cca5b43858280
SHA1 8f02fa4a06392035f3e6ded719644d54eb06c784
SHA512 a1ed5a29ea47a6190c50e22b8c1a007457155138229efa4b6e0f9b3050a004c40ad8c6be193c838ead1c5cc4c269a0c123d5bafebc6b325727bd091adf31ee40
SSDEEP 24576:it18u8FpJqH1ezria7/mTt/px5fIW7guzjGB7HtTlK7/g:qKZFPqVZa7/e/LpIgpzjGB7N5K7/g
TLSH
T1D535F169B6E102F0C47BD1388A824667F6B1B4251364EFDF0BAC8B551F236D50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 b513b0cb56103708c3ec63a9dec069553f87436ac1936b754f0c2dc402f3178d
MD5 28f69170b291c80fac752640e01b80c4
SHA1 ff8253265a3d7da898f45643421ae3193fa65935
SHA512 dcf26e82b0ed906cf8004c1d0cacac45df4c3a26106b159eb16d83dd43b5a62408aff50dcea54593b7616c53cc528b24f28455d482ef8f136ed20f822490cfd5
SSDEEP 24576:zPUr+NQbt/px5fIW7guzjGB7HtTlK7/g:zJQZ/LpIgpzjGB7N5K7/g
TLSH
T1A005F16F66DD18E5E67AE17D8A81860DE67174521712D2CF02E0817E0F27AD87D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 1fb4020bdc5928a9f2c98503036a4dd3fe347a9f49875a755f779de85972903d
MD5 93f66cd2c14d515968870f90aca00031
SHA1 79743786d97872a50c029a7a72a7dc5868c8cc44
SHA512 51ce326eda4bd9054a80efba355f885dbce9101aeaaa13a16744b373fe7ac9b2f2e95d68d4392c6f67936e62e42907744f4fb6a80fdeb339bb30b6b40c61b231
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjv/LpIgpzjGB7N5K7I:JG05lO43bWxzj1/
TLSH
T12BD5BF6E62EC11F9D1BBD17CCAC64A0BEBB23415032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 4e80cbdece1068eec7e4cfa161e152cf6216c1a4fdd6498c2ed890112ed70391
MD5 c663c27fc6e2aa968d86a359fed79210
SHA1 1d2678482da95f25a48edca593438bcbe48d2b19
SHA512 c2589c13c7abe20c2dd690db5b775e7f3654d0256b6e5c6ae904bc09acf185bdcd941428470c1d42ee35fdb829c52d869242eabccfe22602bf8f5df6f66ee0c1
SSDEEP 24576:0sa5POZ3dpbWVM50JicR2hG0lasx2+47eidn4t/px5fIW7guzjGB7HtTlK7/g:za5POZ3wJt2pasx2+my/LpIgpzjGB7Nx
TLSH
T16965BF5EA6EC01D5D579D17DC683461AF5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dc94dc24a954eb2724d300ef4b4347468cf417b47b04467a9d7ba7e2937844ad
MD5 a3e9960de5b847918cde823bf007b716
SHA1 77f492c663dc2ed5f8fd779a377ec89ed6160d97
SHA512 3d4a2d41fbe9b4924280a65c7367db111734cbcb6f4ecccd0a5ab785eee22be529e2b8bc9ba204959b537d05dd7046ed4b4a9ad22eb4e5dab3d277004c5194ab
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7Fkrt/px5fIW7guzjGB7HtTlK7/g:ENc/zEOVHFq/LpIgpzjGB7N5K7/g
TLSH
T105858B1A22E901E4E5BBE1BE89779546FA71786513308ACF0291851F1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 ea9177e5508ad19452e13e1c728e253b6234f9938e1c7b4d239a2bb77010d7a6
MD5 1e50bf9588e1bc4d7bd19cc4b44de7ed
SHA1 9d842b65119a3d4486be87b4fdd33eb5f480415f
SHA512 8c5fe3852eac467ecdaf6346c8b98695aecc1b19c6f87afb4e1b57e976cfeb4c63a9d595ffd2d4d5883cd4466bacf4cea009fac5d8422a439bdf8507d55a77ae
SSDEEP 24576:QJnJPbzB4SCt/px5fIW7guzjGB7HtTlK7/g:QJnJv6Sy/LpIgpzjGB7N5K7/g
TLSH
T1CF15E13DD29810E8D4B7C2B8815A1B59FE31386D2F2169CB19B8D5343F12FD0AA79F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3b38114238d9bdca769ab9483444860ebb3c1c51ec8ee5bdad44e41f088df2d8
MD5 4db38f352fc0f7d4d52f3ab6e8097e53
SHA1 19485848b558832790a0425945eed3254411aa75
SHA512 3957b7099677755c3e174813596667a3076d3d3aca9d776cdffac822ebca6214236711cc70da946e213c267e7ef30d1d9c86270c8678964d4b8c74fb61ba5fdf
SSDEEP 49152:VCLHGeeV5ijCmlDWDk5/LpIgpzjGB7N5K7/g:Mnxzj1/
TLSH
T177A56C05E7EB4184E8F3CAF5CA2294169A327C549B34F7EF4E80C96A1E32BD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 4677fc0cca2ee0c148129503b24282b8821965aaf52192da55f63d0e9f8b0cdf
MD5 656cb24575be27eb6ae57d16d11cc4e5
SHA1 694db389358b8d9115b68504ff43c50d6f027032
SHA512 ffdabc3dda1fb646d7cc643475d679f0067e54cd11fd4301090fdb317ee665a64a2daee2b8510ab628c8131d2794c3c87e9866f81e982929dabb8ee013dc381a
SSDEEP 12288:S1Hck6j5ZI7VUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:O6DItt/px5fIW7guzjGB7HtTlK7/g
TLSH
T138F4015C73AA10B5C16BD03E86820505D1B2B17197225ADF0BE8C9BD5FA3ECCB93DE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 1863f9351df09df1c49fbe7be67eaceb7e88569b069744c9897365b9fb1333f4
MD5 50c1f25f6917727a6179e8e28b74efab
SHA1 d1ff931f9cf086a90c1ac575b65abf642db2dfe1
SHA512 12bfdb2ba13f868301c318046385ed1c80b4658169b21a763f7f74e2e5396bf677af04549bd3ea6cddc99299b45df2c3f5e75f6fcd9d5abd80158cb766e433ad
SSDEEP 12288:5G6kywUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:wtyCt/px5fIW7guzjGB7HtTlK7/g
TLSH
T123F4234CB7882194CB798B3E8B61419459307C116B2187DF2AE0FB3D2F367C86975FA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 15409c4b122e74725da1ff97aecb8f96f220ec2e0bc7ad465999d5ceb4dcea97
MD5 1f32e7b4223be308b56c51f0ef827c06
SHA1 eb04b8e6cb9b0bf96d602a6d033ea49824579ab5
SHA512 b71d6c1fd8e9344d1997ca8890306184c60d07047071c44c8c4ce424fdfebecb690fb7983b8bf5622c95ebb756c356fdcebaa406c2c95bff5660875290019500
SSDEEP 12288:/0RUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:M1t/px5fIW7guzjGB7HtTlK7/g
TLSH
T1CCD423DCF94A2211CB28DF7F07505948103036162B259AEF3EE86E785F1E1CD167AEE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 7d18d5de601e37ca92af306de71a91ef518a5d6a25c269945e88b8c2b883cdce
MD5 1e7e0e031f295180b8a04d2a5db0d5ef
SHA1 a72fa9448d7d83f894e4058fbc164693c076683a
SHA512 439764f34609d9400e279451df8c81e7fbd3f5d89da9525f6bc9657c9f7e1f89e83af1e029e297bbbb1eb6a923b5d2fd7254669d0f486b614e6ab1b5eb52814b
SSDEEP 24576:oSgHLoTfaidZvt/px5fIW7guzjGB7HtTlK7/g:Tg8TrZV/LpIgpzjGB7N5K7/g
TLSH
T149559D1DB7EA05CAE2B2D639D9621493D633B4315772C6CF2448C0394DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 b1090b12e4e80c2103d52b2a5dc2ea40dd6fa4ea51480a24a97075e08473f114
MD5 5af2bcb629db63d2b125734ca9e81cdb
SHA1 1fc126ab5365c832fa4a83d195002a112c71b859
SHA512 5dca42c325f55f7900a34368b838acb938abc5ebbc7cb433e89aed16cd00f6f99ce5f505b12d56f7d29330dc9f26968090ccbc9538814a3a5632c0002a0f2e08
SSDEEP 12288:hpJcm8CNaUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:hrcmRwt/px5fIW7guzjGB7HtTlK7/g
TLSH
T15305F14EB6AE00A5D27BC23C89814549E6B37031272257DF06A4CB7D4F17AED7E39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 01a08c7177babd759b4e4654bf5f9a021ec40c4731d1573e0175eaab45b48b0b
MD5 faf68e432a82630586d422b4ee341002
SHA1 e33938b5d5715b095453f4572bf21ba21152316a
SHA512 4db8d88e4732f2c4358e1b0b4d779247e5e7cd9efc06be2005f5d90b8bb3bce4a1fc0e4aebc7fdca32340d7b4f9c4cc5a5f7217fee79ce5e97ba3d4adbadafc2
SSDEEP 49152:hDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3g/LpIgpzjGB7N5K7/g:S3Upow8sBVxzj1/
TLSH
T146A58C3DA2E800A8C9AAC379C54213A6EA71742E3F3055DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-388-0x00007FF7BC2F0000-0x00007FF7BC592000-memory.dmp

Download

memory/200-321-0x00000285EDDC0000-0x00000285EDE26000-memory.dmp

Download

memory/200-322-0x00000285EDDC0000-0x00000285EDE26000-memory.dmp

Download

memory/200-320-0x00007FF7BC2F0000-0x00007FF7BC592000-memory.dmp

Download

memory/1076-385-0x00007FF7FDAD0000-0x00007FF7FDB83000-memory.dmp

Download

memory/1076-312-0x0000029642680000-0x00000296426E6000-memory.dmp

Download

memory/1076-311-0x0000029642680000-0x00000296426E6000-memory.dmp

Download

memory/1076-310-0x00007FF7FDAD0000-0x00007FF7FDB83000-memory.dmp

Download

memory/1496-12-0x000001EBA6A80000-0x000001EBA6AE6000-memory.dmp

Download

memory/1496-13-0x000001EBA6A80000-0x000001EBA6AE6000-memory.dmp

Download

memory/1496-14-0x000001EBA6A80000-0x000001EBA6AE6000-memory.dmp

Download

memory/1496-61-0x00007FF6F9F90000-0x00007FF6FA0B2000-memory.dmp

Download

memory/1496-11-0x00007FF6F9F90000-0x00007FF6FA0B2000-memory.dmp

Download

memory/1752-339-0x00007FF78C780000-0x00007FF78CAA0000-memory.dmp

Download

memory/1752-340-0x0000021ECA460000-0x0000021ECA4C6000-memory.dmp

Download

memory/1752-344-0x0000021ECA460000-0x0000021ECA4C6000-memory.dmp

Download

memory/1752-338-0x0000021ECA460000-0x0000021ECA4C6000-memory.dmp

Download

memory/1752-346-0x00007FF78C780000-0x00007FF78CAA0000-memory.dmp

Download

memory/2484-300-0x0000023315E70000-0x0000023315ED6000-memory.dmp

Download

memory/2484-443-0x00007FF739500000-0x00007FF739916000-memory.dmp

Download

memory/2484-441-0x0000023315E70000-0x0000023315ED6000-memory.dmp

Download

memory/2484-299-0x00007FF739500000-0x00007FF739916000-memory.dmp

Download

memory/2484-301-0x0000023315E70000-0x0000023315ED6000-memory.dmp

Download

memory/2484-378-0x00007FF739500000-0x00007FF739916000-memory.dmp

Download

memory/2532-25-0x0000023F79930000-0x0000023F799F1000-memory.dmp

Download

memory/2532-28-0x0000023F798B0000-0x0000023F79916000-memory.dmp

Download

memory/2532-26-0x0000023F798B0000-0x0000023F79916000-memory.dmp

Download

memory/2744-55-0x000002A5F71A0000-0x000002A5F7261000-memory.dmp

Download

memory/2744-56-0x000002A5F73C0000-0x000002A5F7426000-memory.dmp

Download

memory/2744-57-0x000002A5F73C0000-0x000002A5F7426000-memory.dmp

Download

memory/2828-349-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2828-276-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/2828-271-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/2828-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2888-233-0x000001B812260000-0x000001B8122C6000-memory.dmp

Download

memory/2888-232-0x00007FF7ABCF0000-0x00007FF7ABDB8000-memory.dmp

Download

memory/2888-234-0x000001B812260000-0x000001B8122C6000-memory.dmp

Download

memory/2888-309-0x00007FF7ABCF0000-0x00007FF7ABDB8000-memory.dmp

Download

memory/3396-34-0x000001B9172A0000-0x000001B917361000-memory.dmp

Download

memory/3396-36-0x000001B917490000-0x000001B9174F6000-memory.dmp

Download

memory/3396-37-0x000001B917490000-0x000001B9174F6000-memory.dmp

Download

memory/3396-35-0x000001B917490000-0x000001B9174F6000-memory.dmp

Download

memory/3472-366-0x00007FF6EADA0000-0x00007FF6EB4E3000-memory.dmp

Download

memory/3472-284-0x0000022EE00B0000-0x0000022EE0116000-memory.dmp

Download

memory/3472-283-0x0000022EE00B0000-0x0000022EE0116000-memory.dmp

Download

memory/3472-282-0x00007FF6EADA0000-0x00007FF6EB4E3000-memory.dmp

Download

memory/3504-377-0x000001B2CA270000-0x000001B2CA2D6000-memory.dmp

Download

memory/3504-380-0x000001B2CA270000-0x000001B2CA2D6000-memory.dmp

Download

memory/3504-379-0x00007FF670020000-0x00007FF67014E000-memory.dmp

Download

memory/3504-447-0x00007FF670020000-0x00007FF67014E000-memory.dmp

Download

memory/3620-292-0x000002EEFC8A0000-0x000002EEFC906000-memory.dmp

Download

memory/3620-373-0x00007FF6D1DF0000-0x00007FF6D1E9D000-memory.dmp

Download

memory/3620-291-0x000002EEFC8A0000-0x000002EEFC906000-memory.dmp

Download

memory/3620-290-0x00007FF6D1DF0000-0x00007FF6D1E9D000-memory.dmp

Download

memory/4272-359-0x00007FF75BF10000-0x00007FF75C3E0000-memory.dmp

Download

memory/4272-445-0x00007FF75BF10000-0x00007FF75C3E0000-memory.dmp

Download

memory/4272-358-0x0000023FB62A0000-0x0000023FB6306000-memory.dmp

Download

memory/4272-360-0x0000023FB62A0000-0x0000023FB6306000-memory.dmp

Download

memory/4280-391-0x0000016C9A690000-0x0000016C9A6F6000-memory.dmp

Download

memory/4280-389-0x00007FF6F2410000-0x00007FF6F274E000-memory.dmp

Download

memory/4280-390-0x0000016C9A690000-0x0000016C9A6F6000-memory.dmp

Download

memory/4280-448-0x00007FF6F2410000-0x00007FF6F274E000-memory.dmp

Download

memory/4416-319-0x00007FF7ABCF0000-0x00007FF7ABDB8000-memory.dmp

Download

memory/4416-243-0x000001B99E670000-0x000001B99E6D6000-memory.dmp

Download

memory/4416-242-0x000001B99E670000-0x000001B99E6D6000-memory.dmp

Download

memory/4416-241-0x00007FF7ABCF0000-0x00007FF7ABDB8000-memory.dmp

Download

memory/4432-330-0x000001B7C3D40000-0x000001B7C3DA6000-memory.dmp

Download

memory/4432-329-0x00007FF612820000-0x00007FF6129B4000-memory.dmp

Download

memory/4432-331-0x000001B7C3D40000-0x000001B7C3DA6000-memory.dmp

Download

memory/4432-440-0x00007FF612820000-0x00007FF6129B4000-memory.dmp

Download

memory/4512-251-0x0000026858880000-0x00000268588E6000-memory.dmp

Download

memory/4512-328-0x00007FF6E5300000-0x00007FF6E5419000-memory.dmp

Download

memory/4512-249-0x00007FF6E5300000-0x00007FF6E5419000-memory.dmp

Download

memory/4512-250-0x0000026858880000-0x00000268588E6000-memory.dmp

Download

memory/4700-50-0x000001DF86790000-0x000001DF867F6000-memory.dmp

Download

memory/4700-52-0x00007FF65CEE0000-0x00007FF65D047000-memory.dmp

Download

memory/4700-45-0x000001DF86790000-0x000001DF867F6000-memory.dmp

Download

memory/4700-44-0x000001DF86790000-0x000001DF867F6000-memory.dmp

Download

memory/4700-43-0x00007FF65CEE0000-0x00007FF65D047000-memory.dmp

Download

memory/5064-0-0x00007FF6E8E50000-0x00007FF6E9052000-memory.dmp

Download

memory/5064-2-0x000002BFDD650000-0x000002BFDD6B6000-memory.dmp

Download

memory/5064-3-0x000002BFDD650000-0x000002BFDD6B6000-memory.dmp

Download

memory/5064-1-0x000002BFDD650000-0x000002BFDD6B6000-memory.dmp

Download

memory/5064-19-0x000002BFDD650000-0x000002BFDD6B6000-memory.dmp

Download

memory/5064-22-0x00007FF6E8E50000-0x00007FF6E9052000-memory.dmp

Download

memory/5828-367-0x000001AD07FA0000-0x000001AD08006000-memory.dmp

Download

memory/5828-368-0x000001AD07FA0000-0x000001AD08006000-memory.dmp

Download

memory/5828-446-0x00007FF796DD0000-0x00007FF7972D6000-memory.dmp

Download

memory/5828-372-0x00007FF796DD0000-0x00007FF7972D6000-memory.dmp

Download

memory/6020-337-0x00007FF704410000-0x00007FF704559000-memory.dmp

Download

memory/6020-261-0x00007FF704410000-0x00007FF704559000-memory.dmp

Download

memory/6020-264-0x0000011C75540000-0x0000011C755A6000-memory.dmp

Download

memory/6020-263-0x0000011C75540000-0x0000011C755A6000-memory.dmp

Download

memory/6052-350-0x00007FF75D470000-0x00007FF75D6FA000-memory.dmp

Download

memory/6052-351-0x0000029DA2000000-0x0000029DA2066000-memory.dmp

Download

memory/6052-352-0x0000029DA2000000-0x0000029DA2066000-memory.dmp

Download

memory/6052-444-0x00007FF75D470000-0x00007FF75D6FA000-memory.dmp

Download