43619cd9431f4fe45a7fffcf86dd09f9e411750371a4370bdd021c7044786266

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
Size 2.3MB
Sample260723-jjd49syvb1
SHA256 43619cd9431f4fe45a7fffcf86dd09f9e411750371a4370bdd021c7044786266
MD5 ef7b34cf0c32562a636090fd9b9f7337
SHA1 1271467cc9648416d71fb98705427f623fc1c08f
SHA512 b04d858d8a77048283a554ef6d25bca38e0523c201172d2298039717f400ed5513dec0d41b1ea3d7b21cc552097c2564feb13fd5a16ab5244eaf564fd0f0ea2b
SSDEEP 49152:i8krRUCwl/rpC3qi1kjsVc2ot4+Ej2EsjKYDmg27RnWGj:I66kjsVc2ot4+Ej2EBYD527BWG
TLSH
T1A2B5AF28F64892D5C07AC1BDCA8A8B4BE7A1F40947349ACF509506DE1E737E44D3FAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2728	elevation_service.exe
3940	elevation_service.exe
3812	maintenanceservice.exe
5668	OSE.EXE
2824	PerceptionSimulationService.exe
4604	perfhost.exe
1752	ReFsDedupSvc.exe
1372	SensorDataService.exe
5424	ssh-agent.exe
584	AgentService.exe
2856	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6360db0523e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000717945be761add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091e203be761add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec8e20be761add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf9990be761add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007238f4bd761add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe
2728	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
840	Process not Found
840	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	1752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1752	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	584	AgentService.exe
Token: 33	2856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2856	SearchIndexer.exe
Token: SeDebugPrivilege	4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4544	2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2728	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4824	2856	SearchIndexer.exe	102
PID 2856 wrote to memory of 4704	2856	SearchIndexer.exe	103
PID 2856 wrote to memory of 1608	2856	SearchIndexer.exe	104
PID 2856 wrote to memory of 5124	2856	SearchIndexer.exe	105
PID 2856 wrote to memory of 3992	2856	SearchIndexer.exe	109
PID 2856 wrote to memory of 4936	2856	SearchIndexer.exe	110
PID 2856 wrote to memory of 3016	2856	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_ef7b34cf0c32562a636090fd9b9f7337_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4604

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1372

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1876 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1876 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f099085132181e55e72c8204de7ed754dd8903885c8dd87abb1c0841081c9723
MD5 12666aa51e14ef0a16a41b4895d50fb0
SHA1 9843e541ea765e2fc11ce8895fe3ef9eea50fa55
SHA512 8c4cbe26d776233f66ad203f4e5b72c8dacbc17b4ca75062bd4323e3ab8a342213e12685af45ec499154824011971d2aa7491e02b18a0260192cad746711b2d1
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnoDmg27RnWGj:n3q6HjBvD527BWG
TLSH
T18DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 7fc8dfe4815d95ae0e26a7f4bfc6a6e4137fed6aafa7ff1bdd89e1350ee94f00
MD5 45b18e8d54ba53dbb25d882fa776613f
SHA1 533738016c95f9154eb463f58ff1316a596dc140
SHA512 1094faa8b0b62253a885eb44e86de3e0b6b667e29173851ca44f68eb3a31141650381cf26e115e3b01243dbcdd98e804f11022e3b5c05c86c87dc85de8529fd6
SSDEEP 24576:dXYfDtczAvsqjnhMgeiCl7G0nehbGZpbD:ItcKDmg27RnWGj
TLSH
T15F850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 62063c8fa7af84ea8a8450551bda3febc1c5f6b689d57881896960798301be8e
MD5 387af342f208cd3231cf25f9f9e742ed
SHA1 c9b9e7833bb595ed983c5da07ac92168483fd817
SHA512 74a3386dec6a26334f7d744a2e10abe1b4bf499402da240b3b89e38fa03b376946c3dbb090ffa320b08c46ccd62eaeff8c229ffe356e2697f55f5e4c8df9da44
SSDEEP 24576:O0Le5ji0hmx3rMksqjnhMgeiCl7G0nehbGZpbD:OPji0AZJDmg27RnWGj
TLSH
T138A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b06062edf3f4b03ecac7fc204b91dd960760b9e4d7d92d8985ffefd52e26d277
MD5 03b69e3d95b62c634265e99ae062f17f
SHA1 f0f3888f8e1b014c95ec473a19c59b6e15fdb37e
SHA512 e94dfedce2b1d2dbc2eec9f7b595d2de3a4e417754ee4ea3bc599deac51d70d76937c2f58587f4ccb8b4ea15fec6d9ba799267dd53295b27c7b0a167c6f76d78
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWE6q8wyuWsqjnhMgeiCl7G0nehbGZpbD:S/ezSC6vUzPvxHjyNDmg27RnWGj
TLSH
T10F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e6d35e3e123fab6102ac33d93d8f81159046b78ec785b5c348504abffe64f41a
MD5 b949640a2e14ec5c157f1b10ed7b592e
SHA1 3b0e8318279b647c8429f5fe737c1cb5e208de04
SHA512 12d177f52e4efef11897499b7634fb3b830397b52ffca7dea0847a11bcc97caf51303a1d145b873ae8600d5b89e10d373d09147c714d91af2a0be369567e6008
SSDEEP 24576:kVbqPb88hv/l+6LsqjnhMgeiCl7G0nehbGZpbD:kVO88hXl+EDmg27RnWGj
TLSH
T112559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 c89e9ebb02274be8143b0031fe0da093321a2530094086236da66b2d0661ab67
MD5 eff4d4547117af36b25a81ef5b71c6e1
SHA1 903cd66ba7625e9ea104d0160c2fa9f824ec3db4
SHA512 ca765edda63c5251ae7b40e2edd9d4377cd5d61fe9b5ad463a17b324a4b80428e381ec447203eb3dfac759517a19175bfc51e6f0cacb0c6961e9679e6eb91d64
SSDEEP 12288:6XQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6XQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F6523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 5c7e500f013a96937b61056c88a730ec411d595f010bec3cea35045ba4499e50
MD5 d158712444bf27e862c30f51267d3f2b
SHA1 f205e16ada9c765ea5a08d9eb860e29ed8564a50
SHA512 1d1418a8f1443b12c2015883497171ea07e4020bbe19f691a1390f70e8ffef25ffa1af229985a77eca7637f8799eeaabd31b43a381b21ccbed69bca03deed4e0
SSDEEP 12288:feBNUbTVO86UzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:fJIUzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E285CF7BEE28FCD2C27A4DB85791C600E76278314F61A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 637a8b93c0d7f5773a27a9898b333ca3a4a9698ea8c456d5762c9a1357eee67e
MD5 69fdec9985b8b480550841dfe2a4cf8a
SHA1 c6c64b90e65f2ecc1e2e8b0e9cfbb34d67977b46
SHA512 27aaddc4a465c1fc8c7e6b9b3e653be51a662f099b6ba0a88c3b5cdaf681f99df14d7a17c62e377d6c6605461f078d442881652a1e86a65ac100140d3d10d35b
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:WQvGAdlCEL8c/yRNw5CqD527BWG
TLSH
T154266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 acf0e1ab3d9c06695b4b404230beab61ed81caad9799e906f111417617402735
MD5 65082897df24d15e52b56b6921da88d8
SHA1 bb1bee17667ffe812922ea490cc81143c2870aba
SHA512 58248a82dc98de570c617352a9834b88fc7feae2775f25bf56e3cfaffdcfe80005245800886ef79c7bf2cad5a4350051059917e30055ca40dd5e392c8d239920
SSDEEP 12288:mAwSfxL/2Dc3RDLLmt0LDQewsAjlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:7UewsAjlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D595E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fe562fde1e29bd24577bacf1549b3b71ccccc1542a5a7c807c5737ee5f065c25
MD5 ec2ffab25b854e637053179c350fda25
SHA1 357277e8aeb1426eb43d15e055cffb837a209039
SHA512 472d3e57789f0cfa3e2441abcfb960997fa3313c554da21f4f427103362f437aa332fcf3038a9596550e6d392b6ac76753df83b9d6e5df74deb286305d34bd94
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHhVQBWG:qUEtQevvqc2W1cpV2EI32sB
TLSH
T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1f983f689097fd0643df853a21ddafe7b64af6b6fe0c6204da28111ff2cc6430
MD5 e7bfbbc6b8eae178684180456da554c9
SHA1 da64908be16b8163206bf3f91b375172219a76c8
SHA512 b7867c37135998d0b4cf32abb20dde921740583174fba3ee1cd9395aa34e83ad9f944eb227c5fe756c875906c29197adae2ad718cd2c1408c9f9c895ebac12c5
SSDEEP 49152:DCbRquA/m2yL5zQfFiV+XenmE3/z5Dmg27RnWGj:8oqtVjnmuD527BWG
TLSH
T1B5D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0302b155891baf18fe3f39e6c3d37cb85a0e561f9f74511eb3e8d58eea0d565e
MD5 6514e0bab2cdfc4680d174cb0d18b703
SHA1 3d7cd56055a29daa52db149ab1c985d72cad73da
SHA512 2086c2c9fe4a5f7e0b0ffcd77edf813b784c3ce9893e5b4fb886a421feee1cceaa77402cd08c64dd040edda120a49078df138855f5c12d8435fed257729894c7
SSDEEP 24576:ZAhGLJIFoiwtA5l7S536sqjnhMgeiCl7G0nehbGZpbD:ZAMyFoiq5+Dmg27RnWGj
TLSH
T177359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 20a3ac43c06f126a73f42bf7e268ef3f28a230c196ee4099293637fd580f91c3
MD5 a82506d49e0752a7cb2f21cbdcddff2a
SHA1 586f899e9e15a47eca6d88bccd5cd3ba27c68ca2
SHA512 842fdc8d8dfe81b0f9e7aeabd141599546dcfb355e64e57af57cf01e1467754b298e877d89683da8fb234a60e2e93c6a35b42af2b713dd7498c682b3dec3b382
SSDEEP 12288:mmw5HEjsChNzBFgl0WDm+C2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:/wuSOWpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D585F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 67a94ff423bdc2d48bc2429f4d3a2d14aed4afa9199cbf35b699d0df18d290fb
MD5 f581c2b92b6afe3e8f73f7a8d4e45fe4
SHA1 ded4afec8605cd66e2817d278b7e6bd67f822879
SHA512 986401a1a520035941ef701acfc107bb1a7a43d22f91dafe0a213d6bf63ca7e250e71c78a5cc4f880e27e8da102b57c50ecb1e553f895c76da58d884d677977f
SSDEEP 12288:IzZ1Iy1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kZuMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B7512AE239820FAE163417CC5E5D609E7333C62673043CF16625AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7b75564f9b3ece8ec12bd154cf591f1394b5b73da730e600a9a6f9e6595b3634
MD5 e06321eb5ddaa6e3c0267019c85a368b
SHA1 fea61beea6a039bee32c4af018360559fb0fa12b
SHA512 e724804b10ea4ee8a516e4fd1337d40a58a288afaa6f85e044f7e3f8bd77acb8f0dbd7f6252daa1f728247ccdfb636ad7ee77dcef81e0fa963e384b2f4e8adec
SSDEEP 98304:iQRQyi36YOcPQLvw2gAf+PN3LD527BWG:5QyiKayX+PN7VQBWG
TLSH
T11A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6961995826f47fb846d1d23429d5de80932487bf0f2318e1e46848dacfa33771
MD5 d8feab9c1934d915792d684a7f251d4b
SHA1 e02d34f0493fe7c503a3012abdfc8b677652545d
SHA512 536fc3a5efdf7a1692ed70ab3363c7cb6bff50a5623af879368728fd9a38da1989d8d30a919532fafa07506367d618a4a480745f3a516bea1f3da5836421d835
SSDEEP 98304:+QRQyi36YOcPQLvw2gAf+PN3LD527BWG:lQyiKayX+PN7VQBWG
TLSH
T1B0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b691632ffef92d287898f602415b4c92805f174b55158cfa80549f604ed5701e
MD5 564d478b754f38009f603c9539504a96
SHA1 89958c7483715a8b0e43f593cbdb87e6fbf6d37f
SHA512 9ac9393ce4b6d5b758e41da50f7a477866a196bdb5d3215b22b85151880fd9271a955f4a70636f28b06bbb52500331f00d002922ee0ee0bacd8f59b314fa7aef
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL08sqjnhMgeiCl7Ge:N68Qg55nhheWu7PNU3/JDmg27RnWGj
TLSH
T189B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 475d3a8966db0a3a17250ffee1054c1af46dfbdacc6292fb79a9fd33531b04c8
MD5 7cbc56780411d562dfefde521f572701
SHA1 c57aca392eec3490b3304adf0548589ecc22738e
SHA512 996d6b2593b49faa5a03940961ca576824efb93cc305bd2f20f3055716629d66c7ef4648e9931162687f7d9759d8387043637ce45ef8a8b90c6e4e99c0c9a23d
SSDEEP 98304:cy5112gYy5azzVvL69nLKnhZMD527BWG:dLIHmWh2VQBWG
TLSH
T1BE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6e549b70d328c44c3c75c3244439c9e49a1404c5bce89ac8e3d9ef07b9f91e6c
MD5 4888d742fe16a537f9a213141158dc43
SHA1 57ac528d3454e660a81d04e3ffcf0cffb32fe335
SHA512 f185e16199c758b197538d9eeeb2477fbb8f6d1fb3f9e10d27d828fd1ebab5a9a9624dc137ec480de2b19cc940958abbb6e1d356713dd668a0e4a7ae2aff486e
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glDDmg27RnWGj:/u6JmVxd2dDD527BWG
TLSH
T1A3D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d17e29c2e565b0eb3edd0783dc27343240ed90c2da44ba343f8509583b97d118
MD5 8139001bfdd17e890140bd9208b3c581
SHA1 5071f5eeea28d1e2a949e38810cbc3bd86a103e0
SHA512 aebb619d7ed4a366a26a93be7fc3e0e9f7d39ee2bd8fd2eb42befbc166f27ffd10f3c01d4f26cdc9a686a5779da1983f1a3003ab5a2341967e7bd558151549bc
SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xXDmg27RnWGj:ymifPbRuD527BWG
TLSH
T1C3B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 982fb944181d0408879f1335bb7a650fc17345d582824af43afde0cdfcaac740
MD5 7f7292fb46c0f3ab5ad15686761b0481
SHA1 46e03e83e1cf400e3c0354197e10cd94f551fc2b
SHA512 b23edc491a1b638579890584cf3b12fe9688a64b161753615aa60b517226f70f715fbe324e5577953f873f2ebd131e4d078d199830faf19c18b32b7017c7742e
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHq4Dmg27RnWGj:N5dKTi614D527BWG
TLSH
T126C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b5d0867822f404828bcb53a555074ffdd082552131d927458eb0d9e449092d6d
MD5 52f2e378b34c901f4f8f765f6c8938da
SHA1 cd4fd6f803141422d8fd782d8b31f38a71247088
SHA512 86b71233c91e0e06a75569dfc7399b861d426a7d2863ce7a72271aaaa7696185a2620217237ff361c821e706b8caeed594348900d991dd621afd6e9ac80f7b33
SSDEEP 49152:9htSn8EApI0figngiDn0AP5wTDmg27RnWGj:sX2iyphyD527BWG
TLSH
T17495BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 577126e7e372a60308aedd76bd4c1227afc5e5641288c6ea2d82af0883c83d3f
MD5 daa2c8407c799067161a935222dc1259
SHA1 288351b3722b4d68b3da54534db8f7136bdba6f0
SHA512 d96c24a895db007c311b8b31e84dee0c5db6d38c0b04d7173036185a01da3620227fe79c7396cf2f2780f4f26b425197ad3ee8b37a876fd04bbb7a041234c782
SSDEEP 12288:sYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA6523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A677CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 4892e258e23259a095abcc1bf05ec7b151496d14169cf22486c8098bed0234d1
MD5 51199f233d39cc31abaaca7edb827af6
SHA1 ad1ccf0be9c3afa5732597cb76db7cfc4b170da3
SHA512 191bbcdf80a7b2db5eeb63ab399a48d0ed0aaa475c76af5c9de0c52cb5301eae375175e48ed24e9ea88816d3e23a573e182b933d479e12642f2bafced23999f6
SSDEEP 12288:bhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F6523BF955C41CAE52608B5C3E5F14DAC073E6BE92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 56f7616765c696f02836ce7655e964827eac7d8eedc8d7b19770b0ca9dec1bb1
MD5 5160aa10f986239c49f33a8c117e5442
SHA1 359012fc5583b9a628c0a0256fb1575f62564c8f
SHA512 4b79ee39a490b35fbc00252ac3437675d00ee3ace462f7d89cabb5a1ff4452d973d954ca92f23eabb63851d974eb5877a654d3dbf12034f32c273a2464b62466
SSDEEP 12288:47Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:47sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1396523BE955C41CAE52608B5C3E5F14DAC073E5BE9200493BA977CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 47a1ae61cd99e556001ae464d0f4b54e4da1e0c79f0201afb5323b108039bfe5
MD5 b02bec1ebd73a3227c2070f9df7a8b0c
SHA1 09d8efdfb1baea8fba4819752aea525c16c271c5
SHA512 e56070735399ef896e5374ec3953869813dbb6e50b17eb59b329acf7c9aa52b4b4720e51de92f6241327210d155e51c59957cb789558c1371e195aba54886d1e
SSDEEP 12288:TVaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E75237F535C01C6D83285B4C2E6E11DE8277D56EB3005DB6B532CAEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 eec79ad7c33480d1f5596cad2f904e17d0eb030755429c8f1552239617becff5
MD5 b89110e662686ba9433c507f579c1e4e
SHA1 0fc3256a65bbe761c68736370971de61f9110a5c
SHA512 a9c7fb5d33944d46f31369fa9c595c1c8825765fdce4bcd08b0609f30b2b32edc80cbb64ba9e5af5c4666b9fcbbf6c30b56bff8fed16ef3dcb3527188c1636ed
SSDEEP 12288:GSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1096523BF955C41CAE52608B5C3E6F15DAC073E5BE92004837A9B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 ba43be15707b2cd35581bafc3aac4fab68b2e15cded4dfcf0217ab8fa5ba02d5
MD5 fda77b5e75171c337be93a5cf4916e0e
SHA1 5a214cdeb0c975aea123af13aef77f53a8fb9824
SHA512 c5b0c37c5909c66dfd4bbf74c0d624dbf525fd2fdc12261f3919c94071630b2b49e5f840f80c70c53dde66b7c56ecbf57cd6f3645b7af5d14bf2236030c8ce7f
SSDEEP 12288:YNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A26523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 7a2a08eb9ee861d74c5bdb2278e5d999e903061ef3d27180dea2d83f6f783559
MD5 69d8804a51bc5b51d8213c2228521034
SHA1 6eeb4aa78b33d13332854a6e0f5f2a3ae64a736c
SHA512 b4ae339df0f2f715888a1e5f2f0b9601a1c0150a74c64686749e5da71e39155b4c4532ea5a6428bdbb04f04828bfadfd3e734ea408063cf5a0bc20a7ccc24c59
SSDEEP 12288:NZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A6523BE955C41CAE52604B5C3E5F11DAC073E5BE9200493BA67BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f183ab519efd737a3c8993f0502b8cf287b7220db698f6d76b120f05c02f477b
MD5 f7c83a4610fdc02f082d3e6e8d6fdf0d
SHA1 7b2e3420bba7da68bd26039bfc4aeffce11111f7
SHA512 8143ae96bde91f1ea3f6e68fd95b01f749ecc22632a29b7c96f3fae10fa079561d1c509e436682bea12fdd99eb7313291ef5a0d0a3eb26bc5cb5c8a77f673dfc
SSDEEP 24576:nZMjzFVSOBsqjnhMgeiCl7G0nehbGZpbD:nZMjzfBDmg27RnWGj
TLSH
T1CA8501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 c6fd823c5e56f2704f734007cedd07521012e8eb38897da68486f5ea2a6195ff
MD5 896cbd57db9cea449b6fd79834b0e6a6
SHA1 dfba9abf47fbc82ee8c314a915385a023c9dbe79
SHA512 ec86d79257a61c9a4b7840364a932d3ae8c746e9253cb4a26569647d6955b140db8a575771314b2e7551572757bb126a0f07d05b1835e7918bf05a6fa49dd8f0
SSDEEP 12288:mcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1596523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 8f6dbc92e323ac8fd7c87f4c99904574fe647f1a0a2db5d071b8707dea3ada10
MD5 28b8d964adb9d0d03b21fe0490f03565
SHA1 852dc503d58f91772ce936c9be3665444bf0421e
SHA512 a92d0d12ffc49aded00055fc736d418842d33c7b47c47903969142f14782a9129260e222965bb49bfddc853484ac051a9dd0d2006486a2b9138ff0a6ef952c47
SSDEEP 12288:agXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:agsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1286523BF965C41CAE52604B5C3E5F15DAC073E5BE9200483BA6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 34dee9f3771ee6de6d3fc4a7529162bdc7d19e29c5d3fb627e289cd74756bb74
MD5 cca1375fcb17f97fd3ccc01aaadac2e6
SHA1 5b4a7442d8f914b6d1076c6b79615b171e330e92
SHA512 9c36057b8732464ffed001134eaaeb262e2a37d94c8629169b42c74f8a4cb44aef3e69a7b926d8cb005179f124000e8641d9f3351a0fbdb2e9e87c9380280702
SSDEEP 12288:4yPz5L81Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Zzy1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B075125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 1fb3784d2da727bd47f33098a0679cb14eab46272fd62eaa41154bce3fe05cb5
MD5 1c497ec3a93f1b6332edf6b6a1be8f84
SHA1 cc9d2e57305480a2d7168b18e3e3b6310d470f45
SHA512 8cf5a5caff5f0a8aa2bb6c1ed7d0af18363368739e021876ce8a451c76a4a85ad0e992071680738e08172037d2d2c73a86f3e1ca2fb2eb5cff77d27d8960f696
SSDEEP 12288:7cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7csqjnhMgeiCl7G0nehbGZpbD
TLSH
T1096523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 2e9b4386cda113d540197304b77266c92e8b5226b173a531859124499c261328
MD5 606b4a7d33e565fea9b99c0b1433789c
SHA1 cd014a56462b853d84a1c9314f093573eee0dc7b
SHA512 4614800d8b62fefe42c4ea0b40acd7125ce80f4d88eaa152d073a83d3ffb976e6292ff85d640af0511152c903a34c661dcc5060f122adc33a326b39653dadc1e
SSDEEP 12288:tcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B46523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 a4b3631b1e349589d13f483970629f61562cf7a89e2df66d2f5d18fab611f509
MD5 43b22f82c9592ec71da42369e0f9a45a
SHA1 f9d773900bd552d68221491bdf1206d3badaf27c
SHA512 f49947f184317332695879b894ad1704551f8474fa88a70bf63e80d0e3e24dea68cfaf9cfb8025fcd2a0d0d6a22121d37e8199eaa85c4d6b19ea233b061d430a
SSDEEP 12288:NyPz5L81Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kzy1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D75125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d874026fd06200cb65ebfa33a3e34010d2a37052e777fd558cc6db1b2f886c8e
MD5 045f1cb8f921a75db9034e00cb34f36b
SHA1 962668bbb4bc603faf3180c6d01ab73c14ea988a
SHA512 dc9006de68b52f1b312cc0537bd6fe3c7ba43aad39c625e7d7dbef7b4b6941a502b02c1dd5119d369805b78fd60626e47fca0babdf7bcdaf26c2114678dd6823
SSDEEP 24576:fTYaLl3z0zDrsqjnhMgeiCl7G0nehbGZpbD:fTvLljaDmg27RnWGj
TLSH
T1098501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 4a3fef1ce6cb3ba1b62e69367ec55b60be78a31b50afbfb112ab7fa46806f08f
MD5 566d8b2bdb50e15acb397eb0bf498d24
SHA1 fde12d2a6e5df1794983d8dfe7d008b056cb41a2
SHA512 489dc8c6aa6650c32556f95d0f3d324f9093e57b50a90e57c40c26bfcc417a41f8ffc175c9b5f3ffe99ce06cad1914119676515a0f28724e9a29b6e2a776c03f
SSDEEP 24576:x35d9CHKy7GZXsqjnhMgeiCl7G0nehbGZpbD:h5d9CHKyaBDmg27RnWGj
TLSH
T14A95CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 646c6ed49b41e52bdfaeb5ef25d86aff0b4dab23b2e7e2dd6c90e78c278ccb34
MD5 230e77c5612e054e66d8aaa0292d7c6f
SHA1 ba01f4221f9dfb3fd880b656d0fd6f5b2920f0ce
SHA512 a96c0b7d1c25f9c7ca4fac72d0a697b447fdf196781fa723c885ab627acd2a305e58417a73324e3845f38f742abec72993ae8bc257de1a6f81cfc49f70588f08
SSDEEP 12288:WbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D46523BE955C41CAE52608B5C3E5F14DAC073E6BE9200493BA977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 cb0136ae3c6d2a4e770d5c35a9341147e3f2ce836d1f60ecca36878eb78017e9
MD5 7996470a37b9aecee722df74c7fd02fa
SHA1 eed5f1a43b7f31ad36ec09482f7cc7a90b46a831
SHA512 5c877d089d69bb0bead51e04367fddd84cdb23ef877d94c61b68b578d11d229f3737837bb125d28fbd72aa8763fabb264581c61b06716ea3fa2dbe58ff5a9726
SSDEEP 12288:vVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1896523BE965C41DAE52604F5C3E5E10DAC073E5BE92004937A977CBAFBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 ca5bb201951a084daa637c5ceee2efd99082908a00aed6a55a51adcc94fd55df
MD5 67aca80d753783d0f9f398687942a19d
SHA1 73eff96b29a1f12354c6e79521e732215c763342
SHA512 6cc225d2ac7bd99f96b51650132fc41cbc2d5262a1fefee81079837d33835ffb55f87ff23fb7811e817adea705a8343d6f7611e48bed98924500ea85300c71d3
SSDEEP 12288:+uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+usqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C6523BF955C41CAE52608B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 b7a30daa7262a1e19bd91ec77c79c9267c701d4b68857ccc1bd0714b3ac2f7a0
MD5 b35e17fa0dbd9ad11a491eec2aeee2e9
SHA1 4303429c7179755181d6b3ee652cae96db298459
SHA512 4776689f719d02fe7542ce79ae66f6d9909c8b8fba99412fe2553db9e8780ab64365f6fd251eaa188efcc0c8c586d0cb7de9075a6ac898a2783dbc66fff6ddd0
SSDEEP 12288:5cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5csqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC6523BF955C41CAE52608B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 f01036982f8d3280079a0e4d8c3b3cc8f876914ea22adc4315625e0f98b6627f
MD5 541105f9206fe7aa4d1ae509cb5973c3
SHA1 cbbe5f8c9408f6ae15a5229469565de1e2f820c3
SHA512 538ff76dc2d8e69fb39eae8442f8c6266ad8c755d98c39cf77978cba790075f119df231c67beaacc4ea9eb3993d84a2e921eecea1b82ad2248f94cbc92ad271f
SSDEEP 12288:wbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB6523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 3b4f02c337d8b651009b1589cbfb2e2f6b631879cdde48b7a3fbb4812062c1b5
MD5 1e100914f83fb7e9546adb5253336509
SHA1 b0fa7c0fb7f4990f93d883990cb542807fc04e43
SHA512 a1fa0db72e0fbd58dd440747ebab62d507405e4554c78b7832b46955d85518073f5367c57f4fdb7a10a003ded3543ade0e3592647e38d87a5e44aff516e4f076
SSDEEP 12288:6UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C6523BE965C41CAE52648F5C3E5E11DAC073E5BE9200483BA677CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 1bf1d7c8179d6c2923ca9389689b67821db4f192df68eb806ebf75ef75511082
MD5 720fa86d445493757aab97f3ee2cb8f3
SHA1 2d31c9575bcb1e54677993f58760bdb4c2ab915f
SHA512 ebd8c17249ac4d4104448d8891f6dae23cdd86078c33c0090dbd45fad0cf06c333784f55e7f5dc7aab29f2bb7487b38005770ae3039d45f669bf38c60e926134
SSDEEP 12288:DSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1616523BF955C41CAE52608B5C3E6F15DAC073E5BE9200483BA977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 1075505a15e23d50d15f8a955ab1c9e828c3105695c249a7807215cb36d4f366
MD5 da3d3d3e1558ce26b869c4ec55e6d7f0
SHA1 a1a49dc53577f28fc61001d7d195f241913a1e6f
SHA512 5fbba40372231c26baea87d2a3761650a7421237b2a5a37fb383bc1053d03535b0e4295f8555ed6b2959b7eb005c01a3ba1e2fa4f1cd6e2426d4deaad1c86f3e
SSDEEP 24576:9fwvTk9RX6wkyAIwsqjnhMgeiCl7G0nehbGZpbD:QMnYIsDmg27RnWGj
TLSH
T14495D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 99f5f2f5061f4dd51b54dc6450d7f04c9823c4cd4d62d8f0e1780f8e0c9188ea
MD5 262898930239778f77d15a8fd9113ef8
SHA1 5770798043f4a197b4f7152509c9b51472c6ac3a
SHA512 c9e161a24fe94e25a758a7457383412afd462c6bdc0db8ba63a6fcb9d4ca84b969fdfc5db0e6d0c4ab416675d6e0a27de00e9c6f44b31d8af6724c3de11fb05f
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zDmg27RnWGj:MySzPrD527BWG
TLSH
T14D066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5c2de6328896971c4e164b1d429dfb5ac2b12228e0d701394a60ceafe14894b8
MD5 bf9c21bcad6ad2de131ded12162d3a2a
SHA1 f1692bc422e37d6e48506c7a861179c777bc4c60
SHA512 27e2b51f442fb3cdcae26d54be09d857e29319a19e499dd2c9a183f5f6fa280bb49c07e3a9b637727d65de4470ca54903afc21086c1fc928991bed992ae05d71
SSDEEP 24576:y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYRsqjnhMgeiCl7G0nehbGZpbD:y47JUQj1irIhCnDHUPfF/DDmg27RnWGj
TLSH
T17065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 a4d5d5e394bd479d6771f10e5f3dc4d27be7b1a23e005c69bfba12617c22c59b
MD5 6a970c06047b31b4e280fffc6250a12f
SHA1 78a4d13e9ba9976fe27c660c5821cdea2f528a88
SHA512 6bf99250699aea7279dfa5e4fe100b3ff26b6e255fc4dffa0d2eb906735df151087043752d3818c63df78a3a9cfcf85240020daa88c6ced902f258ba69ec052b
SSDEEP 12288:BjsfMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17975015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 70ac54f76ee72dbcaecea01fb62cb6032f1a2fdf52474a5b0bfd3ff976b0c8d6
MD5 dcbb59d055e0667b6925c49995540265
SHA1 287ad8311e18420a14fd6826f05586ee4758ca46
SHA512 a15fc600129277de781b968d88049594432b786ace63b93115eef296a58403d60eb9d3eceed26b61b7a91f932ead14f2d8251e9a35d13762692825a1b6b04802
SSDEEP 12288:JJk8U3fg0ogRyuhjZUSCIUJNY+8SKD+aRMby:JJZUP6ihnuSfPaaRMb
TLSH
T1BC250641766AC74FC66940361E73D1CCAB707D41EE04AB0373C99B3F95B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 266c9eff29dfb81f12cbb4f332986d3afc6b7de566629da3777aaf865717eda1
MD5 6cfaeb1a55b4e404575f4e2aa000a1e9
SHA1 89490320851a6d0b6f250db5d88a4cce30915734
SHA512 00fdbcdd7d8f000a1d5705106ded12f2dc4c2090bdd0eddf008f54863f5a3390cad2c709dc52a19b6678b6175a81f901a7cfc8318fd0b46fbcdc411b19afa99d
SSDEEP 6144:GtGCwfLOlo/9yZcGlHOvjUIB86MWaVaZbtVnD9tMxHyynO/JGD9tMxViKWKWCNvA:7glo/9hcHOvj7MMtVWjnO/Jl8f
TLSH
T18765F8406537A38FD5BA6032033A5B4CB7A4EC16B7496F2277C8453ED86AB15A0F93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 fdcfa8114513c8ae9ce511fbb6b23043cddbc1cf4727c5fee45bf7dfd3684fc9
MD5 eba6738511944dca6074661f527523b1
SHA1 650fb873110a4a7573ac36fb0dc1eb51e06a7766
SHA512 d4d95cedef321d2c613ee42f60bdf6a60e669a72d1701d1b8e0dc736483e0046aefa9c38e5d8a2e0c0eb2b6d6c43cc456a323350b6f0cf7ccf9c01f40c625ddf
SSDEEP 12288:bO7EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA65237B935C518AF83605B482EAE12D680B7E669F1044C3B95778FEF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fa349176a019424456084644626621855310999e1b7b54f50aedea0342e50ba8
MD5 56788d84e4d213a62038aa895b576b4c
SHA1 ae659f9b4f8cbe8fc7b9e06cefe2de6129e3517a
SHA512 3f055291ffe880902ed61993cde20258e2195cd4bcaec47e51e1b4c7442e374743c03f5fd6585b2a0af9ad8996ca7b971e6552a103d102c3e19d22fcf772b2af
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYWsqjnhMgeiCl7G0nehbGZpbD:hgb4mBIBhGFlDmg27RnWGj
TLSH
T117659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 d8510d61e7d5d5215fd8fec3f3048f42d82821b4f608ee98fcbeda2e3ea8d208
MD5 ded36ab6d60eeb4ce6a0e39b33564a85
SHA1 818d1e78476ba9896a228d14a62ab0b1c7d6f753
SHA512 9de59f2dba45fad61351ecccd61be004aab2243be9dfa5a3393d026e5013128dc79a93afb8073fa0401663df3da3be3916d3f5eae7718f554ec942a5a1ab926f
SSDEEP 24576:bG88u8FpJqH1kzria7/mBsqjnhMgeiCl7G0nehbGZpbD:67ZFPqVza7/iDmg27RnWGj
TLSH
T174A5016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3cf4367d7604aaf5e186a9b3ec8cfb0ca77f4758a256f7d0f4c1e25fee67cf8a
MD5 83cb2a89dc7380322c06f128fe1a445b
SHA1 2002115e492d43180244b56a577fd2732bd82b3a
SHA512 e850163fc9978772b0d39cff16c6d5bcf862fe291b60ae1c3ef981a276aa554b10b02bc54741c8873c2fcdadbceee550d15d61969f86f849177f18bda929da2c
SSDEEP 12288:YHvUrBFrEjwaQdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:YPUr+NQdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14685F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ffac7dfe16ae87f397a0226f857adb268ddca9394019806a9eafe1614445e491
MD5 9d8be9bf0aaa9da6594c5cef02b4ba3f
SHA1 8837ed526fada9fcd6034455ab48651a2bf694e7
SHA512 b8407a90a06020c3c8c936e6199435dc9296c843ceb94bd17c479f9484557da68eee6cb8cb353e45414469a06495b4ee9551b947481788e2eac8a2a80d819efe
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxDmg27RnWGj:HG05lO43bUD527BWG
TLSH
T144D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3ecd88aa1c84cb2a8db66154cc69804054a03f67d9a622aef9d9e47e7563542f
MD5 fc5c8cdf02ec8bbbd8462b1c420696f9
SHA1 d3c667874f7956d5258e9883ee036c13bcb8d366
SHA512 c918e8a7ef190e821a2c33267959db82da1e93d54f0e4e8d3871978e543e9c5ddc84ca6604325447f360b5740d58bd9b33505a19b2ce28bc34d923968328569e
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnPsqjnhMgeiCl7G0nehbGZpbD:qa5POZ3+Jt2pasx2+mJDmg27RnWGj
TLSH
T18165BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d7eb8970fb4fe979d27ffc5d9de303a846ae2b3f468f29bfd8f494537a7b864a
MD5 108056770e3bec2775506c3d71b8a483
SHA1 c5fa5c093e9931907eb3670859ad8e6778b23834
SHA512 4ca5d46783c34fe3d2d2b71a42d542ec78efe76bc21cd6667ebf69a379c9500b2143166942976ba5aad862fae6e1bdd6e205527feb172c86764c233284477141
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkJsqjnhMgeiCl7G0nehbGZpbD:iNc/zEOVHFCDmg27RnWGj
TLSH
T188857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7cd127ce923a6c2f659110f77bf3461da85b414e008280c080c9c017bd3cfa3f
MD5 f7ebc47f9ecedd2b6ccd273f397db148
SHA1 2cad8199521af12e550eba41945a8e9ff3a29fcf
SHA512 a6db28887657a63ec625f04bc741919cf8d2bcd7f1cdf2b47fb25bcf28d53997adc77078cc5a254b8f5cbc58cb82bd4e1b617c731da2fabfda27e5f7acf13499
SSDEEP 24576:P8kNvNnaFeYhJNtmZBmDsqjnhMgeiCl7G0nehbGZpbD:P8MwBtOmHDmg27RnWGj
TLSH
T16755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 66772f6f9eef352020e409b2b62c3a61e31677de3ae3b8b5827191533bf22c07
MD5 28d68e4dbdaaed92aebf839cc90a293e
SHA1 f8a85e8a3e09ec25f8a5333c3db01279dd6d178c
SHA512 ec773cb0c385fc384232e65a2052b6ab82b943c728d4f1f106b652171587e1d040bd892287fdc60dc1f72870f14eba4f74b8b02dc4008b6a676fdc7ba923e6b2
SSDEEP 24576:HD3FHshBIYQgA4sqjnhMgeiCl7G0nehbGZpbD:HDVHeBIAAkDmg27RnWGj
TLSH
T1BC95E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/584-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/584-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/584-134-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/584-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/584-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1372-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1372-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1372-313-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1372-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1372-108-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1372-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1752-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1752-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1752-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1752-328-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1752-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1752-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2728-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2728-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2728-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2728-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2728-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2824-308-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2824-65-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2824-67-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2824-73-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2856-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2856-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2856-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2856-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3812-49-0x0000000002220000-0x0000000002280000-memory.dmp

Download

memory/3812-52-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3812-40-0x0000000002220000-0x0000000002280000-memory.dmp

Download

memory/3812-46-0x0000000002220000-0x0000000002280000-memory.dmp

Download

memory/3812-39-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/3940-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3940-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3940-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3940-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4544-8-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4544-77-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4544-0-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4544-7-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4544-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4604-79-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4604-309-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/4604-84-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4604-78-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/5124-396-0x0000025AE27C0000-0x0000025AE2A4B000-memory.dmp

Download

memory/5124-327-0x0000025AE27C0000-0x0000025AE2A4B000-memory.dmp

Download

memory/5424-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5424-312-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5424-118-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5424-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5668-299-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5668-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5668-62-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5668-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download