6657c2688480910527bfbcef70a7e0308254b32cb7ba73029edf01cb53a97c60

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
Size 2.3MB
Sample260723-jk35saab74
SHA256 6657c2688480910527bfbcef70a7e0308254b32cb7ba73029edf01cb53a97c60
MD5 d09b0604680d1c7acd23afba5bdfbb5d
SHA1 a25277a1c111cbc99b67706ef46e723712012562
SHA512 da1903ac06b24b9ad7e61b344aeee9b1ef5b33d7b6c807813a87f6a567f2d8e4ee2b618b8dbe64c14a8169153f31d6c0a2b073417c5d8e3b6983fcbe693162aa
SSDEEP 49152:08krRUCwl/rpC3qi1kjsVc2ot4+Ej2EsjKYDmg27RnWGj:W66kjsVc2ot4+Ej2EBYD527BWG
TLSH
T187B5AF28F64892D5C07AC1BDCA8A8B4BE7A1F40947349ACF509506DE1E737E44D3FAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1796	elevation_service.exe
1384	elevation_service.exe
4356	maintenanceservice.exe
5072	OSE.EXE
6120	PerceptionSimulationService.exe
1948	perfhost.exe
2952	ReFsDedupSvc.exe
3948	SensorDataService.exe
1332	ssh-agent.exe
1176	AgentService.exe
2056	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2415531a83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098140670771add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f58302e771add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f99c3570771add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006947052f771add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c04f1a2e771add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6f1202e771add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9a9712e771add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d06eb830771add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
1796	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe
1796	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1176	AgentService.exe
Token: 33	2056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeDebugPrivilege	4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4192	2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	1796	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 760	2056	SearchIndexer.exe	101
PID 2056 wrote to memory of 6084	2056	SearchIndexer.exe	102
PID 2056 wrote to memory of 3428	2056	SearchIndexer.exe	103
PID 2056 wrote to memory of 200	2056	SearchIndexer.exe	104
PID 2056 wrote to memory of 4536	2056	SearchIndexer.exe	106
PID 2056 wrote to memory of 3404	2056	SearchIndexer.exe	107
PID 2056 wrote to memory of 2944	2056	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_d09b0604680d1c7acd23afba5bdfbb5d_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4356

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5072

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3948

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6dfecb2404dca4f8932e9e371093768dde44dc2b0ac74b06feb19a3e823f8a71
MD5 6002e8b53d01c65fd5ba8c74b5a97a1d
SHA1 638bef16fdb5dea0a711a15c749201658620ddca
SHA512 bf73128179f79bd52d59e18e2b87a59481d39db4779e7af31b2017deacbacc4bc09ca6ac5975e82f27bd0609f753e986d272514fb78b3eb3df9034b325a43eb8
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxDmg27RnWGj:y3q6HjBGD527BWG
TLSH
T1E6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d611cb4176b846e0b31d70d5f8ada4462c0df16509a39dfbaf17fb62027b89c9
MD5 029bf8fbaa88a35e3c1303a53e620114
SHA1 2f5aa35b2eaab68c6a4a71e66d9d745adb91944e
SHA512 0f4bab3e3387afa9911af84bd205ee2d3e0b830067a8f233b7b41c1c4a32de427c24c5eec6e72e20b31665b003db757d6fb810d3bba12ac7f90ea7e5129a3470
SSDEEP 24576:BXYfDtczAWsqjnhMgeiCl7G0nehbGZpbD:EtcbDmg27RnWGj
TLSH
T156850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9cdde25a2113871e67d92d54b5fae16c17b99ad1427b4ebcde83a8067035f058
MD5 16d71ed038c20edda0c48abf740325a6
SHA1 f581acf2426fa058da5192e5b902b51522d5adb6
SHA512 848cad0e16c9361336b5b9c29d3f637537cf27792f654380cb2f317d65d03a49c95d60a27d064e4111d813e37a31cab1c1f96a3e5ffd372ac080ee098bf3eab3
SSDEEP 24576:q0Le5ji0hmx3rM1sqjnhMgeiCl7G0nehbGZpbD:qPji0AZADmg27RnWGj
TLSH
T148A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 69170d902deb84f1ab7b9c66becd4e4692fb090df7083d0a5ef396433e6ec9f7
MD5 4dcfc050b69681d5d7e1173b5e04d9df
SHA1 58d5ea1c08aacf765eb0840f86e865b2a890d97e
SHA512 735359bf938ccbb1d52446c74efb041e32b297e88b1bca6e87fc429b9776516de6bad1680b3e9145b3a379c01251a8d8ad5683cb0dff2195fe1cc946da8c8ffd
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuXsqjnhMgeiCl7G0nehbGZpbD:D/ezSC6vUzPvxHjy0Dmg27RnWGj
TLSH
T1CE755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f5a5cd9c0796f30528af4c19f95eed9f9ee0037f6a873d7afff3ffdc4223edc0
MD5 671c81382f6e3d27956bb9d50e16a594
SHA1 fa49d615f8ddaf627b25c1bd0509bd678318ebf3
SHA512 212a0d25bb08b9d4b6ad6ad20c0e1e6daa8265f743361a1288544451aba2de32eeaf62afbd2d44daa32ce3bbe32301557fad6699c2aaa675e0dd1f90d8752424
SSDEEP 24576:9VbqPb88hv/l+6SsqjnhMgeiCl7G0nehbGZpbD:9VO88hXl+NDmg27RnWGj
TLSH
T1F3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 b8e8eda98d69631de86e10e4cba3ec58a8a43734884d6c571b3689a3df64d784
MD5 327fcdc28bfd4c56675b1ab1cd2d171e
SHA1 55365d015039b87a915d169031a0c4aa2d409de1
SHA512 e9c2a54760da76fba076f2935daa2f390269995d655b7f9a9f76289c87444335a690c191132e20a9529c36f19f547c7b3d73e91d90d63f8ec81fdf66e6b0d8ac
SSDEEP 12288:sXBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sXBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A6523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6ad8cf735730f2a3967edd5af1a8987d12e150151bca5b1ba2406d6f230b07cd
MD5 406cb09d19ed2231484cd5f6fd7f611e
SHA1 58413b375f3b6fc754e542d2d89e4fcf9f485589
SHA512 9f93a5c31e64147faba67b71636a07ebf764f960c4b60ae6e85cf732acf64c176a70a866190f196483f253db747199b558028ad1ad10365ea1ae3ebd0c498915
SSDEEP 12288:meBNUbTVO86U6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:mJIU6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED85CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7c658372d62fff6ab8ad9e29d73d89331e5ad28dc3a3a0245dac3485df618373
MD5 6b2263c67b5daac7741101f19e76a24e
SHA1 f6be755b60122a8fec39b285538d3332c4d77fa9
SHA512 efd058c9aff963e2c154ec6e07019072ad4ab4bdecdb32418beb72e20a7eaf424e63f5daab38b7c9106bed5994a8b282c83fe099c0fe67384bcc2ec7642d9347
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:fQvGAdlCEL8c/yRNw5C7D527BWG
TLSH
T117266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 5ddfd3e96b3ee528ea83696ab332b10d7df4dab324fb639a49d27add1ea260d7
MD5 374f6912e83ee2067f6d8b82e6429020
SHA1 dc6d0bfc231da5a01b55000e1d4dcacaff1dcd6f
SHA512 a9f70b21f48b6d7b3a4b2a67291f6d8a791a42280e69a8310f2f1eeef2ecb143ea6d3e25089581fb70482ac5d617190d0c7eb8d301e83a11e67964ac33835aea
SSDEEP 12288:BAwSfxL/2Dc3RDLLmt0LDQewsAj0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:iUewsAj0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14095E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ed2d32b6e0880098e776f05d7d3f85f438d2927823b4f534f97528b105176cb6
MD5 d2ef8bbd1b746123c3040b01009b99c8
SHA1 f69cd5bbe87d195a16103429a1d6c941bfb21739
SHA512 e127733d88618b56d0d81039787881415ce9fa1cb23c63b49721f3883d75b8642394c56098194d51804510041fc298993963727aa7158be35a1f539bda65411a
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4VQBWG:SUEtQevvqc2W1cpV2EI32/B
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fb10ddcc77ae936edc1531814607843298c7a4df87d6f1b40fd40cf331ffed47
MD5 b7de1b6ab3a058a7b343540f1d8668af
SHA1 d7b0396ff1839172effcd830f6fd266ebbfac312
SHA512 a94e95db937e7b95a4abe97f8ff1e8fdafe2e9d900ad535480d3d84e4472624e884b53240d68fdb62876da94449a6b84d70a6b7ad6554ed0309efc04763948db
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zwDmg27RnWGj:toqtVjnmPD527BWG
TLSH
T13FD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d708dd489cf56311d66558065ce64890fe486e74eb934e1b4a033a137d564fe0
MD5 a6e3b3212de8fcd0e1bd5185e8538609
SHA1 e22bcc2985e975b025033171c457e5d6909158b4
SHA512 54fcc7e7794aa5bc05a6b00e7eff29be76d2c1f3d93eafe2d83b6476e70598394700521416cc801dcd6fded4c688521032912cea6daf8480703987f6b4a64224
SSDEEP 24576:DAhGLJIFoiwtA5l7S537sqjnhMgeiCl7G0nehbGZpbD:DAMyFoiq5fDmg27RnWGj
TLSH
T1AF359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5e051842a7f8172bb30a40b1ed2f9d63f9204cdf00d985054ecd8b01d4c31036
MD5 e0dc338ca12a38a5dfc7fc40d4f22caa
SHA1 27b23330ad0297d64825f6e2ed58c093a3b456e7
SHA512 b1532d6885fb78cb982042968fb3bd630e0bc5b8fcc86bf12c6f9704b0d6024d5dd05277d01b33bc443effb21faad8d2d156c0b58c9f4ab9181d80eb32b85d3c
SSDEEP 12288:Omw5HEjsChNzBFgl0WDm+C3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:HwuSOWosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A785F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8ce91687d9d78bc4e0e71af7b9c5e6f8068840fd466f117a8bf03b5416813e69
MD5 ec5bba857cfdd1d34fd5c95055d83759
SHA1 3450ec5595519fde6a87da5cd9a8e1a811cc5bd6
SHA512 340daa91fbac6b4d389384fba330c8eb2978131815cbd97f4e826b52d6dc76c20e97abf7e1ddaf96ae51ebf16baa5782b4fec73b744d9b5bb99a75b5e63e58f8
SSDEEP 12288:CzZ1IyEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+ZudsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1517512AE239820FAE163417CC5E5D609E7337C62673003CF166656AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c6e98f149189baf67be7f9d8ead0bbfa2756ca73d4a72303fcb2c3d207fb14e1
MD5 33d13d8daa5a714d10551608fbfb4ff3
SHA1 558d2bf12a61cc270f1c5d8fbb83d7b6e36bf567
SHA512 24e789a5a6185692e6a234ff40c81dd50b746f7a8316c08ccd69bdbcfaabcfb5d661575911e85dd6732144395b71343b3514e6ff0a7788364f691cb9ce004dfc
SSDEEP 98304:eQRQyi36YOcPQLvw2gAf+PN3SD527BWG:FQyiKayX+PNCVQBWG
TLSH
T19C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f86537b0af5e5d117468eca548a0d4e81366c54d6da6f80105780e437a9f8eeb
MD5 0d732985108f8494a18c9b211891d33b
SHA1 22f01bfd095f32ae812e89208fee15b7482dcb0e
SHA512 178144021a8985ae113bd212edad97a8639b3997639617576db4fe3f33e8086837001777c9f68a1a031f62c944761837658dffdf8f7443542f258ac992aeef6e
SSDEEP 98304:pQRQyi36YOcPQLvw2gAf+PN3SD527BWG:AQyiKayX+PNCVQBWG
TLSH
T133667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 37ceae699fc59a050fb2945b722d048759a3e54b50b20c67a7317faacdf3073c
MD5 3de6b4275da9fe33dc30ca6033ed38a8
SHA1 96c1cf0a850cd1eb6b1598c44e95497e4680a41d
SHA512 605284a50091772add51ed935d6d2a72097daa2e534623540dee8456ad111fb37f751b099302319d36c1c6f82f7f202309bbfba6b13ea7776607f23f9e982c55
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0NsqjnhMgeiCl7Ge:f68Qg55nhheWu7PNU3/ADmg27RnWGj
TLSH
T13FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 233f566460f4c121a8f70899700c06776add295e5fe5a7829fcd5f106c5491a6
MD5 5782b4e1290a8f42f378ca4774cb65c1
SHA1 676c4710d4ec7ef7d0c59b624a58a05841fa66dd
SHA512 f10896e18b82cc700fa76aba31bd2ae23739201e97d0ff1e38eaae3f2f21df9d36a2d7c50710692f2c673ee61d7885e33d1614eea93df7be342b2483f09dfb32
SSDEEP 98304:hy5112gYy5azzVvL69nLKnhZVD527BWG:8LIHmWhXVQBWG
TLSH
T15A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 26d27ef8b5c232415ce0250d03e8e19f18906d390e50e3130612f061b751d450
MD5 e9a76076788cea4d11f5a6b043d7778e
SHA1 bf9fd5e2d73fe13e296017fe1bb0355ae009017b
SHA512 134393acf8fbae9291db98a9a71d25de2fcd767889677f8406bbe01ba949a527f1bcb5f58ef9ab18ad8affa09c511140df2bd9e766dca547624470345d47e2f4
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKDmg27RnWGj:Tu6JmVxd2dKD527BWG
TLSH
T1DFD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f0218ef3eab104a75623cda7d48dde0fd778f71a317fd7b72fd93840dbb29999
MD5 94d1b2e23086a834cc94f03d4c9a2eec
SHA1 a1754856dc900e082ca76708ab4cb98587353aef
SHA512 99ec15b0668212ef0365a4bdcc4e548ea685904af23ede08113b8fe249e00c75115112581575d81e9bb7c199f733834773eab62d646d2dd1283c3c3a81601398
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xuDmg27RnWGj:hmifPbRPD527BWG
TLSH
T143B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a66f1f91e4863d5285447d609b6f2b3bf132225e58a5db5653257053777ac56c
MD5 81b73f94ad8562e46a556d00e6792406
SHA1 40e6647095c6b2cfa72467c7d7dc88d5c102daf5
SHA512 3231d5a8a05a313d0b9de00428cd01378935670c363beb1bac268ecc0b27948798079c2101b0c492169dfe4cf4249c05ead69512b5133ad58454ee705cb4b6b1
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqBDmg27RnWGj:n5dKTi61BD527BWG
TLSH
T132C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5cd6751c37f1d4c35c2fe7c5328f8e1aa61e7c677292e83f0d33e6973283e76e
MD5 8bc5a61320a5d718ae0aad2ac834e98e
SHA1 d731838953167e084c727a21b3ec29985f28c15b
SHA512 a605c7d4dc1f723493984eaa586d5f61f1abc9dbce686203ff4ed031fc7040f9e5e15b89926e8c65ea84b12b6bb926e619aa5731299bf4e25bf1641a0df6e454
SSDEEP 49152:HhtSn8EApI0figngiDn0AP5waDmg27RnWGj:WX2iyphDD527BWG
TLSH
T10095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 55113ea21169149f34bad15d988be46c68a8ebb6987cee738dc7e385ac41ed5e
MD5 227af155ad4e727ce61341b6c0e4e5a7
SHA1 0d57fe4b0a123b1428f3cda72c85233e832558dc
SHA512 ac9033afab732df6c741ef0ad8b1b6f980c856a2544ceec57f005229a0a7636af6122f38e11d5b21f42e19d40e688759467697260c341dc2b9adc31d23edaa16
SSDEEP 12288:3JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E6523BE955C41CAE52649B5C3E5F10EAC073E57E92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 c2e573ba8e0f8ec56e747b26e9315639d8ef086170e8843b2fd3b016ff1f2802
MD5 9baffb8dd5311d7fdf14eafc0bbfe0d8
SHA1 0f7d05e64ad6b2f40958ef495b0738ccfad56487
SHA512 8f6c63aaa9ee9223cd7cc1a23ae10a65403af192d7674a9e64db2b90090682f6c667122c3041338b5fcb21d4277a08d02cb800157ae253f189c202557d8a333c
SSDEEP 12288:0AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D26523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 574861581066d4616d12850387beceb4235877df69fa4cab8cce72918582f679
MD5 06c0c35dbb908c1c5ba88ed5a41a61a2
SHA1 6c82d1424b141458688e3560cb8f092628c74464
SHA512 cae54381292c557664671ea5faf9bcf1c928415c22930a6f8105dac06661cf913d5f792a522ad569956717c188d2cce9a681e5276542ba09dbccd28596668056
SSDEEP 12288:KCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB6523BE965C41CAE52648B5C3E5F14DAC073E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 92feca5e840f5b42c73ceed88724ce7089545d786d9406bb9922631a651d3f34
MD5 61cfd7313c53e095977568f8733a49b9
SHA1 7e27f76140c9ed999400cc484c565f49ebcf8381
SHA512 9e7c6cac5ed3c7b099f4642188c8cbd2bfc4e238e610727b6e8b8349a70ed2464feb4a622d17dad1dd6d96d191b2c3075baffbd88be1b6e0081b708e799ea495
SSDEEP 12288:LVbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13675236F575C00CAD83285B5C2F5E11DE8237D56EA3005DB6B532CEEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 aa9a77c39992772562f7739ffa1efd3f91c584896aee00030c3393ffdc0b153b
MD5 7afbc363bb349506da896b910421f988
SHA1 4b57e92574e83202294729bd17d20c288921cb93
SHA512 1008f860869a0af7d565fc7029e75cb34de751c40ad23a6e4ff2cdf500a298dbb8b9e32f881a9012e45e34d283b8b1a7aa207481e973da33221861ffd5f11fc0
SSDEEP 12288:pzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1396523BE955C41CAE52648B5C3E6F14DAC073E5BE92004837A9B7CBDFBB24584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 854e55066b00fbc293d2211a0a515eb9a1c3e88f00f71767a70d56c3343ba5e9
MD5 2f835c1a98792f3abd9e61131d216af2
SHA1 a033e4643c9b0fe18d148099b642dbfa9e73bac7
SHA512 499b489b109e253cb41802a463d6da29fa8521af461472c47ba67b748fd2b823dab8c70510dc882837a0ec05b927b8d97773efd9a7e2b6c1ac7d2f4bdcb0dc6c
SSDEEP 12288:gcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1626523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 de30ae955540addb91630da503b4c68431bea19b1a013204afd3d4bce7489eb7
MD5 a148c09e0b82dd96e81b70a88165e86f
SHA1 dfc96b9c439575a0057a2705af1131abaa7cb544
SHA512 885d3aee6759793cca9e078e867f9f532c4dc9306a8deebd8c638c052f252bfb9f6a90de508077f88fd0d1ec2bab08675bbf7e596edf759f065adbcf3d8ed4ad
SSDEEP 12288:9YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1136523BE965C41CBE52644B5C3E5F15DAC073E5BE92004837A67BCBAFBB14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 69bf4d726cf1b8dfec5ea6640fd8ac18541f639fe0dbc99d97c198dbc41e6c74
MD5 8ecb1c0568addd2346f52ba28be7e870
SHA1 043c04f87f7b3a1fe00612fbaea17ef4a4573453
SHA512 fae3199d8f787ab43faafb647daa00bc9ed5e908bcc55ced4112a640d1203dd8d7d6cfc183a9debda1ef87f5dc1b24f1bb71542844ddebaa2f1beb68161a8737
SSDEEP 24576:OZMjzFVSOgsqjnhMgeiCl7G0nehbGZpbD:OZMjzfYDmg27RnWGj
TLSH
T1008501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 ca2882535e9630e0221db007ca076b26dd8714e5b8c99a9c4a5ac4da865da38e
MD5 d1c18e9a0c182db5c515d2a6274d5739
SHA1 3097c4206b0c0b0d565fc8c7e56f1408893f136d
SHA512 daaed3f8e475b5944f042ee1dbb4b39ed3ec0778cbd8895adf372edc76b19965163037e024926356acb3bdd96d1954113c0ccb42a7e0098007f6a2892a6c357f
SSDEEP 12288:JtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1516523BF955C51CAE52608B5C3E5E14DAC073E5BE9200483BAAB7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 13ca581579292388b2de447a5a69d627c23e7a141564c9e62bf675995a1bbbfb
MD5 3c0463c40685cc93d43b1891712bd968
SHA1 4024f03db999b9ab260c4c2bebafc211b51bf0af
SHA512 ebdae07d38da2e19fe6a43d9ec810f9923f9d12f7df1397cb01be0e0ca2c3351be48ba7f3c0fc54b11246ff79501d1cf0282ece28783ed70af0f6921c00955ab
SSDEEP 12288:wRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1416523BF955C41CAE52608B5C3E5F14DAC173E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 b91f16e10cf15893a5a1ed9144806427333b572143dab9811e45b234e6445ae0
MD5 05df0bb36a8898a1e1f2432159262e9f
SHA1 e58309e22e6d9a748522d347c0c7245ba3d46a58
SHA512 eec01705e5ad10eb902014428219256038f1f0579986e73059eca3adac9cbfc79ab5a3a343f947fe3daf26f32c8ce703519a2263998f89a257677126363fe719
SSDEEP 12288:YyPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5zyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15375125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 0d03a996f7dd4a4986e23ed44189e16948140fdd34fafd93f76891494020871b
MD5 43862c4d0e1fafe17c1f8b5f5b236196
SHA1 d4f2eb6041b46ba475a19ec4fa4df3a2def2d64d
SHA512 30c7cf73834176e59362ead87edb892d42532fb3fc9301fa07be83a150cc0cea4c309dfb92783a77b0f265c4a5ac191eeba7effc79dc2a7cf02ef324c622327c
SSDEEP 12288:AtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F6523BF955C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 3cc1f95a605865aeda89fe5ac9f4339db0a3f10b6b734085f19e03fbca19e62b
MD5 18a4c1138ebd7a7e7f4528266ea48bd8
SHA1 a1d6d588250e558215bcc671dab9e71a5bacc217
SHA512 d6590bacdad1582d8c6eab21106b6ed2f4f8b74644d6190389ad2257f52cc569675cdbb9edfa9084c4e437f15cd2ea2ec5a3f709b867318250afdb28d7bab3af
SSDEEP 12288:/tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C36523BF955C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 fb9d2663b87eabf27e4bb93847f7073a508ff25abf1d91a2babcb2523deb3482
MD5 207303b3def7746e0696fe61b7d98b93
SHA1 6a416cd3a8996e9f1d95c09383dcda0925c4b4be
SHA512 1765dce2c2d106a5a3e1c6c0fe9c46a7a77edf56935c803e3d60ade7720e105ed8ba2ebaa3645ee3c2e6bac84bca79d4510f8dad101b17952d92e6f12420731a
SSDEEP 12288:jyPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OzyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14375125B73A530F9D1368178C5A29A06F7337C3647204A9F17A016BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 142da5e096c08a1561b116ea99d611261eb97ac2f90d9d4e6325fc1b09c012b3
MD5 15a860dc6162b7854493e283a283c023
SHA1 5f16ed3ca6a54b1b2cfb8c66a6826b42e9c25c4d
SHA512 6b95eb5e2a2a4a0228a578c76adb43612b8b1340993ecb4752d8e3f485a321f9b8f36db4bc7decbf46d4ae5b56fbbb68a6b9b0a1beb3fa7dbabdbc3230d72afe
SSDEEP 24576:9TYaLl3z0zDysqjnhMgeiCl7G0nehbGZpbD:9TvLljrDmg27RnWGj
TLSH
T1C88501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e951251cf788fd94d1e7a4ba61b7b53855b5af9ee4b95477c1139c40497f495f
MD5 95f6041a1a9d10b7b4d278a13d03ae60
SHA1 0bee90ad47de569f7d3a0fe3067a1f30ff0b86e3
SHA512 cef82cb5eb86b89f7fe6d2349872eb2b0e1ab08d75c128e85672c3808f1bf638137314ad8ce6326d125f85c7f3c43c6bbc20789be16d88e960cca6e7963f3d76
SSDEEP 24576:F35d9CHKy7GZesqjnhMgeiCl7G0nehbGZpbD:l5d9CHKyaYDmg27RnWGj
TLSH
T11595CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 703ed3ee6160a284e1ecf6b9048371a4cce8d0c160b06efa65740aeb7852b4f5
MD5 d2b9d8d816b701aeaae3d23e0740f3c0
SHA1 66110df125109ba3a1e1ae40d3d9c688a6abd1ee
SHA512 a847f46b33719ae497ac808ef8e3ca25f83389c34f6aade183e855668aa60358a5d153b54921fa60981fbe95187022b0e1d7049bc0dd781fcdbe1e89830855a8
SSDEEP 12288:+iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+isqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C6523BE955C41CAE52608B5C3E9F14DAC073E5BE92004837A9B7CBDFBB24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 cb708abea37ce69797813342909b2152d19b61f2e6162dfc8533ec4e94ef76a7
MD5 a3dc64ed32f881c352513ac3e2bffb98
SHA1 03474930206db7cd51c6c24903d700a8f1e00ec9
SHA512 e0b2b72ea658c01d7e3c59fce3a253c188e3279034a89496e81da8acb046668bd4303e2d8b50130da20013bbbb0efe4892af608ad4f6b74e8d5f27d15019acd5
SSDEEP 12288:akXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1296523BE965C41DBE52644F5C3E9E10DAC073E57E92004837BA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 a81cbf581340e33225142ef0b772dd4c20a8f8282878d60196dcd0be113c4965
MD5 d0737730f3c290ab243154fe24e66793
SHA1 c709193f6628a622293be85cef03f6a1bdd61a44
SHA512 9535182abff5b379eafc515fd1e4bc1ed01a54853a56e75d029d77c7736afd96a1c3a05139f23e3640b20edcb771a0441992299a869333304dd9b139b6567206
SSDEEP 12288:NvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A46523BE955C41CAE52608B5C3E5F14DAC073E5BE9200483BAA77CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 6336510fb8d2c002cf4cb8ca43b014acbed11ec47d8f4bcaa183c74c90380b6f
MD5 6b7c37be766bfbcb8c40eeaa4a1ffc81
SHA1 77ced501395b4cbddad14aadaef554a364005502
SHA512 d9fc526230d573225450693c779b931a3b3ecac95dda32fbe91618501679be16bf96cb3a1e32771a0c645785fcf75bcd1a49a32c540971f3859e9d183d1e1a06
SSDEEP 12288:htXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:htsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F86523BF955C41CAE52608B5C3E5F15DAC073E5BE9200483BAAB7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 59586b557652f495b0b9f7660a5664d28e8064636e3746951c057f31029fc9d6
MD5 d998eb2010430d832fc37b45de7a75cb
SHA1 a1f95e6f1061058e17ee3cc34cb660bc03d5cfb7
SHA512 764448b6ca568917cab9ab419fb487cf98b7eaa471408f5271405b410922c767515c5423f027596ccbed02009bb591ac28234808378ceec078508a61a325ef6a
SSDEEP 12288:9iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9isqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D6523BE955C41CAE52608B5C3E5F14EAC073E5BE92004837AAB7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 4e3db4d4635610c4f560f710e6bbc1a56b8c66902e99a1fc7764a05f047365d8
MD5 a68a49ebaf032779e530e005385c04e0
SHA1 49081b2faab816034ddec514dc1481930384eea4
SHA512 3f4b89ebc2f46c76230dc9e4e453bd9445d614eb7c16bfc38911886b25c727da64dd8d5b88b8119c14dfa7d85778ab16b48005bc74df4f756224e8251a726baa
SSDEEP 12288:/lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/lsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1826523BE955C41CAE52648F5C3E5E11EAC073E5BE92004837AA77CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 b3bb62b1aa85dfcc79fa95222f1c80705183374547cfc567be59edbcaf30b5d7
MD5 93f59ad18feab08d4cafcfe40b892eb4
SHA1 76c5b2240d872f501beffc47416bbab330398e86
SHA512 e61305c53aa70718e75c9d0419bc8f9dddc1f8e0b0ad11e4b027533d31c72f8ccb7b9af23911dd5644a134c1ee7e5bceec8cd1ae1b31da2e0330d69e83ddf117
SSDEEP 12288:bzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A6523BE955C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 7502f769aa15e8ed9a03932afcbae0c5d2e1376c8b96aa6fc5753b8b6822d813
MD5 463b2001b85d6827d7317f37433819dd
SHA1 9434e3c884b30f5605ceca3c34f2e3e086e0bb45
SHA512 ff9e01cd9a188cb1610984347f118bf450a8621c578519d54e49decdeea1e9c5d6d454765b3fb8d8a8350318ef75e8250126be7c30bb1d5e980321ed57b00e24
SSDEEP 24576:pfwvTk9RX6wkyAIhsqjnhMgeiCl7G0nehbGZpbD:0MnYI1Dmg27RnWGj
TLSH
T10695D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d86fb37622008a4d629c41f85ba4e8827eee4b711ee1663e845f0f567e54284b
MD5 64015e21b25240bbb7f76b4ed7ce2872
SHA1 75512d34c919d2970abf459b665e95c1091d8684
SHA512 ee27261bf98afb067e9ba5c94c7fe62760eb4c8639a3cd31c80f871d5b95d713a164a61e2cbbf07d6f513c08c4401a09554e91f70ff13939a259f28a719a21e1
SSDEEP 49152:pYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06Dmg27RnWGj:RySzPyD527BWG
TLSH
T188066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f75f7625aaa1f8eb7a83cdcf88ec4cf0ad3516c44aa812d3c53c86278cb3d3b1
MD5 accb744f2dcdb2c19080396a0558fc41
SHA1 b8dc0a85595896af1f4d5e22104e01bbad02561c
SHA512 1439b93e0ad19276fb303882fff66658c35213c116b6fa814393a9b691964e2ff6b186eb7fa6b1f219e4e9853fa3566a3c72c32bf5657c7a89f99c12c34aa51d
SSDEEP 24576:A47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYwsqjnhMgeiCl7G0nehbGZpbD:A47JUQj1irIhCnDHUPfF/KDmg27RnWGj
TLSH
T12665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5d6b9e9459389ba88863f5f019f57b00181874c0f58fadf8950dc41adce08382
MD5 9d15c47b4fa75196e0378ee80452a6dd
SHA1 3f36931ac26060aa39e5b51a9a3dcce0cd242ff8
SHA512 2c641461b701927a3557a11d0698eddc98c04ca827186eed2e17aa9aa04efee49d75b146632f08c0e229611f35265bdcadca73d8c7c8e951979a01738fe5185e
SSDEEP 12288:ijsfdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ddsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C75015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 cc531cc1783161d82bcc4769a553c4299bebdfce6dd1d1a70cb4b255842e55d7
MD5 971dc5a6fa8967335d5d5701d8f34cc3
SHA1 4e55a22ea67e5eaf0d1052c46e0a1a94b55dc955
SHA512 d65a6b27ca41c0be50ad14863d2102b77e169add92cb5463cac5ef1a41cdf4957b68036307d4776ddbd54d213e2307d2d4fd5c6991dda8f2f96b19aa747e6a03
SSDEEP 12288:l7qVU3f8wM00d6LfdxCEbp1z/G+h18WrCYW/mVYSKmumJPz:l7SUP8XcOEDzrH8WNW/maSJu8z
TLSH
T181351740766BC75FC6A940321E36D1CCAB707D01FE05AA0772C9873FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 225734aab765e6fdca302fa1793f56e921a80f52b3a20002cb5229d7105d7685
MD5 dd5d18a589978d95e1991a7037857003
SHA1 9efc6921fa7b7b67dcb5f42a9ce54e7b995251f3
SHA512 08ed3f6c5b94c010ed0e09693379f227e9ca7522041d470b0a197e3a9f9a41a4e2860a66927461969b8d2db4bd1b18e8187b8d791f8250fd40b250e18524ed04
SSDEEP 6144:0nqE3C5aFqsnMEv5DCVAH2ZbZZcbVtMxlGDcbVtMxAbZ1sZhaOwMH6BBh:pEv5DC+C1qDaOwMH6fh
TLSH
T11865D6819437A38FD1FB6032072A5B4CABA4EC0377456F2677C4443AD82BB65A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 3d4957ae620d5219cecb75adb7bf2d7fa7f9304047ac51fcbd9f6afeb5843cf1
MD5 f6ecbbeec0534ffb7dfc1d55173eb213
SHA1 b3f795e12a69a053024890e31977c30614f2b2c1
SHA512 e1a81f05ef1f3b018ea1c522c49df54cdc457dbf73d3ca3884a0754da7d03b47ab090c299909e9d064f94a9f0659f4c21e7a4a8896f34bef0efac9f36e48101b
SSDEEP 12288:YO7VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13265237B934C518AF93605B482EAE12D681B7E669F1044C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4bd1cb8d29c597ee8d799a3e94c0b192fefd1fb3887358dc4b5c6df602c8759c
MD5 ccbb3a04ad67337ba78059c60495e1cb
SHA1 96ae02dc8bb64851b8ce1b262907b2fd5328d793
SHA512 57ad790dda298455083c6c43ea1419a44dbfdd874c5dcd1c8eb21a4b8a52746c3eb3ccf63e5177b1a78a42a26f752096d14de3a79d1727203334e7216b16c4d6
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYXsqjnhMgeiCl7G0nehbGZpbD:jgb4mBIBhGFsDmg27RnWGj
TLSH
T143659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 dcfe28f56cb1ef737598f001810b2fdca50d1a206c9b94183131119bad3fca35
MD5 d7c3115df85d1996a7381b3fb1c2a4df
SHA1 71e9a0ca02895aa7c457a10f968fa264b9b55c24
SHA512 65e92999d98dfbd43a807b0c1ce3857d2cb615ee1d896a33a50cb7eec305fb988774af632a6c4e731ff6d5cfe99111411a811c1c9940d22ec92f295788c9d72d
SSDEEP 24576:hG88u8FpJqH1kzria7/mgsqjnhMgeiCl7G0nehbGZpbD:k7ZFPqVza7/zDmg27RnWGj
TLSH
T143A5016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6f8c90b56bccfd58ba2b57fcc2cb372baf837e4d886b66bf44770e09fd52c3c0
MD5 5cb694e998d226017bc4e5d5546a9f8a
SHA1 a24d68f8d806dd1ab7c4eb64cd8534365c116bec
SHA512 396b2f52eafe706519bb33c36849a4897cc31c8823d98175aa1b28e0def9f5c1df3159901686590edc420004e71f14a337aceb49d970f19398d7aca104a73381
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjIDmg27RnWGj:BG05lO43bdD527BWG
TLSH
T1A8D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6d6d7929b216822bf6b626d564dcb75ba65d62cf9b58521cf01709ed2c5effba
MD5 004a0bf34055c1750927c796040e8732
SHA1 c53eef9b79807d082e721dfb3875857b8a10b2e6
SHA512 fbec71261e93e9d15f9f00c1c46d818ef1a886c4a77f51efe30363cbf87d6a3981b987a1806eb12669dbbd6213a91665c6053e4bbf5b7163f0e93d1f6ff4bfb2
SSDEEP 24576:cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn2sqjnhMgeiCl7G0nehbGZpbD:Ea5POZ3+Jt2pasx2+mADmg27RnWGj
TLSH
T1E265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0af4c229841f126d46e896198e9023b8f91e758db4d07c5ef62be6a9cbb817fa
MD5 e5f267a33ba0b76f28a715bf001b8788
SHA1 7183797501ddb4cd0f816e9f6deffc543f4e94d4
SHA512 6589ed29846af6b739485320d2f5e85b843904d91d701179486a10c0423ec6c6ef97d9680862b980c691a76449e91e1befb614be6a173d8a5f2af491ee69cb4e
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkIsqjnhMgeiCl7G0nehbGZpbD:TNc/zEOVHFTDmg27RnWGj
TLSH
T1FA857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 767118f661cc2ed9f0f80631ac789075774980996b4684432e8c98ef770c0fa6
MD5 5a41eb9ae009bf98fee12f6e82b3bc62
SHA1 8b136273ae18b0d62f8e04561aaf69b73d0489a3
SHA512 55ca567953ec0dde8856f527a3db443ea5c65891552fe181d079cbb155206f1039b7daf0502169046be6a19d01b7baeb87237ec3218f978252e3ef07edbb5075
SSDEEP 24576:I8kNvNnaFeYhJNtmZBmKsqjnhMgeiCl7G0nehbGZpbD:I8MwBtOmeDmg27RnWGj
TLSH
T1B455AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 85fb3659b421610678556d780de6738444fb34ea56e11c1f56fa8620ae3f40c3
MD5 3f5eb4682084969a20dbf96e799214e5
SHA1 56c5ce3e896725cdb0e16f4bfe85ba840ba6b035
SHA512 236ccb045f3596e5ddd5bb2ffba1963914805b079599d36015c5f36d28b7f56de4513b0e3abe18d280b490c50d1fca9e6e9403fe757e2591c8150e232fcc78c5
SSDEEP 12288:IHvUrBFrEjwaQsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:IPUr+NQssqjnhMgeiCl7G0nehbGZpbD
TLSH
T11285F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 bf2174752e88cadee315194b87a345403a1ef96dcfe526c2d69a4d667b8ade8a
MD5 fb00ac479477ce491d57ba0f4277b051
SHA1 c04f4b17c4bcf8d54af7515c65697d07420567eb
SHA512 8a526e2fcf7e134c447e75fcffe6592b8dcd17961f509a776f1374b8237c2ffe9609f76d4971955c47f5edbb3ba7fdcfec0979a20c01ae362f6f14ec586cd1a7
SSDEEP 24576:VD3FHshBIYQgApsqjnhMgeiCl7G0nehbGZpbD:VDVHeBIAAtDmg27RnWGj
TLSH
T15495E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-134-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1176-128-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1176-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1176-136-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1176-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1332-115-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1332-313-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1332-122-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/1332-116-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/1384-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1384-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1384-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1384-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1384-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1796-22-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1796-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1796-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1796-24-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1796-16-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1948-79-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/1948-80-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/1948-85-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/1948-310-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2056-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2056-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2056-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2056-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2952-328-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2952-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2952-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2952-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2952-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2952-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3948-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3948-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3948-314-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3948-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3948-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3948-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4192-1-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/4192-8-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/4192-7-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/4192-11-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4192-0-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4356-47-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/4356-52-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/4356-40-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/4356-41-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/4356-48-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/4356-54-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/5072-63-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5072-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5072-56-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5072-278-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/6120-75-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6120-69-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6120-67-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/6120-295-0x0000000140000000-0x00000001401B2000-memory.dmp

Download