c8c4f15c8b222081ace5fe74e9ae9afe9fe3d67c893f06dc41c860bae3611a28

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
Size 1.2MB
Sample260723-laka2aba74
SHA256 c8c4f15c8b222081ace5fe74e9ae9afe9fe3d67c893f06dc41c860bae3611a28
MD5 2d397ecca6a5eff890da25af4643d012
SHA1 6bc656fdbb3e4cddc66ff5c49268d381238c8dd6
SHA512 bbf8e9c257c50558dd5a048ab188c66081425eba07ede21420836d1b60ce9c8dcd8558776daaaa55fff1a2273e9414efb453dd148cf07dc2bbf633630ca31320
SSDEEP 24576:NDO3nQ1F8lNM+8t5wXWotDWi//dirlvZGMApYSRiO:kIF8U+E5UfqkdirbGbc
TLSH
T1C945D091A79C3EDAD13BC13DC5B64695EA31BC50136097CF01E423AA1E236E6BD3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3432	elevation_service.exe
6096	elevation_service.exe
3384	maintenanceservice.exe
3408	OSE.EXE
3124	PerceptionSimulationService.exe
3024	perfhost.exe
5424	ReFsDedupSvc.exe
5596	SensorDataService.exe
2332	ssh-agent.exe
4952	AgentService.exe
1144	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fc36743f238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a08e5676841add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6745d75841add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f17337b4841add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000898e0975841add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a95c4675841add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8e27ab4841add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3368	2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	5424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5424	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4952	AgentService.exe
Token: 33	1144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeDebugPrivilege	3432	elevation_service.exe
Token: SeDebugPrivilege	6096	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1452	1144	SearchIndexer.exe	100
PID 1144 wrote to memory of 3068	1144	SearchIndexer.exe	101
PID 1144 wrote to memory of 5284	1144	SearchIndexer.exe	102
PID 1144 wrote to memory of 4420	1144	SearchIndexer.exe	103
PID 1144 wrote to memory of 4956	1144	SearchIndexer.exe	105
PID 1144 wrote to memory of 3828	1144	SearchIndexer.exe	106
PID 1144 wrote to memory of 4416	1144	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_2d397ecca6a5eff890da25af4643d012_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3384

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3408

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5424

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2924 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2956 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2924 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2956 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8615bf21ada74921c767027a775cafe10b0f4df28c37bdbc6f23739ba4707026
MD5 6827b872d88fb19dbb18913506c83f41
SHA1 bc3a94815555ade7f0b1dcf8850d7dab2ed609cc
SHA512 ca3833f0308c67a439504e97839d88e720ceb6cb2fb6e6919ebf71ee989531a2e43fbf67ca3388e32362978d07fc7a19ad2a501e03ddcec8fd884abb1d8cabda
SSDEEP 49152:ob+632BuPkFKRrdE6ohQstBhuXjfS4LWxnA5UfqkdirbGbc:C3q6tjBn5UfNc
TLSH
T186D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 34bac4bbbcb80f39f4c3c5e5b597bfcd3079138f6d5a0f73b752f8c05dc44e95
MD5 27e1dc62673970e0067af1ce0cd80b52
SHA1 b63b50a2198caf11f7b9df98e46908758aa60a30
SHA512 a36ac0ce0d291e2d2d380474c689d3e073b4577b00280dcc0e342cb84fa0e2c93fe6ea6c9e3a9b44e37e7db094918dd71788e352b17936564f1f85fc591bf5b7
SSDEEP 24576:gXYfDtczAtt5wXWotDWi//dirlvZGMApYSRiO:XtcG5UfqkdirbGbc
TLSH
T15D850128B7D508F9ED67813DC8A28501EB3378914790E7DF03A4AA251F772D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2a492bc0a66a9a0c3c6f267797709552885db3d7ee02490531ef6196827b2f92
MD5 b12568f0f7393755799dbb357c155fae
SHA1 324cf198d7b630d7d8257f4d20f77036385b4765
SHA512 5e76494173983babf82f44977781e06bc6273a262389a12df40e8d35f9a0321b650f13c6f7a3e672df048c753c530053221dc9ce0df2adc6c85dd0a4a0d6feac
SSDEEP 24576:n0Le5ji0hmxMrMQt5wXWotDWi//dirlvZGMApYSRiO:nPji0AG15UfqkdirbGbc
TLSH
T1D1A59E16F6748771D073C0B9C5D2A68AEE7230825B308ACB4285D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 db3f3dd77a6bb4f0af1ea45b8c718758513f4dd2db5b560d328c6f2a0e59917e
MD5 3c0200b4315643bd010484aca908b87d
SHA1 809d44b12216f3a54ecad077689a61840d426fd9
SHA512 43c26af1ad0bffa97f06412b092bc85e02452f55332dfcda271d0c56bd0e81610b99de6cde2b1864f5bc165e28c6381aed0934012f74c995ec9311719a533554
SSDEEP 24576:Ja7/ezSC6vUyDZaqgrvWx6q8wyumt5wXWotDWi//dirlvZGMApYSRiO:4/ezSC6vURPvMHjy55UfqkdirbGbc
TLSH
T153756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8166c262ad580440f0614055de5dfd6cc8400c4d85f1206584887c3fb8a149f0
MD5 b60fef56f584dbf0a24545a145fe1a8f
SHA1 ed7a50c841721f18f2438dac93fcad86b2720f73
SHA512 3b39830ce237aed999d124c3614f67bee873254f054a66e44823d0becec0d88d33310339b9a663752787e2df32165a03fb6f5cfc8ab01a59e8da15061a91143f
SSDEEP 24576:SVbqPb88hv/lV7Zt5wXWotDWi//dirlvZGMApYSRiO:SVO88hXlVz5UfqkdirbGbc
TLSH
T12C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 38e544af7e9deb13fa755d10ad1429e75a253d2c2051af73980f4d424ba6da4a
MD5 ac55f9ef0085fccd6b591fb1d15aa7ad
SHA1 8590cd6210e4bce9531fdc3b33e02a693f72769d
SHA512 484c7254dcf90e7382283271a7814997ccebbb1885e9dac58610a8485d3cbda7f356904e423f09e3e1f2ad8bc71411f0fcdca2a18d59052588fd80eb647fbcdf
SSDEEP 12288:ZUsYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:ZUst5wXWotDWi//dirlvZGMApYSRiO
TLSH
T14165234ADF5568F2FB5B4532B06D4E46AB727EC088C1866E89203B6817FD1F4E13136B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 4cefec16d773f25ae78f82d9336462d7d4c0604c877b8188694d1ee51633f8b0
MD5 fcf800f20fad887a9522c025eaf87fcb
SHA1 c67d351fd15ef385372a49efb069f588f10631c2
SHA512 0f8022b484c7299d6b26677b540973b0c3f17f570a552d3d73e2864041eb8587ed8f17505ecdae6b64a515c0951b1bab63dd11997f42e491b8ec7f19232bd28b
SSDEEP 24576:BJIUBt5wXWotDWi//dirlvZGMApYSRiO:BJIUf5UfqkdirbGbc
TLSH
T16785CF3BEE28FCE2C27A8D7956918600E77278704F5293CBD164830EDE275E05E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6c2dbf075dafbcc1115af6573692e4f9102f4f458900bee66b436c0efcf755d2
MD5 7a965d37c918f272ae9c10eef4595c4e
SHA1 6b1212804022ea99247733e84af933fd05b12eca
SHA512 ecbb3f61389dda3ff2adbcde52255428b4457b761c335296892bf09b31a6147bb7e6d84f36553495b71da363e2740a25dd966128ccc7c8323ba81a6d77ef882c
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THL:KQvGAdlCEL8c/pRNw5Cm5UfNc
TLSH
T1DA266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e7d52d2a6f82da1eed88068f258c728c1721bace2b394147097b5c410c3fbe88
MD5 68c4cec910b65759f930ac5c5c52a057
SHA1 eac022d253a341ed716514b156e5570a829eb9ae
SHA512 de5fb9c3bede3cf13553dfa98e119401783e41f49e50e4fede8a4d383070fea2d9bd55d44d3849af5cf1d69e0ade944e0207525ca6fa3a8e52ac25493ca54700
SSDEEP 24576:imewsAjft5wXWotDWi//dirlvZGMApYSRiO:FljF5UfqkdirbGbc
TLSH
T1A185E031FE74E436C27B0DB22B36C706583D7A604B911AC3E3A85E9D59742D26336B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 029fa3f665006b435c217bc95479a571afcf86146be5af82fc7fff5a04caaa77
MD5 6c7be260ea7162225fbe47b048e33c8b
SHA1 441d6d3605a25888f506eb6a18e85f76f9b130b8
SHA512 984c79c6ebee07bd45dd2c161046671c26810376d4575dcdc04b47f401e7a3b312790c6e06fb3e288c8c768437561709cb5ca5f3d9246dc70c33fbd52fc25a18
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHjoN:vUEtQevvqc2W1cpV29I328N
TLSH
T1E5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 69c894c1539bc7da1b33fb0f7d1c89df056e9a6e13ce4870a803e297a409940b
MD5 c699a26e2272f9cba94c6894adef0597
SHA1 084181c4839f99ade2725e7211e579a561d14797
SHA512 36c772be8efe288f85d9f326218fffb88fcbe14257f0cf7e774dd7e7609330cc77a2dd65dd558616bc5caef5520bd44dd6a2b70f31868e900d9037af829a9355
SSDEEP 49152:rCbRquA/m2yL5zTfFiV+XenmE3/zl5UfqkdirbGbc:0oquVjnm65UfNc
TLSH
T1D5D58D0976B8C1E4D1F6C77886A2CA47F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0bf1cf2c7ed31715dbef7c0c42bfffd887da255bd9fbef676fe7d1bcaccb5425
MD5 e45738d48532add84cb12363b031e1aa
SHA1 1993faccf4cb5f2b24896bab8158cf21cba922c8
SHA512 d03f55821d20babad25da72159469e5255a1ede479c42f1445fab6ca5f61dbd48ba370094138c09a8fea4568af2a8f7a05312cf402d9e8b149d1ce481e951017
SSDEEP 24576:rAhGLmIFoiwtA5l7S53Kt5wXWotDWi//dirlvZGMApYSRiO:rAM1Foiq5K5UfqkdirbGbc
TLSH
T19335AE80EBF955D4F5B3AA78A9B68570EA76BCA55E31C20F1160D21F0E33A50DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c2c934d8b24d65cb2d93c5f92dececb336a7e58ffbfcd4f707a61052521d2c18
MD5 ae18ec5a4b5e96f72b35df33a0a69e51
SHA1 112db29e1d164b517c07d45e6775d7666cb987b6
SHA512 acdecb22ca6afcf736d0e1c1d15370a5608d9a5a9280a3c046e4f8057944f459b54edde97d43c24be5378cdee9a9d7e537eca2523adc50fd8a043c2e1faa986b
SSDEEP 24576:Iwu1OWzt5wXWotDWi//dirlvZGMApYSRiO:Iw6O+5UfqkdirbGbc
TLSH
T18585F14A77A41CF9E9678239C55BC536F7B2BC012A21C71F0760C75B6F37261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 4f50da41fb8b916fb053b6213973473280f1d5c3eba03d4d04bbbe99c219a5ab
MD5 11405ff49a7ca6e6d42794e96ccfd9ca
SHA1 f601b390dacf74e1984b438894c587c3072d5fe3
SHA512 6b9bfd515c514106d05bfc4da92e789db9625bf372fa10eb4829a77ec030ea7377492c719f94846bc3dad722280fd64537efae5bc3dede475675485dcddf5e40
SSDEEP 12288:4tZ1IyPYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:OZuYt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T12375128A37E430F6E167423DE8E94A05E7727892576283CF062027691FBB6D1AD35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 81b3894dbd928f4ee20e36ad27642204182bc077925ca5c463095001cc686e97
MD5 ef377801bf9b507ff481f55efafad3c7
SHA1 27b093539a8d24911b9167ed6e8c64a539ab7834
SHA512 1c62894b2b3f97efc769a324044bd1587e9423064843f26f2ec7a461bd3d0f5d7305d8fa5d8c7854c45049df7ad10b4877f11c4d5389f22937f9a9045807e653
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uf:GQRQyi36YOcPuLvw2gAf+PN3j5UfNc
TLSH
T123667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7d4b9435defd790e57925097d3f07e1451032848a48730b47aa88ab4e67c8d86
MD5 05726f861cc6aaeb642a143c599fef74
SHA1 cef66ff2b54b67459a0333fb2843a80bf36f3b89
SHA512 4812a35e7cb792cc66475e37f62dad0cb012632bb76a9e4e9754c5b1a570577ed20a758154ff3e7d6a83af2b4203f562d19969ec7e0d5b3c030357d98ce1299a
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uf:qQRQyi36YOcPuLvw2gAf+PN3j5UfNc
TLSH
T118667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e3c4a90bc62eb37c75bd24b565f0d67c63366f055a1423c407f2735014f06ed0
MD5 92c0867d55e50e85b68ec7a2941e7c2b
SHA1 ae21944fcc933a5e161596afc230d2862d304f26
SHA512 82e8f953729dc9077990d203c65b96b0b3c6dc82dbfffe4e3fb958830d588fb800824b8d136f877037376ad769407479a66ea58c759628925b4a6c5523123d28
SSDEEP 49152:Z68Qg55nhxeWu7PNU3/15UfqkdirbGbc:nthGRc/15UfNc
TLSH
T1BEB55A33B2F600A9C44DD1769F4A872196D27C718FE1E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7757fb3c8efe3a48c82a02395da4b97dfa4f0cbdd8130ffc518bad31bd996157
MD5 ac5b06e42a53d17f888418b72be30cae
SHA1 e4a2d1158b45f3003b27205c87fcce39c0c0891e
SHA512 1a27a90fc21a47246e26a7a56ba4ec7c221de4fde0108bf482dfc27c30b4df0b7777332c1ce088c3252b03455aeba7f5361f9ee378deea62677150401f7f56ae
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99N:Ry5112gYy5azzVvD69nLKnhZU5UfNc
TLSH
T12F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c572ed1d0b9fa34d295b1277296697dbe320ff62e9921b9540e4ba53e261b66c
MD5 0bb09f06fd77c7810059f43e71a35432
SHA1 1fb099fe6b8fc8a65abebb2e209e5398e9186eaf
SHA512 e13cf02bd7ae7cc05328b9cc7f6333fa90091af23a88d8de3959744fd0c1d29b6b7eaefcf076143f55de294c4305436386136ee5140321589c263f3eb2097107
SSDEEP 49152:iB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glL5UfqkdirbGbc:Qu6JmQxd2dL5UfNc
TLSH
T1EDD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 69230ae810b5883c39015ccb7073ff462e93725e03a74f93a26223f4aa1f25f5
MD5 5369021eb1b31f4754d734c095de733f
SHA1 1cd572145a31fdd9a6379279095ed39e61b33505
SHA512 ab7e3d1ababbd9f5aa3e6b92cd00552777697c4857de1abab51f1c87f01dede1c8ef852d63390936b2267ae78f76c985dd34f2be226e45f972284e2feac39005
SSDEEP 49152:21hpsNoJpF1A6yU44CwH7R4x/5UfqkdirbGbc:2mifPVR65UfNc
TLSH
T1BFB5BE13F2D900E8D05EC17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e86f6150753616350b295af6aca1b2043824a9304835b682ba13319a78e6daab
MD5 69bd3dbdde7b332f1add984910aa81e1
SHA1 5e2e4ff63862e795c84bd6c61c9af311d67a17c1
SHA512 8726720acdb2051a2dcf90c54f7fca35fc13df38b475fd0811c7d4875de71ebf2539dd617249fa5f8e3781937d9338f8124f215d76d3760c3c5cfaea3f2034b9
SSDEEP 49152:lSuZQIY0Be2KIRVtOnks6NMHqQ5UfqkdirbGbc:r5dKOi61Q5UfNc
TLSH
T1F4C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d96a52d38e29b6d8766ea7268090c87d103c3fe18cd44089d1a1758084d9522d
MD5 2f7490923790083eb62e1a90e1835ebf
SHA1 788562f09a373275709b0658690967bb28b4d601
SHA512 ff92d7e9014437bcb65713b772eded02f11ec44cf8ea21811e63c47f3d6fcc958a258b716039ef2b304eae88ed1b7f4fb9906f304428f0846e02cc55e752cb7b
SSDEEP 49152:lhtSn8EApI0figGgiDn0AP5wb5UfqkdirbGbc:UX2i/phe5UfNc
TLSH
T18295BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 02b82e51c8fff79413797d82e27e0dec133b0594588b3142c9a134875a000a9b
MD5 ad56c911f356a037353ae4ec96dfca89
SHA1 dbe5b96b50148976acddebdbf57b978506741816
SHA512 7aed9c519055f863edf8b8dbe5bf7e9b63e6d6e8eb9547ae037cb242fd734895b9eb025a832d3747870b3a5530f55169ab4702f76f1aa8a6cd244fd81208e2de
SSDEEP 12288:V0YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:V0t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1EE652349DE9658F7F6078672F06D4E49EB217AC1D8C282AF4A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 aa8e07402559898b83925a0f1491a5571e303b59a65ac57cdcac69fb8521d163
MD5 97457784c2d0e2a0a766ca9256147c24
SHA1 212c43a442f8fc61f32b89e3185b1780324e2d5a
SHA512 022ff304e20fa569279d18411655f47fa543ef22e17234d6c6cee44b32e6c166b3f07ed4e698618aef78d438d31c841ebc82fd9cc42a8a1e08b6805731e9bce9
SSDEEP 12288:OrYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Ort5wXWotDWi//dirlvZGMApYSRiO
TLSH
T10A652349DE9658F7F6078573B06D4E49EB217AC1D8C282AF4A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 41ebc404167d6e6ed6bb5134fe0f2b5c9b61319090aae1cbef93220ef94ef0b9
MD5 031556747d332a235f37bb7e6fbb2dea
SHA1 42011ea7959c88ecdcfaf520d4b9a94ccf470ee9
SHA512 e265ffa9bc56efffe46754c35ec60bed5198088bdea3de74f1439d3821fc245b05ffbfb6d76dceab4168e295586dc892be96ce022552c7f3a3c0b8ca5ae93de1
SSDEEP 12288:GpYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Gpt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T143652349DE9658F7F6078573B06D4E45EB217AC1D8C282AF8A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 2fa50b35241ab10411489521374c1db1975a160874e900e18f18e36cd66ab2b3
MD5 0f4cb303dfe69930627bf81223282c77
SHA1 e08f4d745ea03537fb67c627bd28094e57dc88dc
SHA512 f18ad05cf331584be0f052b4c92597498ece40818a60b495eb2a68e01f0ac7ef99533247f501aa8425b46d5b6b4e2f9a3d23b556cac87aceb177eb6933772f3f
SSDEEP 12288:4VqYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Zt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1876523456FAA54F2F917C236E4694A05F7727DC0DA4283AF4A103A580FF92E0E531B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 7ad84883a399dc7b1352e3b9658fdad8592389ac9a309ee16358066cbc27d957
MD5 520b36ba54b636f11d267660262a58a6
SHA1 032f548af0deafc300f7693d241b72412538f771
SHA512 3e7bdfa75f7c0e37f6bcf996d1613ca31a8f0161f0b04a9065fae8c66675e117f261c071c043ea91a3015a892a526234cff2fe115941078bf444b9e3fe545199
SSDEEP 12288:jiYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:jit5wXWotDWi//dirlvZGMApYSRiO
TLSH
T114652349EE9658F7F6078572F06D4E49EB217AC1D8C282AF8A10362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 608cc008cd4259600b40dd758b50bfb715121237cd2a9796b201e4e809e537ae
MD5 681c5929bf90dbf178e5c077eb7a95c9
SHA1 409c0fe16a9695d5277c97dff3496223636508ec
SHA512 f8834c09f7607fac6be7ed506ccc19fd14c1405df6e64f1f1e9b1ce52d44a22b637c7c62ce833a9c21b387bf22fc9fb1bc342154aea47cb0c3b38ec46ce7822f
SSDEEP 12288:hHYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:hHt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T194652349EE9658F7F6078572F06D4E49EB217AC1D8C282AF4A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 8c42645a499f2a3673c8a401ddb77240b3a2501651df86aea1bc21fe085abfc0
MD5 ba2c830f2526b116016f89d5a96a4db7
SHA1 40c0a45de2c51c8e6a81120ff7ef13eb6c81ab61
SHA512 40cf2ed38ffcaf9290eadeadcdeb6e67fb567445fcde3d079554f7260ac8aa65cfcf6831fc5c6f3028972c4de7caf5326dc997c96cae510396c393233e291d56
SSDEEP 12288:2DYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:2Dt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1BF652349DE9658F7F6074572B06D4E49EB217AC1D8C282AF8A20362427FD1B4A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 79abdecade11b44b63d95a473017a5cdd9afefc387aaa2d18140c1f6c1bff236
MD5 9af0a258725235dd0e9e0926716ca605
SHA1 6fc8d2caacc5f5af58ac5fb27db2cebda349a3bd
SHA512 14b9f39d4f91d74bc73ce4b1c68149f56465ee2c0cb8fc3ba1b5c64e6cb32f1c45db7e2331032054471389927d51e36d285f3dbb48ffe13a882b7a8d5649691d
SSDEEP 24576:4ZMLzFVSOLt5wXWotDWi//dirlvZGMApYSRiO:4ZMLzfd5UfqkdirbGbc
TLSH
T14C850295B3901CF5EC67813EC8658D06D6B27C560BA0C61F03B4362A1F773A15D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 da6dd6bb544cffeaf95f602201848ae7342434a7be16fbefe4a323df853893c4
MD5 380d69f5f9f41a23f657d4b1ab497919
SHA1 b0cf3df16c8bec0cd5aed210d3252f974081fe54
SHA512 937931f5d56305328881eacc9c921283b80a165765b5ff6d187e83736090f672a70f4dcf29b293913a6669ee5a913432a4200ced5c2b18b6262d7151795d68d8
SSDEEP 12288:5IYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:5It5wXWotDWi//dirlvZGMApYSRiO
TLSH
T16565234ADE9658F7F6074536B06D4E49EF217AC1A8C282AF8A10362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 e3e4e22678ad95b8f296c1613d6afdbbfa0b1a3a80915d1a53c110fb24e62e90
MD5 6841bae237cf66620107ab3a6f04a2ad
SHA1 e70412ab59477a0954366525ed6e297231782c92
SHA512 1d480236a1462e820c366485cfc8270a3bac7deb4ecf2a4bb5bab5e6caa408e60c048d9e2c228521c75e7e4e77e9be7c77017e430b4233c10befdcc8c8fdad65
SSDEEP 12288:4cYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:4ct5wXWotDWi//dirlvZGMApYSRiO
TLSH
T10565234AEE9658F7F5074572B06D4E49EB217BC1D8C282AF4A20362427FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 8a0eb168f2343656ec7ff7a0a8fc813997abc13790015ca264653a011c69f905
MD5 edc23a367abfe5f0486cc5b2b64710f8
SHA1 f25a0148f24abcb84bb217d2fb8094f16a461ccb
SHA512 7006efeab1a2ad421eb673646da579a5a87d433f786cfe73dd3b207bf019499c8e9be3be75e82a650a970bf661a7bdcc5670d6d090710d7d60641d3cefb4e2d8
SSDEEP 12288:uyPz5L8PYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:zzyPt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T15975024777A530F9E1278239D8660A02F772787247508BAF476017762F7B2E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 9549d2c825e0039a24a153f716b3c7e982ac3001161e74111bb2aae930dc4f7f
MD5 3fa821783882a32644ebbdf0d7df82dd
SHA1 1a81e37ef2737c5fda6cebe05cf31107ab7c4eb9
SHA512 3d799bb7114f07858e0d5100ea698376dbb4fc2c498200e45cd615dfa27b27dcbb2c596bf1f5b38625fe93365425fa7f4ec38efb7586514eaae48f324082642e
SSDEEP 12288:UIYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:UIt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1D365234ADE9658F7F6074536B06D4E49EF217AC1D8C282AF8A10362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 a5936f90fe20a4c00a603e9da3e72624adf3339f1dbc2ab4a33c91b93c33d193
MD5 f8dab83f8b1cdb38ca1443601224f5a3
SHA1 fff18bad2c8f4250997baf821d6632b9289c025e
SHA512 b35c3e80b9905deb5b5bf347c2e70c0c0796149989e317b86933947f3802c2400c13be073b41be2af190939ca4352c3509bb099be8969a7c3717db8745b4d47a
SSDEEP 12288:SIYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:SIt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1AA65234AEE9658F7F5074536B06D4E49EF217AC1D8C282AF8A10362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 7364b4168895325d3babfb0d52433b126dd39d2454a3ba4bb7f5f0b026e7094e
MD5 a26bcef19893f6105ca1b1dabbdfebc3
SHA1 e575ee40d7813bc58b973de7e15526636ab37985
SHA512 9c2f12e1141dc1a34cac70d978ae057653d7b4f916502379dbeb0f8ed519b01799b52f8f28c395df35f271be2d316e26581bfb5943d888124f563bd7fc818e6f
SSDEEP 12288:JyPz5L8PYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:ozyPt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T17E75024777A530F9E1278239D8660A02F772787247508BAF476017762F7B2E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 4ed47d979155f3afe20191b6ebfd3008d500a61cc5174235cf6e2ccd77f861f3
MD5 a951abde3952191efe62c00a8b541fee
SHA1 6c811f35639c09914dd910095a971b51aaec2d7f
SHA512 2ab859d2ea310f04b0e658b2d5a173f994dbc63b3317b237f7d85e77f541877577c3e3256e878d391b0dad6906c4e08f8bd628114bf27d7081ff758e51a45483
SSDEEP 24576:1TAaLl3z0zD5t5wXWotDWi//dirlvZGMApYSRiO:1THLljW5UfqkdirbGbc
TLSH
T13F850295B3901CF8EC67813EC8258906D6B27C560B60C61F07B4376A5F773A15C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 1b839865e268f1a32cee2bf5b7d7060cde2ab0c6bedd507a220271b7ff7c7d64
MD5 0bfb43deb09371dac38cef90c98401c8
SHA1 30d8ce66dcdc56792daf9a2e0ec59562800d7fbe
SHA512 b3c675a9ff5a05fe2f7ed1130c852085218f7c962aed33d88bc7ba5f07a04db75258b37c91cc29edc2a9008cb730bdda4081238da570645aecd5c693401c5549
SSDEEP 24576:j3Pd9CHKy7GZ1t5wXWotDWi//dirlvZGMApYSRiO:DPd9CHKyad5UfqkdirbGbc
TLSH
T1A895CF90F7E414E8F0B78A35C9764512DAB67C9A5B61CE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 f5a6679563d909903438497006b3fae85b397e496061bd562603bf01865cc55e
MD5 b45f007b082acfd9d4915af6afd6db21
SHA1 b0d4436348113a648eea1afa05dcf85ababd4590
SHA512 28aec9eac9e4fcf59672b2da2572c88cbea4bcec138ad0274db3fc7c6349dc8384bea11e354de74fda5b3c21dd5d11b04b6d041103f303deb9e084a873de2996
SSDEEP 12288:zJYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:zJt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1A6652349EE9658F7F6074572F06D4E49EB217AC1D8C282AF8A10362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 7e264d90f844f05b3cf05059b2b559b5ae4fd9d378177c277f59a6e2dd3467f4
MD5 b0d15c8abc2323ddec06055168ecb9f6
SHA1 dca86b3f58490377328d7ff3e69470e32fc3e42e
SHA512 f871fa0c561960dc4c5afe2b3944f80390b3dc9bfc80dd112152ff43c0297e2c404f4f3c1289e769763fb378acccf648249b963c6c4256b2675830182d71d495
SSDEEP 12288:jvYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:jvt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T15C6523499EA658F7F50B8173B06D4F45EB217AC1D8C282AF8A60362417FD1B4E1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 8555754d006856c7949045fc75fb55df49cb860b310a34ed0e9f5a9c6d978a8c
MD5 05abaeca14ccbc393629d33eb69dee61
SHA1 37c33d8ef1129a8d976b501a06485c2641ac6dad
SHA512 1b9eb1fb52692d9321b6ab5c7f29f3a36ee945f4137761d4c06697898116cbc56b1b09995ac05ef6dbb4db0b054a61d11416b02258ee8d94ee8f096ce4f66b87
SSDEEP 12288:5eYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:5et5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1E5652349EE9658F7F5074536B06D4E49EF217AC1D8C282AF8A1036241BFD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 5383a580312b5a29169de73409a3139b05fc599dd9fab2cd2cffb939853d8871
MD5 77435925c17d12496d2249e3cd93a1ec
SHA1 394b7b4acfb0dcb11b2834b47edde8f9b10ac5c4
SHA512 5720bdab865cad9fb90e1177e4473f181c2ef5a181793d4a9dd4546b5b18e2adbfb217838b01928f2ac234b8f0eda632303f232082cacb2c4d3f68a327111dd6
SSDEEP 12288:bIYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:bIt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T19D65234AEE9658F7F6074537B06D4E49EF217AC198C282AF8A10362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 6732addd8da25a9e179332d0d186b26814eb069ffb3175f3810e6a274778ff6e
MD5 a83a1c87b8b07f1fc189e99746dd20de
SHA1 f5ada960060e6fafcc9916b6ad455012b13c0f29
SHA512 849079f427f4bfe0bd1288a3d58a22381b52ec213b57a661d374f7e6325cd9db2d75ccf6c3b3db7e95b5e842b7f7e78df5f79328e0cd90b4918b043bb257b528
SSDEEP 12288:9JYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:9Jt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1ED652349DE9658F7F5078537B06D4E45EB217AC1E8C282AF8A2036241BFD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 20213a1a593d73f6e6d27b9e06355c4194a25c548e703c8538e4163e17412af1
MD5 5957041a0efce4b3a13bea40b8930e7c
SHA1 5b33782c2bb9e9db2951f0427cfc188db892f582
SHA512 7e6d39fa5c600945211ad04542f5b8ff9ab509ce074650482230578514166deb9ea6168f9127e9e3aa28982dbcd84db76233d63f7829a1d7d2fcde45e41cb433
SSDEEP 12288:XgYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Xgt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T15D6523499E9658F7F6078173B06D4E45EF257AC1D8C282AF8A20372817FD1B4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 913028d48fcc1a33cdc43937a8171460f5f34ee3cee466dc06efdd41001dafa0
MD5 e7b79620bb3ec0be740f8f2f85a87471
SHA1 531ee361d2a862294833ed8082a44d35217cb155
SHA512 2b9f78b5511e0d1fd026fc6dacdf6a051dc49561b415bb48eb70197d121458196a9d9175153ac0e831271b335063ddf8d1290de59f934a75413d5dc465790de0
SSDEEP 12288:6iYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:6it5wXWotDWi//dirlvZGMApYSRiO
TLSH
T11A652349EE9658F7F5078572F06D4E49EB217AC1D8C282AF8A1036241BFD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 9dae358eb750b60586440b18b89c5a6547e5dbe8bb54373ee46152a261d2c7ef
MD5 1bb43d464adb5c0a42853140eaa33be6
SHA1 dc4b420166e14905d6ae525214d52a82d61291bc
SHA512 a01b038e0a15666f3ea20a2ac9e6f500a7af735dbcaddbe4a7f61b26c2c841396cecd916508185af503a93989c7fdb871c3577b71b86a87d0fdc8324217e4a23
SSDEEP 12288:PxYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Pxt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T191652349DE9658F7F6078573B06D4E45EF253AC1D8C282AF8A20362817FD1B4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 e0a338b17269fc5143d7ff8e1ab665e6e2add64774c5f3979712150f0f83c037
MD5 d796d6a79f43e1e7e4a93428f1592d60
SHA1 8d26e9bfd2e58d6968513fc564be86084e07e4f4
SHA512 c69814ebddefb1dda6608cd3b1dcaced8f4925807a4d2f925925e3457f3518ef6dd6443ade91b9bc055a981ba30069fc8b39cb9870831664b0749ccf4a793f78
SSDEEP 12288:FiYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Fit5wXWotDWi//dirlvZGMApYSRiO
TLSH
T15F652349EE9658F7F5078572F06D4E49EB217AC1D8C282AF8A1036241BFD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 e10b5533f6061be8550cfbf8e2a6555738721d8b358dff7c82bf46e1f09a2dd4
MD5 cc8bf3c30e15117f6ad1c4f8462691af
SHA1 e38255de6e37be9e04535f632720ee070d463656
SHA512 b5662e5a22526ae0f641db958cf4cbbe2a9c39c479f5ecb95cbe585163d3b0e8ba4e41292e2217e2083bff324a32a51f6feacb1329a700c659342fd6354a786d
SSDEEP 24576:WfwvLk9RX6wkyAIMt5wXWotDWi//dirlvZGMApYSRiO:pMnYI05UfqkdirbGbc
TLSH
T15995DF29EBDC44E5E177823C99B7460AF6B178591B31C2CF0299536D0E37ED4AE3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dffb57cc2917f29f7b9129f2fc109dfce4c7fd85ed7ff34ba059b3243ef02973
MD5 71827bf636ca9557ec2bcb670d5f1f6b
SHA1 61f011487ea7baccfef13e510e91e160228f237e
SHA512 b59a540992dac27022498e3ca7056750d0de7cb722648c892a5e152345702c5caeffe02c48b72e7a2956548705996fbfc1605ad7d026779773e7b6f28291eb9f
SSDEEP 49152:BYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK075UfqkdirbGbc:vySzPD5UfNc
TLSH
T1F6067C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5ed5e70548d4eaf66c337cf3fea6ce074f1bd8b097e06ce2bb545c4c4bcb18d4
MD5 67dd57e36d422d3fa6245770fc33bb33
SHA1 7df8b51a947ce8e563d7b1ead4e9974b135cd246
SHA512 2128ade15ac0e3e7d3234f31f7631c2050f1126294432e1d6f3c9cff88a4f8be5d972dfa18067ace47ca7c66ef348d8cfe0b11fd524f55151ed54e4d4523cc10
SSDEEP 24576:n47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY7t5wXWotDWi//dirlvZGMApYSRiO:n47JUQjairIhCnDHUPfF/L5Ufqkdirbr
TLSH
T11865AE1EA3EC01E5E1BA827885154A1AEA71742E1F31CACF1270537D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 2996d02658399c9244abbacb0400d14e6f83ba7d2852851ac3eaa6612a1b1785
MD5 32229910793d06cb452429f6fa443e02
SHA1 fa538415dc05ff87ddf66adfa4c520dcf037d10f
SHA512 34da6336bbc608278c58e491c6e1bbc25f6d0074b71dad9444df711e821c0c08fc84a522bdd87d4febad3f78c4ffc0088bd421cf141a6559b5cc21820e7c5806
SSDEEP 12288:aasfYYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:uYt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1E075F00AD29801E9D06E5236D75A4A41F7337C6187E1C3CB46D0F53E1FBA290ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 89adf0fb50d63ae0ff5d0c086eda6420ebbd157f345af9f6d46aecfb3b2b65d0
MD5 cd9fa2bac191205647245cf0ad5e0fd0
SHA1 b05ba7f1dddeb67c3d54a413575a94514cb0f441
SHA512 0dcc097aca12a56e3db827d16d3b87d94f6dea12e717ba82219a28c6068f786db08b48cd439d46f1e70d427dd9982d60f642d91c608ba123926c0749714e0a66
SSDEEP 12288:KjgWfy5Kkuodbj+fceUGcOjEkvpLGsIeA:Kbf92Jj+jUGljEGpLM
TLSH
T18D451701766AC75FC6A940325E37D1CCAB707D01EE456B0773C8873FC5B6668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e00c3b28c8a4e6997aca5191fe4def0f621973b5d13192620273e4c61a918ee5
MD5 b9c210dd8b9327c0600e0b9fe4f8da7e
SHA1 72a0630e74da5a317787bca2c055a00ecae35658
SHA512 68dd393f717fd56c9ba6e9e1d0254cb1317d81d28c417119cb9c66292a51ef38a6e5367da25446224efe80a4c489bfc39d1e9ecd613c18a2033aee8eefaa01ce
SSDEEP 6144:MIleLD+fIuPCSgSJm9y13+BKDexHYjNFBKDexH/vYPw3yfhpI0SvEAKE:2+7Pay4wj/3yfQ1KE
TLSH
T1B065D741A537F38FD0F75032072A6B4CA7A4EC0677056F2673C8493AD86AB65B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 1c8bdb254a863189836f036913c238287370f71cc01c77426ecc8ab2bc173524
MD5 0b43bfc849511d556f1f0d8c1e7a5546
SHA1 3e034c544d63214fc9a5a868d4d1b78e9dd06d38
SHA512 5d660072523964f2c6bdba388e8f0a73e1465197890bc54a9ad7c09652efdd076dad7f310dd1dc32a8e1865deb08f2a29f8910a9c474c7a44e3d79e7d96252e8
SSDEEP 12288:U+7wYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:/wt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T149652356DF995CF6F92B4231B06D8A05AB267AD08F81C1EF8900376817BD1E0E93176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8ad26b5e4c69865962168c0b78543130f345fb74fbbcfbda856ac8ad79fedc33
MD5 fc436cb09a8cdc9137e9a93d672e7bf3
SHA1 84ed2c30025de22dc2198dc85f84bb292385de70
SHA512 9d55365944afbab3051186f02be775699ee1223b4638a4ec8f71c0cd9acda0faeaf50252bb4d0500c9d538014d18e42adab165c002c9bade13bf93f8417652a4
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYmt5wXWotDWi//dirlvZGMApYSRiO:Mgb4mBIBhGFB5UfqkdirbGbc
TLSH
T1E4659E1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 ef419dd3c92567d32908579986d0385d761eb96d844ff243cb7029e7b3a93faa
MD5 837ca978340147b46794b7ba4691663c
SHA1 b543d73d9a757d17f4a5d6c9e78b647d4e75f462
SHA512 a3827aa232f58328c34ed0d7ea7bd66e4a85ac837c778419f578cd72567fd647fc40fe3dd4316f59c9321f40ff69560dd9c0b7175bef6265090c3dc193f8935d
SSDEEP 24576:AG88u8FpJqH1Zzria7/mLt5wXWotDWi//dirlvZGMApYSRiO:T7ZFPqVQa7/O5UfqkdirbGbc
TLSH
T138A5F165B7E101F1D47BD13889864A63F6B2B4210360EBDF0BA89B551F336E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 523adea016582391ecabd12fc9984d70d92c641c06a1dfd99326596e230f74bb
MD5 5f432d9f955e1a70c8dac9e8986a2fb9
SHA1 591b9ba0c168d7da74398b31a6e9097755cc5a47
SHA512 bd52c6763b79c12f4c917e76107d6058e1a4b6df3f943c311d1a24a4c6ca63970495b9ab14c488282b955364764a44257f51451b3215e515337d43292115d614
SSDEEP 24576:kPUr+NQ3t5wXWotDWi//dirlvZGMApYSRiO:kJQd5UfqkdirbGbc
TLSH
T1C785F11F66AD18E5E676D13D85868709F772B4620702D2CF02E0917E0F77AE8BD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1db00d6eca8df6ed97d27528143c646191b815b36314fbbc3632484fb527aa2c
MD5 bd907ac6583c1a33417651f36782569a
SHA1 22daee50c7c272dfa5bb5e2ec3ab445f6bd36c9e
SHA512 7eafbfba0254303c3d095ac531683757e9c937e65d96ad5f813f7b67e789fe812b0374d9b4b02871a6797fc81971b5cdf2b19cf1fac4c721b5fb21856c8fc588
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjN5UfqkdirbGbc:EG05lO43bM5UfNc
TLSH
T18CD5C06E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7d8a0585c2166d1c8fca1e5b2899f2c006b2df348c1c1349ee64d68165a1e0ea
MD5 3f27d4c022c26c1a1f8b9245142df74b
SHA1 78c9530ff5b1aeca810d94ac895ee022332565a0
SHA512 c93eb34f2a73eb4010479fcd2ede1d61df6e4b558dfd66519eb1583dacca937089953051c7b7d68442af0f8b39fc8c7166a0efe7c8c5ff89be923cac5cf2570c
SSDEEP 24576:Jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnNt5wXWotDWi//dirlvZGMApYSRiO:Za5POZ3hJt2pasx2+m15UfqkdirbGbc
TLSH
T15665AF5EA6F800D5E579D17DC5834A1AF5B1346153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 00b546e856a2b63875da40bfcca1a581a52b6a2f7884c26aa182e397c37232ca
MD5 f98a90103e762a3dd13ab992b88d1fdf
SHA1 e6c85c51c795e77dd592092eeaa37acb5bccf33e
SHA512 f7fe7a40780573076267fed1d6259a0622a3fd917bae47bbe783cbc6873bceac5271d6c66a6007652f33ec1d8099cba5cd384519d341ae267487b341967df494
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkTt5wXWotDWi//dirlvZGMApYSRiO:GNc/zEOVHFu5UfqkdirbGbc
TLSH
T1F1857B1623E901E4F1BBE1BE897B9946FA717865533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 39acc5e4df0174d681d343e971ece2d280133a5e6815fe827b0d0b9edce2c640
MD5 3e5843e55f0ff0a3158b4dad28f3b04c
SHA1 b7c539b6803b3f69b30497d03e9bc2e2d73ced56
SHA512 37ba5c1b3df25df65822b61f474f436eef3b66a8a306d38b16f8245c1cb25ca1fc37332e6f900a25f9dc2ef68e0e4f8bcd3c8f2f972d2f973ebdb50c7b334704
SSDEEP 24576:E3kNvNnaFeYhJNtmZBmxt5wXWotDWi//dirlvZGMApYSRiO:E3MwBtOmv5UfqkdirbGbc
TLSH
T17355AF6EBAB845E4D1FEC6B5DD238512EA727461073293CF4290C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 976f9696cc299b07b8d9424c275e63a8fc14038688312fbfbd5306cae2eada35
MD5 8f67c18f2fd0d1fcf13d1fc0197dec75
SHA1 af2801b6454f5e0d1e7c9e8804cbb29ce27dec04
SHA512 d46ea12d814df649bbba5827449d1b7ad24ffee025d66c740caab1e93ca21b57d0f686a146c5e85e7e9ef7548b80045e5984e3421a0c7fdd82d964d35e8522e1
SSDEEP 24576:QD3FHshBIYQgAUt5wXWotDWi//dirlvZGMApYSRiO:QDVHeBIAAc5UfqkdirbGbc
TLSH
T11E95E17DEB9C04E4E57BC1BCD6638A06E77138A9032256DB029091B91F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1144-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1144-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1144-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2332-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2332-109-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2332-107-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2332-363-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3024-79-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3024-305-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3124-303-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3124-68-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3124-74-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3124-66-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3368-0-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/3368-304-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3368-1-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3368-8-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3368-7-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3368-308-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/3368-78-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/3384-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3384-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3384-53-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3384-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3384-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3384-39-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3408-55-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3408-56-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3408-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3408-288-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3432-22-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3432-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3432-15-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3432-21-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3432-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4952-127-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4952-132-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4952-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4952-121-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4952-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5284-365-0x0000025E29CC0000-0x0000025E29DB1000-memory.dmp

Download

memory/5424-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5424-82-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5424-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5424-378-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5424-376-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5424-359-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5596-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5596-360-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5596-102-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5596-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5596-96-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6096-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6096-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6096-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6096-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download