17a3c8c13c03fd4ed1e083ecb8b431e63cb176c768654254c9930e8c5bf1a00b

Analysis

max time kernel
140s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260731-dhhs6sbf86
SHA256 17a3c8c13c03fd4ed1e083ecb8b431e63cb176c768654254c9930e8c5bf1a00b
MD5 6989adc53f9e760d0504001c47419141
SHA1 9d303374c79f24d0914d8ffd79e52e1f0a3ab221
SHA512 f0ec6858603d6565c420f7a3bc28c415948c6394cb443ee0ae5199fc345009386aff0ab04d7058e65f359147d40f3bb9f763ca3cbbe6db17757c3fbc3f2fc86b
SSDEEP 24576:JhoH6ThNF4Xx7AlOpayI7qWwfMaCGRdd3aEHX:roHGFEBAIpaZtGRddKEHX
TLSH
T1AB35D049AA5440E1E1F6D27889834946E6717C014771DBCF13E8E27A2F37BE19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
4236	alg.exe
5468	elevation_service.exe
4256	elevation_service.exe
240	maintenanceservice.exe
5704	OSE.EXE
1292	GameInputSvc.exe
4664	GameInputSvc.exe
5340	msdtc.exe
5964	PerceptionSimulationService.exe
5900	perfhost.exe
4388	ReFsDedupSvc.exe
4340	locator.exe
4264	SensorDataService.exe
1116	snmptrap.exe
4676	ssh-agent.exe
1988	TieringEngineService.exe
4440	AgentService.exe
1492	vds.exe
1564	vssvc.exe
1952	wbengine.exe
5804	WmiApSrv.exe
5276	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\25c97356b05c2f27.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe\""	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4664	GameInputSvc.exe
4664	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5076	2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4236	alg.exe
Token: SeDebugPrivilege	4236	alg.exe
Token: SeTakeOwnershipPrivilege	5468	elevation_service.exe
Token: SeTcbPrivilege	1292	GameInputSvc.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	TieringEngineService.exe
Token: SeManageVolumePrivilege	1988	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4440	AgentService.exe
Token: SeBackupPrivilege	1564	vssvc.exe
Token: SeRestorePrivilege	1564	vssvc.exe
Token: SeAuditPrivilege	1564	vssvc.exe
Token: SeBackupPrivilege	1952	wbengine.exe
Token: SeRestorePrivilege	1952	wbengine.exe
Token: SeSecurityPrivilege	1952	wbengine.exe
Token: 33	5276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5276	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 4664	1292	GameInputSvc.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_6989adc53f9e760d0504001c47419141_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5704

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4664

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5964

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5900

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4264

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5804

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2c257043cbd086905f129d5ab49674ac878fcd40f44c52a764a67aed5cf03b2b
MD5 c56b4ce842886c80734d0bf356032ef9
SHA1 7c9a8a12480f3add54f83bf9a7c93faff05447fe
SHA512 66779b4aa1e6ac3387d6a80bd72545397eed268b5a604b9ecc970357146bf201a8c1ed3140c7e5a30668b4bd63db44332d82e6216f2258530aad87f94dd4e29e
SSDEEP 49152:Lb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn9HpaZtGRddKEHX:Z3q6gjBYgtsx
TLSH
T1DCD59D03F29900E9E069D178D7469133E9A2BC890B34B6DF0790B6562F7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 1494f163d991c00db67ba1b250a6038bca9adf100a8bdc8e96257e2fd6e5d828
MD5 78f4ff7aa06962a40926687f571ab211
SHA1 48e978491da3ffb05ea29d2e26719e664cfdbebc
SHA512 8a753b19775e7982fa5b6605323c88e48e310dd7b361d3d9caf98d83da00c1607569460e0306a202d66b2eb991d71ef8f83bf99f837880ef1e0829f4c1db0e2a
SSDEEP 24576:iXY6DtczANEOpayI7qWwfMaCGRdd3aEHX:mtc+paZtGRddKEHX
TLSH
T15E050229A7E504F9EEA7917DCEE28501DA73B84143A0E78F03E499654F233D45E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 538a003a1d49b1e896bf05487f445a830ea4f43419215ec833cf47f23569476a
MD5 c72ead5526423696f4ad14226436ab35
SHA1 a248129229a38992f3f97298a94778d377b2ff55
SHA512 b9811127aa391c599aedd64a183e66170dd6d678042a755bcac2491b89caca6afb3b21c46dcfe5a4058522fb545c641f6d286bbb01bee50e76cfa3cb5ef11ba0
SSDEEP 24576:k03el1T0fFxOrMvzOpayI7qWwfMaCGRdd3aEHX:kX1T0do5paZtGRddKEHX
TLSH
T14C459D26F6748375D073C0B9C5D2A68EE972308257308ACB4286D77C6F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a390898aeae78f50f2c398c03897b4375092fcdf8a9c81a0c38f4524863bed73
MD5 4d2e98f884201dfab22405cf2c5e8179
SHA1 913356e7ab35e1cfb3b126df8b24d6d3d1b49428
SHA512 1c157ff3a7903e1377e311b0e29285e01f8a61afa2c4502db97f73f4bfbb0f128ad5ee5e999bc2ea61e2a683e16e3adf42ddb13f75b7062548eee2960eb33d80
SSDEEP 24576:8L6/ezSC6vUyD/aqgrvW/6q8wyu2POpayI7qWwfMaCGRdd3aEHX:P/ezSC6vUzPvuHjyepaZtGRddKEHX
TLSH
T1D6755C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 6e52624b2a99c7d166b34afdd7f901ce730fe60e4afe1db7a8eb58e13a641420
MD5 7f0227788139fc581779d3f067d53ac5
SHA1 de8a3935c2e4065090b8dc9e897898054e109e54
SHA512 dbd81fe0f5f36aecf9156ee90e41265dff3c7d6aba400b7625b987c9f2c827f573449c05ebca6618efda93b8cf906fcd422868fd65f550924cd7a22ae654cc48
SSDEEP 24576:+AbjPsv8pv/l+dvAOpayI7qWwfMaCGRdd3aEHX:+Acv8pXl+9paZtGRddKEHX
TLSH
T123559E66F5748331D073C0BAC5D3AA9AEE7230424B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 4bfa4a32d7fb7547eb3d409babeb36bbf6952b48dd3646f0d76d8858d807dc95
MD5 93f6d406118138f2abb2eb97cf0217d0
SHA1 1ffb2ddd260455ae6ef628fea7d6739efe1bbe4b
SHA512 10d87c64bcd566c69315ce94344ba4b96ad8ee0379252745c942c7c4ad7d3f204286e012538af32c6c002df4ce8a2b4f62e48572b0e82583628353640ebcb495
SSDEEP 12288:AKCqOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:AKCqOpayI7qWwfMaCGRdd3aEHX
TLSH
T138D42383CE3A20E6E7F875F6BBEE454A49F8F80242944D8A1790B9D9C7763D3D106643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 3b361fae1b435088747df66e5f4cd042e437da1175e489bd727eb4f833d7ab6a
MD5 15445e1f4e8925817785cac2ae15cd93
SHA1 4920dad5b23d3710a26ac27f081226874cee9283
SHA512 1cc2ac8f5854983550c14d2f427f3fd0ac41f06b818e93de29932fd6e64a1d84d2fe8d28aff4ac8508325f88b5d0dfb745cd759e4d7ea3d0d7ff333b7d9fed6e
SSDEEP 12288:DeBNUbTVO86Un9OpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:DJIUn9OpayI7qWwfMaCGRdd3aEHX
TLSH
T10E15CF3BEE28FCE2C2BE5DB95B918600D7B274314B6193CBD164824ECE235E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 6717e1fd19e14c35994d9c1f13a8b39002392c63a17fdf99300cb3820fbf9569
MD5 cee4e179a2703c5f21233801090dd052
SHA1 dc2a05b7b39a2d52aa2c57b65a8fa601aac06d39
SHA512 32cb1d10223a1f9f2aaace5281b6eb8e2daf460e423c20d3a2feceece7c8c6075c4710e03a146e096f193f2470ec5f1e169f4ee52c0a5986cb2e55a8eae34f86
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5JoNRV3THc:nQvGAdlCEL8c/WRNE5Ctgtsx
TLSH
T114367C656BF880F5E1A7E178897AC5B2F7B678020D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 1c6106e1f0707ad7329183f331e2789052de98b6f9339c12bb996b61d55f1bc6
MD5 adc30f5beccdd6c1cd60068236a547fc
SHA1 67aa4b448a5220edbb3aca1f11b833d7c8f65238
SHA512 61d136b34690b98623e2389d9225fce1359134979a0705b7ed468e983fc69b4482f905fd7b78c9bf657bddc9844bab7ab02d00956c24028b63943dc7ec971165
SSDEEP 12288:lLwSfxL/2Dc3bDLLmt0LDQewsAjQSOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd9:tmewsAjQSOpayI7qWwfMaCGRdd3aEHX
TLSH
T12B15E031FE75E036C7BB0DB62B66C706147CB9204B611AC3E3A88E9D59702D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f467bf7650d8de7e0fce1877097c61e9d7d1305e1ccfd77218958316a7041a87
MD5 5027810dc644299b63d55cb171252a82
SHA1 7ef59c36abf561a076b20062943fbd07b802db89
SHA512 871f80e226ff7901dc2b551bf132159e0f5b2031f5cba3061965b5546747ab565cc4d817d0d8fb9a3d8a6d258d9b9591bf2d6203686bb83dfe7d25d6d3ffbc82
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrQdPlbuJHC:BUEtQevvqc2W1cpV2Xr02C
TLSH
T1EE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ecf7d1c234d0047977f84c2d4f0138ee56487c68e2f417a0950aadc6204069f2
MD5 ee1f900f34f43e70d487cd489f02dc1c
SHA1 2269ef005b7837559d1bdb029ce4c972ac5f3741
SHA512 0a24f643485ee0479c709ef9ddcf38f0095429c849537524c95162aea2affc8fac61315691f9030ec4f506bb763cf38a7e605442d52f19cc86b5e81a852d5643
SSDEEP 49152:SpbRquA/m2yL5zMfFiV+XenmE3/z2paZtGRddKEHX:aoq1Vjnm7gtsx
TLSH
T14CD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 59a94d9e6d12155c625bfc0e77eda0ca58ebb84d0d37a1c17d9570e88933c531
MD5 53819a6ffd7977defee8e457861ee1ae
SHA1 8bbd80b6fdfacfa6ee76efaf1cb009b43faf6b9e
SHA512 b70b2bd1f350b14eb21b19678fb45b34bd0af600b827ca9aa9e615101a45abc5b640caff944a2e645afd6e4908217ffc3f4b0473b67fa415bd3d6c84fd293bf3
SSDEEP 24576:RAhGLvvFoiwtA5l7S53sfPOpayI7qWwfMaCGRdd3aEHX:RAMrFoiq5xpaZtGRddKEHX
TLSH
T140459E81EBF951D4F5F3AAB899B68171EA76BCA65E31C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 87d0e2fdb093e670533d459857ec2cf62fb641fe91a34adec147f9250141d8c8
MD5 275d2384985a3daab8775b3837d953a4
SHA1 ca15b29d960893a8f2c7de92a62472eef4c6e598
SHA512 3ba8dd8bb0bcf9e6a7843f8c4e0a07c4ea051c5fe06fab0a79556b553541ada01eb8c70c9722a88f06a1507de7c7c4f15e4534c308ae457a43aa9b2ce0c0f380
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CxjOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBG:uwuuOWgjOpayI7qWwfMaCGRdd3aEHX
TLSH
T14F05024677A51CF9EAB65179C697C136E7F2B8022621CB0F1360C65B5F33361AD2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 74a106a96239edafad44e8d2a61f8854b80e09daf76d4adb18bb99fcdf8cd2d8
MD5 e1ed9afafb5c578d8a9f06cb55c82996
SHA1 6389d5c7addd79511dc62a67d9e9ecfa02e67004
SHA512 9cf0f39b615970aaac7839b9eced8d0de05e5b366b0d5698e3e7a68b3fff749946cc40a53e1d8825b86b0e24ce0e99cc7cc5049002f1b3e857b06c532990c506
SSDEEP 12288:icC1IkPPOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:VCuiPOpayI7qWwfMaCGRdd3aEHX
TLSH
T1CFE4128727A520F6E3E562B9DFEA4609C7B1B013037147CF1260869A5F237D29D3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 13e7d09d33d0409094990a84b171480420b595fbf724bb126597653f273471df
MD5 2491d2f99d915793362147e58f1f130c
SHA1 ae6cd1faeaa27dcc904b00e4d0c1517920b9a2ba
SHA512 e9fbccab64b3a367de9b07e40bbaadf5742c28b3afdf73c3781858e211c1389dc9f1e987c4a6aad1cae3743029d44ae44411e2093b91e2c4bf0ed963e84e6595
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U1:qQRQyi36YOcP8Lvw2gAf+PN3tgtsx
TLSH
T182667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 51c4dc5387f8ededa44cb197c15d89a5fa57aa8fdfd2b899b8b3ff03ed0cb90f
MD5 f023ca65aed5b185285ee43f1bcd7d84
SHA1 5a94a92acfbd3d4f0e99dd6ef87fc75c2d4d97de
SHA512 127798a2128d667bc3478ed2d5a8a5884a9f030841bf74ff3a2d4b83502db28d0e2c741ac88586928546cb29ae46b11e136b98e2b537eb27ce4da1dc83ca2da6
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uw:qQRQyi36YOcP8Lvw2gAf+PN3ugtsx
TLSH
T1FA667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e159b183d0d74df28eaa58c52733db954966bf50aff97563b335008b686373ca
MD5 04e2c0b31327c7950ea58e150d3000d4
SHA1 2c6231c7962212216f697b318976734fe7508d63
SHA512 3162d0d307efd07611cdc7f8ffe283c0fb93966b92585f2529f8061e3c24cc677895615f24a0244a8dfb50a838fa7fedd6bdfc9640d5eb29ae50af7f3012559c
SSDEEP 49152:E68Qg55nhMeWu7PNU3/SpaZtGRddKEHX:uthbRc/Sgtsx
TLSH
T115B55A33B2F600A9C44DE1769F4A872196E17C718FE0E7DB855172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 01a4f707d69882b22c5840d97d2f6ba48f2d9ff2feef12e764a3d1717f155a92
MD5 cf7b024fdbfd4cd962ebd35101e1a12f
SHA1 de5551d3f45e57e05bc9fc24f1af9ff61b5e9ceb
SHA512 5fcd3f898c5c92891bcf493932f3ecd36ad489a350010ef653aeb9971e495208163f5cce98eabb01d6699c2836aa753719c4a20c1c35c116d05f40878d90af19
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99p:ny5112gYy5azzVv569nLKnhZqgtsx
TLSH
T13C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bfb62dc4d5b277f9d9bc483f5e9ffdcce87b88d91938f4425aacccf02a0a8942
MD5 dcc5a8904979e65fb1079c938f8a3cb6
SHA1 65885a7a1849a82a6806cb07f0cb55404417f63b
SHA512 bd96519d6dd6ab03fb05c84e18429b42c6c5b81d441d57a616ef9b3ca7578edc0f2bf54c2919208d2d1960e592334d76442c875f072e0c713366417c8916b401
SSDEEP 49152:eB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glBpaZtGRddKEHX:Mu6JmTxd2dBgtsx
TLSH
T1DBD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d6528d6670464814fa27856e753b8ac9b21a58f38e57bcedc9571bab1834c6d6
MD5 c4b4d9184ff6f4cf20266da199949083
SHA1 b35657a0c30db78e3dcbfecf3dcfe0df81394f8a
SHA512 7dc96f1d273b9fdf0a289e84cb8af8a67976ec99483193f2e3b2e81edac14ae7d011fc4888faa845aceaccdb3539e43274e1fb83cd44832a638a69086b6af277
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xgpaZtGRddKEHX:SmifPbRvgtsx
TLSH
T1FDB5BE13F29900E8D06DD178875A9232EA72BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6c3f77fe4c6209a7928a7cc4093fbd2c49b9c8483d74db492d8213e770c1f199
MD5 20ce499044d60c9c081c8d88cc8f07c0
SHA1 a1962da61c1d71d093630c51342d84831336f368
SHA512 849c66062b9839e81f376971fc959208d279d927ffc09023e08206091ca1bd567ac8d401623c8f6854c0be2840cc839c1c3083a50766171c9c72912b56b1856b
SSDEEP 49152:QSuZQIY0Be2K6RVtOnks6NMHq3paZtGRddKEHX:K5dKoi613gtsx
TLSH
T16BC5BF03F2E940E8E0BEE67487669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c75d751a8ad613055cd21425afcddc878fdefcd8fcd361ebfd921ed0ee37bfae
MD5 fbbe6177d3163c96188df36bd61b30ff
SHA1 4734bb204ff258492883967ea1ab09f4c9cb8f15
SHA512 8720c53d6a6eb878a0c5514b09a4851e31183e90646338bf257394bdf306af6f171370879a823024ac8c4e1765da8b6894c259707d70bac3e37870db9e4d1e5f
SSDEEP 49152:4htSn8EApI0figTgiDn0AP5w3paZtGRddKEHX:pX2iyphQgtsx
TLSH
T169A5BE13F2D900E8D06DD1B8C7568632E962BC160B35AADF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 24f30ca06a5a5f739de38b4cfda2fe5048e804016d142853945e1ac33143b2a1
MD5 ad45d9aaafddc479d4061dd265621256
SHA1 ae09817f1ee4174a5f224ab306f2a30a38358c16
SHA512 c75c50bf2320a0b75b4426b54185b128b4f08199cc198b6fb08a17a9bd23824b9ca1663f4acac3e7cf4dad41e1d4acfb7ed43a54e7592e46544038a210c88489
SSDEEP 12288:FtOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:FtOpayI7qWwfMaCGRdd3aEHX
TLSH
T197D42383CD7B21E6E7E871F6EFEE428A48FCB0034291498B379595D5DBA23D39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 214618b7037c4ab1b4136b7faeff4616ba1b4309cb01fc092c61714961335885
MD5 06c1ab245749dc98ed362cb8417fe514
SHA1 43528920e163f0661087190a62bacf414d537d46
SHA512 46bf79c3a6ea428dfca34aef936f97398a1935e6ab07ae9d245085f27d49d7f5e0b3e2bd1cda1dbba3e70f584cf4190ab478b55396adc857e4804cb29151c5a4
SSDEEP 12288:bVOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:bVOpayI7qWwfMaCGRdd3aEHX
TLSH
T188D42383CD3B11E6E7E871F6FFEE428989FCF0034295498A379495D597A23D39106A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 2cb8c4a6ee7955e7419547057e6252c46b915fd29e9f2626cae57b513fc57097
MD5 62aa7aad071025a0196e240a5ec06a53
SHA1 dd23ede98076017373a2ff8c0f763c21a1fc0032
SHA512 efd646ee9a5437fa4a178ad9b780acf0d7121a6c6f70c3ee687dbc2a97dc9d79a623b18d083e9e1b0aab0bfabc6aa31bbdda9739ed4a6a12c3db8f227c3668a1
SSDEEP 12288:Z1OpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:Z1OpayI7qWwfMaCGRdd3aEHX
TLSH
T123D42383CD3B20E6E7E871F6FBEF428988F8F0034295498A779595D5DBA23D39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 1bbcc650b01c8f2809187ef7b5187168d756f0793d850e65af66a147cb674a6f
MD5 5e64257ce527688fbc9315b98058a340
SHA1 d141cd62666b5b1bd9c42c246027732d9fa1fb8c
SHA512 1c94b6037d83bb6803c7ca0cff2b64368c97261b581130fb227efa40c6a411c6b78e45a3f157ea7632f4430d291e54a5a5cfa4a10251f933f808045e3c8c22d1
SSDEEP 12288:HlNOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:vOpayI7qWwfMaCGRdd3aEHX
TLSH
T1CBD423439E7B10E2E7F8B2FAEFEE4149C5F8F44342614A8F2750598A4FB23929515B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 f97e419382131d8fdd8c69ba8d9e8eaee7e02d452ef923680ab791bbcfa0f937
MD5 26607f3d5fc232dfa03f93c6aa4c2218
SHA1 f23ef2f23406a3d9c14b085d516a42c77db9316e
SHA512 784adaa2a7c2cefabd7885bc14e8f0245382088e89a9da859818f41755828204e3269567132592d3b468af4fc1a984b382a94644de237f66007ccab232dc6270
SSDEEP 12288:4vOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:4vOpayI7qWwfMaCGRdd3aEHX
TLSH
T108D42383CD7B21E6E7E876F6FFEE428949F8F0034291498E279495D5CBA23D39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 b0410d6785a54c05c1f5758f1951725f6f51f7c0d4976d823e3a1b7f7b00e314
MD5 ea836c98f01364df563d2fa970578575
SHA1 bb5fc11506894ed3b4f46565ee043f1af3f84b53
SHA512 905b44364ec203a72a5996c1dc006febda231550d9994483d8bf1e5397acd8c2835c19d163244367ab8611d133a75fcc4017476f38adc1be38bcd861dcee54ec
SSDEEP 12288:raOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:raOpayI7qWwfMaCGRdd3aEHX
TLSH
T1C1D42383CD3B11E6E7E872F6EFEE418A89FCF0034291498E279595D5D7623E39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 591aa2f95b2bedfd616fb934f41a2fbb9646ea8c5121d3d6e00d5053667dbc7e
MD5 5a8cf2c1880ae2fd2fbf947365a6f75d
SHA1 e8d0c558d68ddaae0912e09eab0e795bc6ac9d63
SHA512 d9521843f7cf17ffe9599f8a18b50454fb4ba6178974bdee9df643ea2d8de8870ce3b61cfef011774c91d62564d55dbab45873765a8327cfc9c543f027c8bbc6
SSDEEP 12288:yUOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:yUOpayI7qWwfMaCGRdd3aEHX
TLSH
T1F8D42383CD3B11E6E7E871F6FFEE428948FCB0034295498B379595D6D7A23A39106A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 335fa3143b5fda1cda8174ac6b081234c2cbf62512d0a773f58b23731022cefe
MD5 2106b2b393eb390c487c46ab16652a14
SHA1 8eecea1cdc9850ca2b61605b962c279f3d28d56f
SHA512 e2be7bc14f620e2c4cb2a52de9f9e5553c8d34d5d85856fe5b443f2175e58d5aa654881f50974dab8b5c8ccf2e270c9ebf8085bb24b8b5ae7c2062474110154b
SSDEEP 24576:RZMszBBSBdOpayI7qWwfMaCGRdd3aEHX:RZMszHzpaZtGRddKEHX
TLSH
T178150195B76018F4EDA6817ECE658906C6F2BC1606B0CA0F13E436675F333A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 48d3aab734e687a17213cb73bd1c01a1b862e17e66ab0343cbf7d1b9982cbc1b
MD5 5b641b18086e8837b627d40f5298cae8
SHA1 1534721da43a780f77f0ef717f7259a8d527341b
SHA512 87dd7924832c2aa9a77c78ee830e37eed855e15ad629d98b1da8d0bcd839534b83880dcaccb9fa638d146a46937a57e002f98e11bf4f3d7358338bb2cd8431f8
SSDEEP 12288:LoOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:LoOpayI7qWwfMaCGRdd3aEHX
TLSH
T1FBD42383CD3B21E6E7E871FAFFEE428988FCF0034291598A279595D5C7A23939106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 821bf3024cc08869578ac48f360da79369c51c9ce9a49ac306622dc3a221ae9f
MD5 9bef2541bf18032b8c66c7cd0de9cb26
SHA1 428ac9c178138d62812b1f06d8cdbba41f2ba995
SHA512 5dd69a54b628390319ce4b30108ab5c109609eb7887630702c1b19df6c23e4f9c223256098a6ca64540e130f00c8088d32273df927c9aba2fdcc7d1aa69728a8
SSDEEP 12288:XHpUMeVV2H2WVK1Flzk5zrUv37HYVXt6cuhryyf8JgCqPqHS8ytjhEAWCb06mngi:XuMgKK1jczrUv3749Bm2yf8IP8ytjq4S
TLSH
T161D4234655BE35C8E2E949FED6CF5607CE6C6885B959661FD33402363B00722FA83837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 13852320d7147c9450dc574f8ff6d944f1d21708384673b407e804867891509d
MD5 674c8dd2a0186f91f2ee6019ed447483
SHA1 e88c328ea50352a7167f3f2269b413b49f944244
SHA512 c537892eb5c7a1d4980cd84160300798ad53a7d6e2f56e51b49a30f1d11d14ccd71293c8ae5d96be0f3e0e1cae1f777b6d22bcf6a12ff5c6a26462cc1249e2cb
SSDEEP 12288:1eP+mLiaUMeVV2H2WVK1Flzk5zrUv37HYVXt6cuhryyf8JgCqPqHS8ytjhEAWCbe:Y+9BMgKK1jczrUv3749Bm2yf8IP8ytjq
TLSH
T1F1F4120773B530F8D17A8279C9971A02EB75B8755B249A2F537003762F23761AE2BB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 37ce62a9611c3b65eb135b4a75d72df9231c4c4b95a87df9f9decdc430649b57
MD5 d126f372d408c6ce9a73390badef28db
SHA1 86d13010a31b3ede2a525a3bc56aec97ef3f4331
SHA512 86738eb46e069a84f5271d35821649f238ca5643c48f252dc3b6adfda4a9c38dc6043f15d6b72f782a7975b4103e957b8e633719d42513022616ff8ecc819fdf
SSDEEP 12288:10UMeVV2H2WVK1Flzk5zrUv37HYVXt6cuhryyf8JgCqPqHS8ytjhEAWCb06mng1k:1rMgKK1jczrUv3749Bm2yf8IP8ytjq4S
TLSH
T16FD4234655BE35C9E2A90AFED6CF1607CEAC5885B959661BD33402363B00732FB53837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 68a69cdc00a5030bcb1de5d3bdfd3f5c3ec4f21d44d1eb1354db92ff6e8bdee1
MD5 1bd6db87b26dc842ca91d1ea4c5e65d3
SHA1 e2714d7ebdf076a315dbba1ae54ae55adb7aafdc
SHA512 f4e7fbb30ca3c21b018b21b5cf0816a23cbb3dd66c46b5944b236bb1a589d4ad91eb7ab55086ad39c54b53827bddcc139f0ae757937602b2d900e7a50f65dfc8
SSDEEP 12288:9cUMeVV2H2WVK1Flzk5zrUv37HYVXt6cuhryyf8JgCqPqHS8ytjhEAWCb06mng1k:9jMgKK1jczrUv3749Bm2yf8IP8ytjq4S
TLSH
T1DCD4234655BE35C8E2A949FED6CF1707CEAC5889B659A61BD33402363B00722FB53837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 e3f7748785a2c452ed36178a2fa617b9cfc030887a01b6998d4f42b5ac5ef187
MD5 175aaa5a55dd051031210d28a8d3360a
SHA1 aca73cee3b82eba54ed5506576434f63459e5184
SHA512 317144f3ee341006c1c1fe9c1440c99745e9ca4d7181f23eeae68de6feb1a3f2c3702ef446459d4b1e59ff18706e72ddc41dade6e7d68190d099427e863e5e33
SSDEEP 12288:QeP+mLiEUMeVV2H2WVK1Flzk5zrUv37HYVXt6cuhryyf8JgCqPqHS8ytjhEAWCbe:x+97MgKK1jczrUv3749Bm2yf8IP8ytjq
TLSH
T15EF4120773B530F8D17A8279C9971A02EB75B87657249A2F536003762F23761AE2BB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 43ff205558638e3850da1c15a8e50d402f554bc5c184e03d23c5e83d114b4ff4
MD5 9814ff238fea395cab7ebf89e07b6644
SHA1 bad830333319750364970860259b7376c88eb3eb
SHA512 740cd354102927308192680d1a5672b0159d959bba8d47f9cd21de14eaf00998cec8dc50fd57c75eb5439ad3732aa5bffd975fc7ab87f14b656fcbf188270d3f
SSDEEP 24576:sTeaLL3z0ztfMgKK1jczrUv3749Bm2yf8IP8ytjq4b0Ppmro:sTtLLj2MgKK+zov+yEIP8v4b0/
TLSH
T1C9150295B3A018F8ECA7857ECD568906C6B27C5A0B70C61F03B432676F333615D2EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 6a75c6d41482e30da0a1fa15e4ac89077787b0c7afa048b286f1f03dac8127e5
MD5 97dc3b795ff079483a9a49860e45c5cd
SHA1 35d6e50f77224199fb41f5ea96d8055ed996c914
SHA512 51042030773f869b35ad2495de6f51d2ad8e1816889c8761d53d13ab5ac74fafa87fe2a9617b9a95aee718ca67cc25efd96b1a526440053073f68d45b97a9a43
SSDEEP 24576:s37dbCHry7/rNMgKK1jczrUv3749Bm2yf8IP8ytjq4b0Ppmro:W7dbCHryzBMgKK+zov+yEIP8v4b0/
TLSH
T19C35CF90F3E414E8F1B79A35C9664502CAB67C995B31DE8F03A4262A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 dd70fe0cc97d200eb4d5292617bf8ab99eeb560f0f7d7d6e7b9c459bc2145a4b
MD5 c0f74bb229c5f1c1a9064ec2d36fdecb
SHA1 214773f0d761b4f13d4d49d23f3d773b0b0e5fee
SHA512 afac21fe05d444cd7d1ca620e29699ec3b16a3cb183247f626413e2f8f6c04d7952631d29e44077ceef4565ef88960e621a9984519a3a743a469fa6dd00b6e9a
SSDEEP 12288:JNUMeVV2H2WVK1Flzk5zrUv37HYVXt6cuhryyf8JgCqPqHS8ytjhEAWCb06mng1k:JqMgKK1jczrUv3749Bm2yf8IP8ytjq4S
TLSH
T14CD4234555BE35C9E2A94EFED6CF1607CEAC5885B959A51BD33002323B40732FA93837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 a6dbb7025091942401e3dd1d7a32c47ca893a892ef827cbb2a4c9fe6a30d2939
MD5 41c92a25dcf83f60101323b0d4065f05
SHA1 6e7a1fa6c5ce5f75005dd70b7075543beb5ef76d
SHA512 ac3ef032edb03ecdb68c2a1ce417d0310212f6c94e2bb1f5da25b7389307d1e712d82ce978e81a9059246b4ba2db325c7f721a10d1974664182e3397d1daaf19
SSDEEP 12288:4OUMeVV2H2WVK1Flzk5zrUv37HYVXt6cuhryyf8JgCqPqHS8ytjhEAWCb06mng1k:49MgKK1jczrUv3749Bm2yf8IP8ytjq4S
TLSH
T1C6D4234555BA35C9E2AD4AFED6CF4603CFAC2C84B659661BD33002323B44766FA93837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 6f9564ede259d81bf99bb58760a5ab6819019005a3aa793592e038dc33660126
MD5 b98b7bef0fa1917cecf4452859491385
SHA1 fe8f364b3e5e120de628df31c291a6c460f45741
SHA512 b03204edb331a2ee877fec12df62939ca0306d675a7f528cd664bc35efe834c9713fb82b38c36b56ba6b6ac090fb479d41253626002b7c1f71f1d04386284502
SSDEEP 12288:cGUMeVV2H2WVK1Flzk5zrUv37HYVXt6cuhryyf8JgCqPqHS8ytjhEAWCb06mng1k:clMgKK1jczrUv3749Bm2yf8IP8ytjq4S
TLSH
T123D4234255BE35C8E2E949BED6CF1707CEAC2C85B559A61BD33402363B00726FA93837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 84ee7118cd1599f4169940ae39eecce7228676756b4ebcab15c10010b7a93693
MD5 ad4dc9fe59e4e51c697a6bfe537759bd
SHA1 beec58f981b099154822ca50759990bf723e9df2
SHA512 a8a54fd79b76bf4e44d8dd65b5d17f30f3400787890dae9fa69622647540b83fd67b95775778f819948fc462d9f51254608a58dd62218897290d3ad5f997754d
SSDEEP 12288:b4UMeVV2H2WVK1Flzk5zrUv37HYVXt6cuhryyf8JgCqPqHS8ytjhEAWCb06mng1k:bHMgKK1jczrUv3749Bm2yf8IP8ytjq4S
TLSH
T1C8D4234255BE35C8E2E94DFED6CF1607CEAC6889B959661BD33402363B00726FA53837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 ea551754ec8d8d0ba995da696aa639c45318d3b8c5b2a93122a320484ad03b5a
MD5 e7c8039cf6dd7f1aaab788784df9d138
SHA1 0119768c4207d6f1bfa403de7ddeab54d4fef0d0
SHA512 d7385d441bca5a39de279821f284b32724ccd719531d82461f92264fcc7423e8a9dd93a3ff6c6b808a0a0dbc286cc2927f96799387585fd5167eabf462e15ad2
SSDEEP 12288:lzsfnPOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:8nPOpayI7qWwfMaCGRdd3aEHX
TLSH
T114F4014AC66811E9C2AD61B9CB9A4641B3777C2283E1D3CB13D0F57E0F762919DDAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 8f7ff03279bc54784a9a8a99587d2200912eae3b8b5cfecd1b180392af8de55c
MD5 29cbb047f329a8e4c0debc286bebf193
SHA1 d5eee8fb26921682e36518f422b101381ae8fdf6
SHA512 a586d2a4774ad7f85b4df5b9d8d9124577fc552a846bc6a930ee33f5b8ee7c3b48d6dca00c7c6d4312f815134fb870295294c33ceb0aa3e9f9874964eb24b83e
SSDEEP 12288:RC7sOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:ksOpayI7qWwfMaCGRdd3aEHX
TLSH
T1F2D42353CF3A20E6F7F872F5ABEE811949BDF012435089CB764496C99B723D2D916A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f905ab59e2ef43dd0cb947fd92dfa15670f8b7dad3927c79dcb3187dac6d9cc7
MD5 537cea656361d8ce290cc0eb55201bee
SHA1 8092a0fff56f7d9874a334996f6390eed348a4cc
SHA512 4096f5cf9df499c663d5bedc4b12cc31a56acf19b7e9dcdd59d110b1766b27c74379487bfe3c0659319a4ed7bff601732a715e2573391630f5c3d0dbe912d655
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bY8OpayI7qWwfMaCGRdd3aEHX:Ygb4mBIBhGF6paZtGRddKEHX
TLSH
T1B265AF1E22EC02F5E1F9E2B8DDAA4417D6B278160331D6CF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 ffa6b267c58793a8b4a8dba42a508676fadc44ac6da85fb13973bb051377d561
MD5 4665fa202b6cca385bcbeee0efb8c5e4
SHA1 bf0d2b53dd0f42b1fd800d7a4684b5a9ac3b7bd7
SHA512 1695c2b2774f8f199274de8ed98237ec4802dc7ef2a31e08e2be0a9264d75a5b50a323d4ac2ed0e831cf169789ebc952f457d9e6d5ecb96a2dc36d80d1a178c6
SSDEEP 12288:fKG7OpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:SG7OpayI7qWwfMaCGRdd3aEHX
TLSH
T138E4235B99B730E4D7FCA2BAABFA415768F47011431019DF06D0D5B5CF623E1A23AD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 3fa7bd41eaf328b3acc229c21fce08c5dd384c644bbfe6c5c28a2729fd68825b
MD5 c63a651df77e72e6dc28fe1fe299526f
SHA1 50513d4ab2a5cc76f924497f19c89c78fd8a40fe
SHA512 cfaedce4f992af669bb25d86ccbb9e1c27288ade6865eedaf3131a54d7be887c21dd24791f05cc404bd31d20c5e21001b8c0a0df28331a7fbb8043141c32eb6d
SSDEEP 12288:MgOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:MgOpayI7qWwfMaCGRdd3aEHX
TLSH
T1E2D423838E3B20E6E7F876F6ABEF454549F8F003439149CB2294A5D587A73D39136943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 dfc490b8de3b958b3ae170fbeb391301cef1d5104d919b4c799c5f990fa210e7
MD5 cd7a0c182860b3f448ef48f77cadd48e
SHA1 cc514d729ca253301a767025c24dcb57584a2e23
SHA512 7726115f39782fb94598dac68e5292c5f93b71b5ca975553317b325488891007524beb7c51bdfac7349e75be3bc8e94148df4c1396a6d2324959328b1f5dbfaa
SSDEEP 24576:9wp8x8FpJqH1Mzria7/m+OpayI7qWwfMaCGRdd3aEHX:aO6FPqVra7/gpaZtGRddKEHX
TLSH
T1FA35F166A7E101F1D5BBE1388A864663F6B1B4110364EFDF07A88B951F237E14B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 f46acefd87f39361cef3c4a3286209b277b28a66a98b8b607178aac8acab09fa
MD5 5b989d81f83beb8af104e24ae13935b0
SHA1 e08feba6a4767a816cc6964fed8aee85da52e5a3
SHA512 4ec2d8f929902c2f9bbed82c65c2f338b10f286e052b169703c4ffd48e19ae393f214e63f403b95c6421fc9d7a93a63be036ac110600cd924189829ae9cd3e66
SSDEEP 12288:DHvUrBFrEjwaQaOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:DPUr+NQaOpayI7qWwfMaCGRdd3aEHX
TLSH
T14005F11F66AD18E5E7B9F17D8A868709E771B4520311D6CF02E0817E4F63AE4BC3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 58ed17882fbf6f3338600458eeed0f3bd00e5d5171342aa18c51fadf182d4b61
MD5 5e51b77c91b78e8aeeb00dba2687d2a6
SHA1 858a0164002284b51b6c9ea27d5f8a5c34b3fb85
SHA512 eba60ee5d455ef1535a473fa7508481f7ad7045120b14d3c7d8e3b4600ca805623b54713b4f82c97f964a9cd40e266a88f04817d3f0b8bb2c0ea085d9ebd3026
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtpaZtGRddKEHX:WG05lO43bqgtsx
TLSH
T192D5CF6A62EC11F9D1BBD17CDAC6460BEBB23415033556CF02A486A91F23FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 d6685a626da3468fb279f436c887ad55ce3888c914c69fe166ac01bdf37b5842
MD5 10fced6bbfe51b3cf5531601e99b8b05
SHA1 34aa842df39427546db0a028ca2dae4ebc047cd5
SHA512 63d0cdf50e5778235cd7047b9a18d298a20380415c6547aeb83cec4a1530d2bcf047f932a8d578ce8be1c3ca826a6a9d9490cd3695de2d1124106fe0192147a8
SSDEEP 24576:zda5POZ3dpbWVM50JicR2hG0lasx2+47eidnaMgKK1jczrUv3749Bm2yf8IP8ytW:Ra5POZ3wJt2pasx2+mMMgKK+zov+yEIe
TLSH
T14065BF5EA6FC01D5E5B9D17DC583460AE5B1342553329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b4bbfc430841ab03362ef02ebe416f8ceb46ba27060b27d83fd3d2790c0d3e0c
MD5 a21e799661347bdd2372d45ca471802b
SHA1 23baccc9474a8fc8faba1e59278fbf9651e6f194
SHA512 b3d3037dd9c7fe92f0a715829e7a486a8303cf57749afc706c3a06113a859847795b8474ff0183f7df807f536078e278313f500ad19a5b57d67dcd10bb5765a6
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkoROpayI7qWwfMaCGRdd3aEHX:PNc/zEOVHFOpaZtGRddKEHX
TLSH
T121858C1623E901E4F5BBE1BE89779546FAB1786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 792c00fdda2549208a94bd522549a352da8e41d76ba7e42bd4a33cdaafd46baa
MD5 2a2dd761675bda5c4ca4418045a7308e
SHA1 6610e092f559456d93ad19d45972e9d431b4882b
SHA512 8c4e5ad79a102580d210a8416a8cea0bd0d1e2b86351fb8985ee43d37b7b45539bc7d58dee7043ca7ce78be5c4ad94143188dfa707127c2451d31eb1feed421a
SSDEEP 24576:IJnJPbzB4S5OpayI7qWwfMaCGRdd3aEHX:IJnJv6S8paZtGRddKEHX
TLSH
T12B15E03DD2A810E8E4F6D2B4825A175AFF71346D2B2169CB19B4D4343F12FE0A939F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 abf9a05495b37098644a0c18c178cf3efcd41684bc5423d874b4abbb8ed56e02
MD5 497c2b39598006d6d5a57f9249f81fe2
SHA1 0cc5d0b60a1fd9e041c5657fb010f213c535e657
SHA512 bc677762c3c76c18c8eb64e3874fad0567fd56b5e40e43f6c389e79b1c7d658b6e7e8b474a1424f6b65cd53d64bf1f176d19ac74b73fdadb2ad6133b74a0f72b
SSDEEP 49152:3CLHGeeV5ijCmlDWDksdMgKK+zov+yEIP8v4b0/:ydJK+zkIwg
TLSH
T1FFA56B05A7EB5184E8F3CAF5CA2694168E327C549B34F7DF4A80C96A2E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 4f0368a521355b9d151369ff38d13c4257522b5f2340de08710daa527dc88a4c
MD5 44030f9a9e695932ed725c124636c5e8
SHA1 6d2648e88bcd940c61ee8e3009adbf436cdb75b9
SHA512 29a45d5f0743dc3644490c6bc396aa3cd3e47975a96ff3ec55b3efa205b1b13908ff9d8de89c472d1ba7d83177850ebbbadbc225b949c0a78dc0b0bf10f93563
SSDEEP 12288:v1Hck6j5ZI7zOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:r6DIfOpayI7qWwfMaCGRdd3aEHX
TLSH
T1E005015D677A10F5D2BAE07ED6D30102C2B2B061836259CF07D4C5BA8FA3ED9B539E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 6b535e9d7a32300c126d2b18617aa042ba33bd617a28c0cb6d8eb7e9fe2578e7
MD5 5cd34208c3c9762b290e82bf5075c291
SHA1 e73b7962a17298fc399b95f657aca790b589bc91
SHA512 003da1c4c9af488c594806cb711a4c935af2ffdbac555937573d5c7d76e81ff5b0bfcf6b6abcd5c6215485afb87444749f6c2e483817d6cc4666de5e7cea937d
SSDEEP 12288:2G6kypuOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:ftypuOpayI7qWwfMaCGRdd3aEHX
TLSH
T1DAF41242976920E5E7F822B9EFF782958E74BC11476146CF22D0E67E5F323D1A931B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 1e419f23dd6c7a8ea7700a19b4e3f68c6b0a6b007e8c1e153afb5642687247dc
MD5 670446ed79f14fdee9194179fa0fd62a
SHA1 141e3d3ecfd9d1bf354f6a59d5e9233f9e666425
SHA512 1dc8fe4223c847fe76902fa7daa26abb4ad2426ad0e75d7e740c7fb68827db69fd5a56c4e87e798e0e88758086ed18689daf6b9f3bb1be4112a4d18a440f519d
SSDEEP 12288:IjZIOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:MCOpayI7qWwfMaCGRdd3aEHX
TLSH
T133D423978A3730E6E7E876FAABEE424645F8B012035159CF26D0D5F5CB663D29132E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 aa82c2c6cf4beb6377e610ea5b1d13bae11872ed1f05579d07c016fc9441a756
MD5 251c5fff0264d3629505176438014ffc
SHA1 c803ce019ccfb462dc5171e20f1ad2167e6235e2
SHA512 046199c3fffe26c38f3eede97ff4bd43b9cfda7ef383cab1946897bbce7805538eaa362769109461eef03ecd96b22c8968191be2aa2ee472f2dce3d5ada0454a
SSDEEP 24576:LEgBLoTfaidZ3OpayI7qWwfMaCGRdd3aEHX:ggGTrZepaZtGRddKEHX
TLSH
T151559C1DA7EA05DAE2B2D279D9721493D633B4315372C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 5694696ccdf3df0d6c5aa5e55cec06770fb0ad6c4b10bfeb7fdc1e2515a69a80
MD5 66d42f0d85778622e5e46444f0727590
SHA1 5638023f85dd6ed55d17efe72a927c083f76bb46
SHA512 253bbb48a513d48273d3d872ff57fbb846bd381a4dda5d040f75b44c8d8410fd23ec60cec7defff560c57290ed0ce714dd9fba0cfb9e920693a23dd772207a60
SSDEEP 24576:orcmRtMgKK1jczrUv3749Bm2yf8IP8ytjq4b0Ppmro:KcmRtMgKK+zov+yEIP8v4b0/
TLSH
T14405F14EB2BE00E5E1B7817CC9864606EAB37070671167DF42A0837E5F17AE9BD35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e2a1ff4f1904e13c163ec80ee8d9091282234aff36747522d5eacbea55767d3c
MD5 ed8a46f420134554abe37db6dfe77f6a
SHA1 a5d87ee0aaeaa7e8b318fa480d7bace26de75391
SHA512 f675f26d15f696c4d15180ccb62882cc27bd911d0acdf53bb7bb48b66754cf06d8ed475c6ab63661081a14e49eb46e1d0240cb69c5ed1ea2fe4823af8b3aa1e4
SSDEEP 49152:ZDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3MMgKK+zov+yEIP8v4b0/:K3Upow8sB0JK+zkIwg
TLSH
T10CA58C3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB0174C178BF1BEF19A39F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-45-0x000002780AA40000-0x000002780AAA6000-memory.dmp

Download

memory/240-44-0x000002780AA40000-0x000002780AAA6000-memory.dmp

Download

memory/240-43-0x00007FF6B3420000-0x00007FF6B3588000-memory.dmp

Download

memory/240-50-0x000002780AA40000-0x000002780AAA6000-memory.dmp

Download

memory/240-52-0x00007FF6B3420000-0x00007FF6B3588000-memory.dmp

Download

memory/1116-378-0x00007FF7B97F0000-0x00007FF7B98A4000-memory.dmp

Download

memory/1116-310-0x00000220A5150000-0x00000220A51B6000-memory.dmp

Download

memory/1116-311-0x00000220A5150000-0x00000220A51B6000-memory.dmp

Download

memory/1116-309-0x00007FF7B97F0000-0x00007FF7B98A4000-memory.dmp

Download

memory/1292-232-0x00007FF6A1250000-0x00007FF6A1319000-memory.dmp

Download

memory/1292-317-0x00007FF6A1250000-0x00007FF6A1319000-memory.dmp

Download

memory/1292-234-0x00000184C4030000-0x00000184C4096000-memory.dmp

Download

memory/1292-233-0x00000184C4030000-0x00000184C4096000-memory.dmp

Download

memory/1492-350-0x0000018CA2810000-0x0000018CA2876000-memory.dmp

Download

memory/1492-349-0x00007FF6992A0000-0x00007FF69952B000-memory.dmp

Download

memory/1492-444-0x00007FF6992A0000-0x00007FF69952B000-memory.dmp

Download

memory/1492-351-0x0000018CA2810000-0x0000018CA2876000-memory.dmp

Download

memory/1564-360-0x000001595B1B0000-0x000001595B216000-memory.dmp

Download

memory/1564-359-0x00007FF6C5D80000-0x00007FF6C6251000-memory.dmp

Download

memory/1564-358-0x000001595B1B0000-0x000001595B216000-memory.dmp

Download

memory/1564-445-0x00007FF6C5D80000-0x00007FF6C6251000-memory.dmp

Download

memory/1952-367-0x0000022220570000-0x00000222205D6000-memory.dmp

Download

memory/1952-368-0x00007FF7EC490000-0x00007FF7EC997000-memory.dmp

Download

memory/1952-369-0x0000022220570000-0x00000222205D6000-memory.dmp

Download

memory/1988-329-0x000002491C450000-0x000002491C4B6000-memory.dmp

Download

memory/1988-330-0x000002491C450000-0x000002491C4B6000-memory.dmp

Download

memory/1988-440-0x00007FF6E8BE0000-0x00007FF6E8D75000-memory.dmp

Download

memory/1988-328-0x00007FF6E8BE0000-0x00007FF6E8D75000-memory.dmp

Download

memory/4236-13-0x000001B363A70000-0x000001B363AD6000-memory.dmp

Download

memory/4236-11-0x00007FF7E6840000-0x00007FF7E6963000-memory.dmp

Download

memory/4236-61-0x00007FF7E6840000-0x00007FF7E6963000-memory.dmp

Download

memory/4236-15-0x000001B363A70000-0x000001B363AD6000-memory.dmp

Download

memory/4236-12-0x000001B363A70000-0x000001B363AD6000-memory.dmp

Download

memory/4256-37-0x000001D6DF3F0000-0x000001D6DF456000-memory.dmp

Download

memory/4256-35-0x000001D6DF3F0000-0x000001D6DF456000-memory.dmp

Download

memory/4256-36-0x000001D6DF3F0000-0x000001D6DF456000-memory.dmp

Download

memory/4256-34-0x000001D6DF1C0000-0x000001D6DF2CD000-memory.dmp

Download

memory/4264-443-0x00007FF628390000-0x00007FF6287A7000-memory.dmp

Download

memory/4264-299-0x00007FF628390000-0x00007FF6287A7000-memory.dmp

Download

memory/4264-374-0x00007FF628390000-0x00007FF6287A7000-memory.dmp

Download

memory/4264-300-0x00000240999B0000-0x0000024099A16000-memory.dmp

Download

memory/4264-301-0x00000240999B0000-0x0000024099A16000-memory.dmp

Download

memory/4264-441-0x00000240999B0000-0x0000024099A16000-memory.dmp

Download

memory/4340-292-0x0000012375BF0000-0x0000012375C56000-memory.dmp

Download

memory/4340-373-0x00007FF777D60000-0x00007FF777E0E000-memory.dmp

Download

memory/4340-290-0x00007FF777D60000-0x00007FF777E0E000-memory.dmp

Download

memory/4340-291-0x0000012375BF0000-0x0000012375C56000-memory.dmp

Download

memory/4388-366-0x00007FF62AAA0000-0x00007FF62B1E4000-memory.dmp

Download

memory/4388-282-0x00007FF62AAA0000-0x00007FF62B1E4000-memory.dmp

Download

memory/4388-283-0x0000022C0EB30000-0x0000022C0EB96000-memory.dmp

Download

memory/4388-284-0x0000022C0EB30000-0x0000022C0EB96000-memory.dmp

Download

memory/4440-339-0x000001DF0CBD0000-0x000001DF0CC36000-memory.dmp

Download

memory/4440-337-0x00007FF78FDD0000-0x00007FF7900F1000-memory.dmp

Download

memory/4440-343-0x000001DF0CBD0000-0x000001DF0CC36000-memory.dmp

Download

memory/4440-345-0x00007FF78FDD0000-0x00007FF7900F1000-memory.dmp

Download

memory/4440-338-0x000001DF0CBD0000-0x000001DF0CC36000-memory.dmp

Download

memory/4664-241-0x00007FF6A1250000-0x00007FF6A1319000-memory.dmp

Download

memory/4664-327-0x00007FF6A1250000-0x00007FF6A1319000-memory.dmp

Download

memory/4664-242-0x00000238A2ED0000-0x00000238A2F36000-memory.dmp

Download

memory/4664-243-0x00000238A2ED0000-0x00000238A2F36000-memory.dmp

Download

memory/4676-320-0x00000259B8210000-0x00000259B8276000-memory.dmp

Download

memory/4676-321-0x00000259B8210000-0x00000259B8276000-memory.dmp

Download

memory/4676-388-0x00007FF6FDAD0000-0x00007FF6FDD73000-memory.dmp

Download

memory/4676-318-0x00007FF6FDAD0000-0x00007FF6FDD73000-memory.dmp

Download

memory/5076-22-0x00007FF6E2A80000-0x00007FF6E2C83000-memory.dmp

Download

memory/5076-0-0x00000135A0190000-0x00000135A01F6000-memory.dmp

Download

memory/5076-3-0x00000135A0190000-0x00000135A01F6000-memory.dmp

Download

memory/5076-19-0x00000135A0190000-0x00000135A01F6000-memory.dmp

Download

memory/5076-2-0x00007FF6E2A80000-0x00007FF6E2C83000-memory.dmp

Download

memory/5276-390-0x00007FF623820000-0x00007FF623B5F000-memory.dmp

Download

memory/5276-391-0x0000013782540000-0x00000137825A6000-memory.dmp

Download

memory/5276-389-0x0000013782540000-0x00000137825A6000-memory.dmp

Download

memory/5340-336-0x00007FF6ACA60000-0x00007FF6ACB7A000-memory.dmp

Download

memory/5340-250-0x000001C0E6060000-0x000001C0E60C6000-memory.dmp

Download

memory/5340-249-0x00007FF6ACA60000-0x00007FF6ACB7A000-memory.dmp

Download

memory/5340-251-0x000001C0E6060000-0x000001C0E60C6000-memory.dmp

Download

memory/5468-28-0x000001CE2EFA0000-0x000001CE2F006000-memory.dmp

Download

memory/5468-26-0x000001CE2EFA0000-0x000001CE2F006000-memory.dmp

Download

memory/5468-27-0x000001CE2EFA0000-0x000001CE2F006000-memory.dmp

Download

memory/5468-25-0x000001CE2EE90000-0x000001CE2EF9D000-memory.dmp

Download

memory/5704-57-0x0000023C8BCD0000-0x0000023C8BD36000-memory.dmp

Download

memory/5704-55-0x0000023C8BAF0000-0x0000023C8BBFD000-memory.dmp

Download

memory/5704-56-0x0000023C8BCD0000-0x0000023C8BD36000-memory.dmp

Download

memory/5804-379-0x00007FF6E73B0000-0x00007FF6E74DF000-memory.dmp

Download

memory/5804-381-0x000002A3CB0A0000-0x000002A3CB106000-memory.dmp

Download

memory/5804-380-0x000002A3CB0A0000-0x000002A3CB106000-memory.dmp

Download

memory/5900-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5900-271-0x0000000000950000-0x00000000009B9000-memory.dmp

Download

memory/5900-276-0x0000000000950000-0x00000000009B9000-memory.dmp

Download

memory/5900-357-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5964-263-0x0000024847550000-0x00000248475B6000-memory.dmp

Download

memory/5964-264-0x0000024847550000-0x00000248475B6000-memory.dmp

Download

memory/5964-261-0x00007FF69F4B0000-0x00007FF69F5FA000-memory.dmp

Download

memory/5964-348-0x00007FF69F4B0000-0x00007FF69F5FA000-memory.dmp

Download