0bdd290eb8983be7d67456d68659bd1aa455c088fbfb60b9857cf02044cf56bf

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
Size 1.7MB
Sample260802-jkcb3avyax
SHA256 0bdd290eb8983be7d67456d68659bd1aa455c088fbfb60b9857cf02044cf56bf
MD5 f552fbac1a3ddb67ab9bdec19b7321a1
SHA1 1997fb0e5e59d254b57d773d1f1332285f69ac42
SHA512 db8eedbe925f5120560c4c840c305d7598309c06843f8f694e7334f228540ed37005aaed017ca997437b88652c039a47d0bb4c0261e3d4402efdb37e1aeea813
SSDEEP 24576:GJ7onabLDVBJdLBhvn/+h1xO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a7onabPV3xBh34eLNiXicJFFRGNzj3
TLSH
T1DC85028277D440F4E2B78538C9B20A15E5B63C654B31C65F0365276BAF33792EE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4116	elevation_service.exe
6056	elevation_service.exe
2932	maintenanceservice.exe
5856	OSE.EXE
1496	PerceptionSimulationService.exe
4184	perfhost.exe
4520	ReFsDedupSvc.exe
240	SensorDataService.exe
3076	ssh-agent.exe
2208	AgentService.exe
3388	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\abd5d14e5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc7cada35222dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007633ada45222dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030a12ea25222dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be1d6aa05222dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bb84ce35222dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4116	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe
6056	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5736	2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2208	AgentService.exe
Token: 33	3388	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3388	SearchIndexer.exe
Token: SeDebugPrivilege	4116	elevation_service.exe
Token: SeDebugPrivilege	6056	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 5040	3388	SearchIndexer.exe	100
PID 3388 wrote to memory of 5716	3388	SearchIndexer.exe	101
PID 3388 wrote to memory of 1692	3388	SearchIndexer.exe	102
PID 3388 wrote to memory of 3224	3388	SearchIndexer.exe	103
PID 3388 wrote to memory of 3280	3388	SearchIndexer.exe	105
PID 3388 wrote to memory of 1964	3388	SearchIndexer.exe	106
PID 3388 wrote to memory of 2756	3388	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f552fbac1a3ddb67ab9bdec19b7321a1_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2932

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4184

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2860 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3280
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2860 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 df61907def65f1d0f4f8eb0a747aa7c2f963b7cec3102dfd6e33a83e2e419f96
MD5 49f711f02ed6608791a48221f4e89e36
SHA1 6b3243d85693e9eeaaa210b3c004514acc62ce1b
SHA512 46cbdfe58506ec0111e5bb3b3e435878398007cade93d715da1c7da086736857338e11753970c8af190a798ba9b8fcd7a341174b5c4735cf1080e0dc27df81f0
SSDEEP 49152:ib+632BuPkFKRrdE6ohvstBhuXjfS4LWxnLLNiXicJFFRGNzj3:E3q6sjBg7wRGpj3
TLSH
T1D7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 61e84d48ecbc6b9c25256b95284414d4378915f64235d0f75135df2e1bbf1af6
MD5 5cb5b2426925c6c5aa08b470b1c4579c
SHA1 a7b045f84a0eae994a7319dd3a6968ca9ed807a7
SHA512 9cfc5e2082eb8cc69a75ba9d09db39a57c2794a0dd3651007f406bf6e57883b05afee19c64c53786076d0d5e916956909d3174a2df99ec584109d8efa21a2e7d
SSDEEP 24576:bXYfDtczAM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+tcFLNiXicJFFRGNzj3
TLSH
T10875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 dffac1b3ff42dd4174280bee3c05d28f72e146092a2a1d051a895b04d4b330e2
MD5 254e5089bfa3d7d734edfc6febb75474
SHA1 65aa52f78fd507fe7355a4c075a6cea73a3c230c
SHA512 647c5287d83ff492195cbc46c95c5d9d3750ece79525b43136ae7b43ff124c375ff7da52396a52ee3dede8f9bccd0538d6e37780acc070284f8dd56b6418fc00
SSDEEP 24576:j0Le5ji0hmx8rMj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jPji0AayLNiXicJFFRGNzj3
TLSH
T15C959E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d546aa4d1cbdeb9e5c69ccce615fe13515adf480e21312c0c0dc42d3d1d203b3
MD5 2d47963b94774017eb06126100020423
SHA1 116ff113bbeae7908402240063db4f70c0f33572
SHA512 8eb6c94014d86db42d0956168bf5e56f20f73a2a87f78203ffa49beabbd78c439898a06d50c68b91d5fec6a0da62871edcf772727aec9e5d9a75d0c4d061fed2
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWn6q8wyu1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:P/ezSC6vUzPveHjyOLNiXicJFFRGNzj3
TLSH
T1EE756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5324ee9ba6609a18f122a297a75f022dbed71be8229a0348260708032d1c3be8
MD5 47883d81505ec467800d34425b74e505
SHA1 e80fc8b651300c137f2a7083e408298bfc4b767d
SHA512 7bceab4cac4a3c025842b51a675874f449116f5761b921b5795c31d4692eafcc6921064a35a87f3aeababb303983dcce96f1a903b1242021c553352ee7ff7b23
SSDEEP 24576:SVbqPb88hv/l+YQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SVO88hXl+9LNiXicJFFRGNzj3
TLSH
T182559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 54db61b489ede86a8c19487679d40794ab408a37a0a2e184c6b03fb0e138456a
MD5 2324c6c37dff30888ebbbc204e0d9d3a
SHA1 97c313660c116d49559536b983f56dfae27468f8
SHA512 bf0d7485709388d10455d0c9ce35f51c8858fb986a9649e2fdaec14c6f44e1f2797c19e1d081e0c83c6ec521459c1e2d83d8f3f1f2264a6e4de9f88806d41006
SSDEEP 24576:2Sn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xLNiXicJFFRGNzj3
TLSH
T16C6523D3468854B1FBFD003A867A5828B5845E2CCA555DE2D2503E5EA23CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 7034086febe797cdda987e9ccfbef0e967b6b0bec9a956900a96db667d20a9c6
MD5 0952dafffc51158b959634d1fa99ce18
SHA1 0359cd735b8d7e0f60f182151a9625fa00c1e8f9
SHA512 deb2f502b63f09d9954d87fa097c95211b11c33fe484bde85b5cda6fcd1f1e9d984d11b8525b55cf00fd6f9376a621adc142b6b261d3ec5ce7cf80c2571d1a98
SSDEEP 24576:4JIUI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4JIUILNiXicJFFRGNzj3
TLSH
T1F585CF7BEE28FCE2C27E4C7956918600E76278304F6293CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 18b0b9e96e2fb6a35c0b4f5e66c994cd0e4e3af5834f65cd7129561bc3f921f4
MD5 3ab254e0776b3a781824daae89c302fe
SHA1 d85c50d1981361b177534817a7223c68a16110dc
SHA512 7913e323149bd7da8067a5974faa225ae0a9e69e312e4590de016165e302c5b63e2e593a3fe418c5f6a2de1109bb20d021d30723b24a2084e0e13bfb2c2e13e4
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH2:2QvGAdlCEL8c/DRNw5Cl7wRGpj3
TLSH
T1D2266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 496ac65f74a0839d93fbf338bedee5554ee7b033501a2d8615ac582d25637e03
MD5 35a9ecb5ceeda5b1f1b725e683f1b4d0
SHA1 5d10f42b0ae85b176a47d462707e31c4f12b3647
SHA512 b631ec685b510192da1f79599cdb8bcfa6c7eb8175359fadad860c4a2e37c2c424f82c20cb0a2d7aeeaf13804094b1d31cebb4995979ad0d6d1f1c1e0f0a6291
SSDEEP 24576:gzewsAji/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2ljiLNiXicJFFRGNzj3
TLSH
T19285E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0cfc45fb8096542d40bc8ae0042e763056ec025acdc5b026dab8eaf72f157890
MD5 af23d8a9ffb7e06967e16b57e9ac7cec
SHA1 9d6b8053bfa4ad848a37692edbdd47ab9115f0d7
SHA512 9d9dd937e9eeab0d58990a2fb4f0976f38c7f0dab936d533db24b308c2c499a1e60b9da74390516a26e037fac5d8059a97819184329a25cacfe65bc51e86bcd6
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHeF9:hUEtQevvqc2W1cpV2tI32S9
TLSH
T1B8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8913225fa8b8eec7c40bae13d9ce7cc0aba044d4559c1663205488a1b5c510b0
MD5 49cb60ffb032766af35ed0c86642b820
SHA1 5eecce5e008e4ef0de938ba541c6d0333ea2c69f
SHA512 f8427f5faafe7cb144ee40958e77c99cd747393aa3b14af9a5d3d0db944b2fc641c4a420cf75728a694730637b6bc57408397edfd0dadada38064610a0a67028
SSDEEP 49152:MCbRquA/m2yL5zifFiV+XenmE3/zCLNiXicJFFRGNzj3:loqHVjnmR7wRGpj3
TLSH
T14AD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6623aa005ecb05ef9497b85d7b3d3eee958d404a19d08c56575f60b46dc43c50
MD5 4487753f5f08c72b533753a728a2be00
SHA1 c0f45b0903866a5e8bfac417f7e19604b5feb214
SHA512 1471f698cf8909cf1af20431bb3cfefc39ceed1dd5cf2fce27f07489c1c07673511ad7dff8536244a139c871f8a7906d256c657239b17594f57cf7a897a34fa1
SSDEEP 24576:1AhGL3IFoiwtA5l7S53x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1AMUFoiq5BLNiXicJFFRGNzj3
TLSH
T170359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 00f5429f18638b96600684c7f61bc2872241aa93f58d743acf1042aba884d443
MD5 3f507a5eaafb2e8993cf3063f03c5257
SHA1 da4c7ff9f3a13177f58a3180290823bc028557bf
SHA512 da65e71b414e68126d40db8982ea092830fd957e511c76d770c8a6ff3f4ed4c2b821e7691d8fe42d13599757fa71e6f71751effe5f9d6e9c84607861cf313295
SSDEEP 24576:6wufOWu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6woONLNiXicJFFRGNzj3
TLSH
T17D75F08632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 77f8c79f2841ae02ec3948bea78cde3e7dd4c030d13ee2556914049c7b98267b
MD5 66a6a3073c94dc3fa5ba5df811416cd8
SHA1 ff02948024d9a2d7377c969d5e3a8b5a5dc4569c
SHA512 c61bffc1f6d0ab758753a02cb104d7cc3227fe3f0a174c58217e0d8dcb52d0f5947e878870979a1167efe1c28f3ea823317f671d18907950ea7ff153e92ecec9
SSDEEP 24576:tZu7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cLNiXicJFFRGNzj3
TLSH
T1A465129622D420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b06dbc368bc2cf9aa0a379072234ab62382e8e5cac30ee45bd411dfd749bcce5
MD5 2237e38daed38a7dc353b01ade923643
SHA1 c638e3682c79dab546eb9c1dc70e689f96d54306
SHA512 b545d1ddceb939aab9484dd7997803cbfe84a602bf3e8c039fc26f3dadaf225a6fb0227e596768e019c42034b9704f5c459a0989374b6d38d7fd07b464d7786b
SSDEEP 98304:RQRQyi36YOcPbLvw2gAf+PN3E7wRGpj3:IQyiKa/X+PNAF9
TLSH
T167667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0557176839a6ad54f7d44013214f6ceccbd4a3b69db57d928fc184f14c3b2adc
MD5 23f515ad4b11eadce85790b6d06bee67
SHA1 4deaf3c3dc616940d76597fbf65ee3ca83e18da3
SHA512 97ce49735ae1dda371168d78d10436a23547fcf12976b212a9acbfa35527db416d7c2fecbcd4664a4088a3f2f3a1d8a8cf6c2642907f7068c82d7a040c76d625
SSDEEP 98304:EQRQyi36YOcPbLvw2gAf+PN3E7wRGpj3:LQyiKa/X+PNAF9
TLSH
T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1a365a0fccd6a87bcf7e967d74fd106159ba15b227bdece694987ae692606569
MD5 44a7ccec0fbdd936c79c32bd690d3e59
SHA1 fca80ef2438a2040097da65eda16d186579b43b9
SHA512 fe774a1fa0ff9402877b34bca35dc1d994627c1a7390539dbbbe2ba05a5720851430a4d8ea4b2855b22878810b2d4a2fd452e5de6d76c4790a12e6d557bff7a1
SSDEEP 49152:x68Qg55nhceWu7PNU3/yLNiXicJFFRGNzj3:vthLRc/y7wRGpj3
TLSH
T1B1B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fcc8922442a46c63fb921251b4953933bd6a4270dc257ce720771e7490136bb4
MD5 60140a38071e08f11294771911a4833e
SHA1 3a4cd59b2cc12dab4332300b98a6bc685adea7e3
SHA512 0fd043803a2079fbf307d72ce19a73f0c60e06e160b777b35edc377e81ab918e1901b48c68a4455532698596a69258b5b99f605dad6ca5d4d006b9ebbc6b8fe1
SSDEEP 98304:hy5112gYy5azzVvt69nLKnhZn7wRGpj3:8LIHEWhNF9
TLSH
T1B1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 96d4addb79a5424e587a26c0cb8139a29e250ac7ded62e65d60971a3b81c4ba3
MD5 2a7c76096e6dacb4d6b788c94606a2ec
SHA1 b97bf3970bc88e0c8bfccb09655cff8fbab542ce
SHA512 c2c089976778ab4e1291a6cd662a6470cf161a19f1051310a156c9cbcbaa4926b4fe7bb850168b6a6f05140fc1107ae073fec312778c36ca84ecc056c0f7fe73
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glcLNiXicJFFRGNzj3:+u6Jmdxd2dc7wRGpj3
TLSH
T198D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c384d89bd32dcee87bd5d82477bb435bf9c39adf7645f15f61cc684203be039c
MD5 2ecf825e98f908a4b285679764a079c0
SHA1 d29cd3baa6caffe809b3ff84c5a9d319f98f43da
SHA512 ce50b3b95c1a66843978bc1f6a45aa996b7ab0d3005b7504cf44effc1fb5da297442b5197371f43790371ff535951c377583c805434cbc3b2a668b740b91cf61
SSDEEP 49152:01hpsNoJpF1A63U44CwH7R4xoLNiXicJFFRGNzj3:0mifPWRR7wRGpj3
TLSH
T1A7B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 297fe3fc84eadf5223896480b6a5f929d67bb1d452eba162d06a11bd1a45e1f9
MD5 27292fafb12f1fd3c1c9bcaeca66df58
SHA1 74422019d734c096cac56953ee7e3f40a4f376b1
SHA512 21bc0fdbf223aa50731877077745e63cf6c33bd9031524df159baa228d111b15d08cbcee1378c2a9970ca00aa34cbc2be05d6622690b634a7b16dce256ce0a05
SSDEEP 49152:kSuZQIY0Be2KcRVtOnks6NMHq7LNiXicJFFRGNzj3:25dKii6177wRGpj3
TLSH
T174C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d87046613749848014445bc09c3cc1fc0b112ce22e8cad412589db32a9f793c3
MD5 74bde920580d91b1cdda2c8a7742d8ab
SHA1 fd2fc1e3334f74b107bc97bef313f310206e5c52
SHA512 d77a5cdb01fe4206373dfa828ab0fd556e3a1f4dc2536f424b4da88e87cb0a3ebe6c85c3af533102dc56d56f5669c20ba39b260fa27c2e8284a9547319d2b895
SSDEEP 49152:ZhtSn8EApI0fig3giDn0AP5wMLNiXicJFFRGNzj3:oX2impht7wRGpj3
TLSH
T1B195BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c6c7de9ffed7fe1fc0fe49e85a201b46e15dbfd7c3aeb637ade38009aee0292b
MD5 d91cdaec1d1e6f47639f7962b8f979fa
SHA1 66e32af05ca2db67a83f68ddca28cb8e85f9cbe4
SHA512 97bf57a9b18b58a48b744c90db7a17d35888252d570301847fb18dc816270e240a89c805c7e25366b14481629395519e24b576c57f126417cdbb0ca1d5e457c6
SSDEEP 12288:ULiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Uf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D56523D3558955B1FAFD0039C6764428F5882E2DEB5618E3E3043D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 28c6ef704479479906f6832c57c0d3dde91dfdc700a0724bf8b14072b0e7f7f7
MD5 de1d6764edbcea50c624701d3cd006dc
SHA1 a138eb0278e0f47ad66db109da9704d7e3e1dd78
SHA512 069c753b64925efc28f1a6bdbbe33c91e102b911bea53815638a57a81163db9f76bb8d5a2ab8d4d4a1a0ef844147e17930a3f6416664aa64be4237e8b60f5e1d
SSDEEP 12288:tMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1616523D3548955B1F6BC0039C6754428F5882E2DEB5658E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c2f2d416ff2d1dccf848d1b7e93303428b77b8a0be19e3e21623afd1e63d6940
MD5 3ff897e855fbab35e7ca39d545a6dc1d
SHA1 06aa2be6858502a7e7a5eb8baada9d532d3ece1f
SHA512 5a790e9026fffddfe2e5c43bf87f8120afcd7776477cc3ac61fbde57bfbc1625f8da380e6f3a845fc8f9c0eca623c0aaf54d83225f605c25ceca6f79a6a53ef1
SSDEEP 12288:mWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C6523D2548955B1F6FC0039C6764428F5882E1DEB5658E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 34e98736c47cd361a9f61aafcbc927e47d40af3c577acf66d83733df080c3d18
MD5 b87a8871483b597d52213c7556a8617a
SHA1 432f4849be5a262fe9bc042ed2284cab93cc9e89
SHA512 558063909a5e2915773eb6eb2cb673f27dccfa78010bb648255aa7b5965ac24895381f0468dd010493319159200558e05304e6a0480142ce1abcdc35e6574098
SSDEEP 12288:RVNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E2652392168901F1E9FD8039C6764424F2A47D6CDB325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 d95689f782921d5fb379988a723e73d6d5edbf07e43571c4dbec79ecc281b832
MD5 60b4f49226164d56b8d9e107eea4d621
SHA1 a25221a6469307ee8fa221ef18cb175379ebb12d
SHA512 e6fed68e3b94ad530c3b4a71c52f19972876497653edd1790799faf865f6a831eb847b2321e23ed15d8bd1f5388b8b00b6052912f413a87574ac29aafe57fb49
SSDEEP 12288:I1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1016523D3548955B1F6BC0039C6764428F5881E1DEB5658E3E3483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b1d1a9a75a85e826df1590197e58aecb5b387f3675fee600bb85b3efbc4ec237
MD5 a16f35c587192507ca5ba6f876387e3d
SHA1 de190f664a057ad434b3b78f10aa0b24ec77a7d5
SHA512 d1322cdbe1ad31879632aca82f8846d9049cd4b188abaa54aa55ae7c2fdcbbeb31a5b9dc6797b27ca4ec9a925d873a9712b9c7de965e1f87eb776bb07ab35f2a
SSDEEP 12288:cIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1146523D3558955B1FABC0039C6754428F5882E2DEB5658E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5888b463431111f926da854acd52a545d5da984644e1c4505310160f0ea71c34
MD5 17063a4bc7821d05f9441a2c2b1fb9fa
SHA1 86f80b0b1678b6f5b8fc4e1fb6b7cfe438800572
SHA512 1a974bd87fb789776bd45914761da8c6e29010e79d6ac37504e53a125369d950feaddf1fc0c22e0c65ca3bb5235de52737dd1854b042e824f8d57930f8e311bf
SSDEEP 12288:/UiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B6523D3558955B1FABC0039C6754428F5882E2DEB5658E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 44151e1153e1c8eaa3ddab9c4ece63e2d1defb4d9cb344280f2b1629304cfc80
MD5 ae82ae0cdfa680d665e35d120a694fea
SHA1 f6b31dd514c8f9bfa3611a79f8e3f194d68039ad
SHA512 34cab7c6146da38bf0ef446b42646863fde18164f955b17202823be12ef5bd10afb36d5b41906598dc5731c3adf1afff2c8dae2c6e542b610780bee7df506f1f
SSDEEP 24576:SZMSzFVSOW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SZMSzfqLNiXicJFFRGNzj3
TLSH
T1D6850295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 78a8e514d8bebccec1699f209e64d11897bab0faa65585c871b82b947c7c6596
MD5 dade15f5f7ae63f9dc263b64be55083d
SHA1 38e9982266adc9b4612227c7a6bd99323ca35a17
SHA512 236039af31481907cccea9acab3831bf9ab61c731f334c8d6353677b2fa230699851e7c4736dcb43556a0b94bcf1f76b3d3ea450d35ffbb13a6b37f8922c47af
SSDEEP 12288:WfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE6523D3558955B1FAFC0039C6764428F5882E2DEB5658E3E2083D1EA278FDB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 85e2afef463ea1b15e4a383258c0972dd2253a636a32d3692d9b443cf92a4497
MD5 ea624d757423faf6e2affc64bac96425
SHA1 742ba1f84c415b5dfdc7f72961ed6200d4a2859b
SHA512 933b5e35c885ae3b678db9a41369d669dc0a06a8dfc389a3f446e4240967e2f831e79364ae7387587c184c535323e46f8e7183b53adb766d32ab1f4938d832fc
SSDEEP 12288:7jiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1026523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 430dfe7cfc901faff18c075be447c7c1f128520f50c18cc66fe7af7c401a4c70
MD5 c357418f25ddafef27868618f76a0fcd
SHA1 fe6f031928414de28eab7d386ac88327cc211d56
SHA512 193c53e8f6eaba136142f18203ce004f392140b32b4c88f3770840ef1f7b829b0cdfbe3c8f78841d6bcdf0bd06c51e9fb0e828f79afa3244efdaca9a4ec7bbbc
SSDEEP 24576:AzyS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AtLNiXicJFFRGNzj3
TLSH
T11F750247629530F9E17A8139C9620911F3717C3647208AEF53642B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 47a68cb0046758a2e64b2d2ce76727211643f01911a0f4d90f758004932c3cae
MD5 4f83b4323d0bb2681d91d6d88f7af4fb
SHA1 aa77fdcc8be30fa8e73a0c45cf78f7f7a03201b4
SHA512 02030f7a413e21146198219b35d860e47d9abb893055e1993f6277b5ec85e963f98dfdac820d5bc5f6bba04fc9a605aa2d6a90f7e61c4acb50a0f3739b5fd933
SSDEEP 12288:1fiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1776523D3548955B1FAFC0039C6764428F5882E2DEB5658E3E2083D1EA278FDB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ac300303a4c3812b5926f2363830c8f1489c64ad983dcdbb1bd26b7d2f4540bb
MD5 0dcd9fbedd40b9b87aad6111f81226c3
SHA1 f65fd1aef5f8d35920009781aaebe4349d1c6139
SHA512 b8b23c4e44dcfc4dd48cb2d760b97ccb0a6d5c5a267d9033ce813735afda20894b280d0a226d27604de44c410a093b7bb4e065817077282ecd226b50f5d3baac
SSDEEP 12288:rfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1046523D3558955B1FAFC0039C6754428F5882E2DEB5658E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 a939a48ff2e801e378e0914962624213a90eda42ddbd8d9b3871ab8a0cce134c
MD5 7efdc4afb4808e365def3c58bc99ec30
SHA1 d4ae86fa05ed663e2078e95e25d9fe3d6453ae2c
SHA512 2c1ff322ec796e2d4e9bd7ec904b6537a961e72078a3a94ee247c622c7b3d2f33e07c1769fe01afc88edc6f0c1fed57da42a50cb058cf4cd243cf10dfa78a133
SSDEEP 24576:KzyS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KtLNiXicJFFRGNzj3
TLSH
T18E750247629530F9E17A8139C9620911F3717C3647208AEF53642B7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 3f497d0c9e15f15ca66620902836f64e2277c5c32b5e3be96a403da59c152434
MD5 f302f4e8e826f44525a8066d2f713581
SHA1 2638723c49e3c2b02c917046662c1c4ad629ba11
SHA512 a6b68aa8c60ba22c21c2a984da90074a782ab5353faee3692b3db7c1848d7d7b04037be05d6bbc06269f7becd2b281f5af2d0f8a9c5ba720a57cec58b2212c26
SSDEEP 24576:dT8aLl3z0zDw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dT7Llj1LNiXicJFFRGNzj3
TLSH
T10C8502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 0b430e0469a81b76c8e9e6bbb836e99ae57663312f1bcb84d865084e4c2ac4cb
MD5 bd1829c79bec8ebd9c9193a10879e31b
SHA1 43339d2b881766b1e8cc8e45624449f0b565b3ec
SHA512 674301dd185df4b3c1b6fa9dd92bfe2ab432ad17c2926fab74c6a16557039f0f9b5b1ad8999f9cb68b5b1c16e572818ef551b229253ab5324549531728723375
SSDEEP 24576:83Qd9CHKy7GZk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mQd9CHKyaqLNiXicJFFRGNzj3
TLSH
T16095CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 f8392fa56a196942832da36d0691b942b2f1c74dbbca435fd1b953981949ce7a
MD5 9dfe786fd5149a75b819db09888e3e6f
SHA1 5e89c612915a953e6e3633c74cdebc66e1222e72
SHA512 2014800b94698d03745b79ca88624fc0b165293b28b70d5b81da8f13d045f932767765334a61fedc7237eadd16471a848f2c449fe53fa1f32c9fe0fea4aa15f6
SSDEEP 12288:m2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13C6523D2548955B1FAFC0039C6764428F5881E2DEB5658E3E3483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 6db51372e3ab2f2e057e42185afb1d7c7c15667a8b8dd3bdc45a249a816116a1
MD5 f0087831e4bb2dceb12cd44329851a0b
SHA1 34299603382fc20cfa9d49e0798bb86c3ca7348f
SHA512 ddcfb8bc34a5d59fb6a478f5a9d618b5e26bbee46dc2a1bc570e8d3994bd9fd49acb94e7cc30e7db376a967e9247117ceff6e89a244a8411581a3f50011c291e
SSDEEP 12288:3giJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD6523D2558955B1F6BC003A86764428F5882E2DEB6658E3E3043D1EA27CFDBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 37471189bb7686185dbbf229542d15b7950a14fa36d8b090d218872f9686afac
MD5 1c8b624491c5820368a65087f7ee41b5
SHA1 b9f8353168dfc35e9ebd7d766f357be17bf605b8
SHA512 ac5732446cbd75f644df918bb8141b4467035b0964c09970087c5b9bbf2c07b4dfa531883508d35ff03e7aed4277ce394dfa78934ab752c2e872643eb51945e5
SSDEEP 12288:ZRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C96523D3548955B1EAFC0039C6764428F5882E1DEB5658E3E2483D1EA27CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 99d4bb63d797d7cdf26767f954d466ead6237af4daed5c35df6cd44446400fd5
MD5 7d9b740ecee95d4fd7a5e9c5d9a1f2e7
SHA1 6749edb64accfc49dae213a55e7dae9ff53d2d56
SHA512 6784e367091813b6445dd349b3e4d35c942c9ddbed4244fdc18fdb5b5c6e4a19d87dc05f10f68b4b00dc9067edf9cbe3ffdfae3fb76497025b2d7371a24ac27a
SSDEEP 12288:afiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ar/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C46523D3548955B1FAFC0039C6754428F5882E2DEB5658E3E2083D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 f8b71fadcb467760cfba95edd970a5012f7e3239683a455e44348730fdba733e
MD5 748fa7d4246a225065355a3855c70a69
SHA1 ebac8b183301806da46fcaeb8d492dbca0b38756
SHA512 65beab80d74dfca78d86a92af46d21747fbb73255e4f7ec6676768114e43e3351062f7d2cfd87cb01d04d11c7bb62e66d6cef21988d81db35ad1e2d852d2d0df
SSDEEP 12288:j2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1066523D3548955B1F6FC0039C6764428F5882E2DEB5658E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 1e4a9d417259e6b0cd569d391655d4f57b27c7c208faf33f3ce94be598abe3eb
MD5 2a4ba64772691f6983eab998403428e0
SHA1 98105746c60ef08a896487b1914400c46951adff
SHA512 273930ce3271efcbe4f1f2152e2cc641c8b9cf8ed57a7708a547fe68a6d387ff97c1a1ea05ab6563abf1d4570d834c6c7334ea7834bb45e3b6fec476b6682527
SSDEEP 12288:cHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1896523D3548955B1EAFC003AC6764424F5882E2DEB5659E3E3043D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 aabbfce6a580f0d9a2764a24ef71ba8ec72162d12370d07527a16d803e5fb6a8
MD5 97ec76ff6c8851cd92bbc80d999da41d
SHA1 f80f0417c9bfffc574350c1249d49f5621ee7c20
SHA512 c4b2a3ce3b681395e133ecfef2a504b1c9ca07fb06979c5025b393faa20c9d241009d64efca5cc1aafc0b76fdc29c07a9c345291aacdde82383e394455a705c5
SSDEEP 12288:o1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B46523D3548955B1F6FC0039C6764428F5882E2DEB5658E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 7e0b93085527184158e629caefeeb2bb5a33623e8313aac78c6cd5e5f4548cab
MD5 376a378e1006941040efc810edaa543d
SHA1 70e65226fe02bfd1660912dedaee8b0197886c78
SHA512 85bf5386f45b41b5cd90ed06acb6af2f6fb255b257e136f5080b2a2e0258b4f30805cf3480cfe8455eb04ed587ced189a6528dd7285da6dc4198a909a721853b
SSDEEP 12288:mOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F16523D3548955B1EABC003AC6764424F5882E2DEB5659E3E3043D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 3c1f8a9c6355f605be77e6e343336b9f5a39fd7edc9215305e2af4dfd3733cc8
MD5 6ecdc6b651b7a58a50395178301568bc
SHA1 c95d7d3f8fb5451748dc16d371e7c964ebaf26c0
SHA512 991e22282209108e49879b30492a229e399532f197330f9df84ef27ed8438d7014f34b45c45b7a72bf609f08c27c9450c800f07930f6f2011c0fc9c2a1a18db1
SSDEEP 24576:mfwvxk9RX6wkyAIH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rMnYIHLNiXicJFFRGNzj3
TLSH
T12095DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 635afdcfb7ead98cef5e0a535071df9967b6e70e298eac8446bea70d08b6071e
MD5 43769d845ee078fa81d3638187895bd4
SHA1 4f46bb80308ca2d851c618a9b7453203d1466f16
SHA512 98e37a5b474feb2fab66e01f8c09ee9580e144bb355cdd6c1cb273cb8e2b61d5c06f31b940b0a04da40c0ae9f245892bdb85ae26db1cc3437061419e778526c5
SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0sLNiXicJFFRGN:tySzPk7wRGpj3
TLSH
T1C9066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cbd75abe427c6aef99ebc117175bd6cf4419a9009c9f8f2b34ff09aaf510d244
MD5 80211b9222a022ac4b13d76c97ec0fa2
SHA1 c009f1c8dbd1bcb6d704009036a34e61dd83e7bc
SHA512 95653c284b4bcb35ad4cbbcbe34dd37ea80d066d417dae70334bb31bb4150c7ba0db216c055742f2fcd6aa79c77a0ec81ebf54bc09e9edde3744dfd7ec2a1c85
SSDEEP 24576:647Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:647JUQjTirIhCnDHUPfF/cLNiXicJFFS
TLSH
T1A365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 afb168fed88f8da8f85ad7e64aed05a834106c27b7e9b4b05e0b5757cac09140
MD5 dc94b0f834679a7d65d72f9aea17d23c
SHA1 264b3a1d519c962e2db66de7ee429cfbe3479197
SHA512 bb4883447f4168ce62fbde1a32bbb74544cb59861621ca670c8b49878d78e75d032dc14920342821f87105ed2e5ce55639cdd6a650cf9e1bc20ead546818de9f
SSDEEP 12288:XosfPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:v7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17075F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 590dcb494e33fa6bf193cfe8f0b06745d9e7efbd291af136edaa6f24dc74ac38
MD5 25d6a914a6f35950258dd5ace323acd3
SHA1 f87029db7c4f8f216d7ff100611682e5c45f1ad7
SHA512 2591f0d0143f7930d1be64668d985989ac640f43d6681a80ea8e121db1e23468bfd58b7c561bcf309c3f83807ff40eab1afe570b61ce1fabfe567370e3091af2
SSDEEP 12288:fADPgCU3fMMLlp/ZHkhHYBm+BbcSP+qeHphRMk5:fAD4CUPM4LRHk+BmCbcIveHphR1
TLSH
T1EC350641766BD78FC6A940321E36D6CCAB607D01EE45AF0373C8873F9576668B6F2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 10e1958642bab2d3e5e321024178dc18d5725a57191b25a0973b327ec941aa0c
MD5 d698486f491cc34732001d734db927cb
SHA1 41a79f88d0c1d35f26ccd7b6f018908fc9bf6005
SHA512 764ec5695a62bc92f2065b76dee9531391d89e30f19ad3c50d0767ba4a1e9df5821adc5d4f7aec29798da6ef0a5c0ad962a73274430dc64b660ab8819f20d29e
SSDEEP 12288:l7mvlGHE2Z5qp93FKeaeeNlQMqlR6Ft3pS30UIZIUYcBQoj:l7mvlGkokv1aQMqlR6FCcrmQ
TLSH
T1C755394165B7E35FC9AE9033423296CDBB745C06B7493F0573488A3C8866A7EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a46b85ca94b3ee9e19d3780bbbd5885d55a7ec65721b5c767a3558a922be078a
MD5 3a135bcf6e32e08548a419a362ffd03b
SHA1 226ba122b14c203dd9b5736e67b107e2a35e98ad
SHA512 9cac7d1f5cbd9954717a9313fafcc0c58acc7adc153b061704ffa38f529be4acd8031d615133b46f3e88fb6851bcf6518e4d49b7937b0dd69899afe065f8301b
SSDEEP 12288:pq73iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1676523A3568859B1FAFD0039857A8434B54D7E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 17b1f2861575e7cd96039f4ff37c3b1c57530c912dc9166c4e0d088b9bc3f07e
MD5 c21fe1227824781866cee10fcd1cf5df
SHA1 13f093a1742e5528a9a080f5d1730aa06fcf5df0
SHA512 cd8237589cf9dec7f1bb174bd95af633129bfee2c215417ce76ac277c0d16ee5b48e52e231dc4fa3ea0c38a70e42e2dfb405396ef038c284382f2826e5751b75
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bY1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ggb4mBIBhGFGLNiXicJFFRGNzj3
TLSH
T1A465AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 ea3ad9d8e99c6f5355923f431b65fd141b065a22614334e96a6b0961050aa810
MD5 d5ae0aedf37ddfca62d9b6aabaadc3fa
SHA1 821bdddc86ba07092ec9f91a562d6c404e428cbd
SHA512 009c01caa185b155454ba13d62808ed970b20cd127752d8081a3f9c3bf6942ff05209eb91f8db4a7708ca3904bcf014bef4f865c1af21534335df69105a033c8
SSDEEP 24576:3G88u8FpJqH1+zria7/mW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:27ZFPqV5a7/9LNiXicJFFRGNzj3
TLSH
T1C695F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 73748b0741143001bcda15845168482e520ef6e2fa890620db7029cb8a78e434
MD5 27fb4eda125033b79878035c7ac94dfd
SHA1 093deb23b114c3893e4f0d8f82851db780a8034b
SHA512 67988ae4031218a6adf34134ef4b9e630428730ba047c3731cf36d36ff0d91c80ec0375f0749e8d4a9235ed9184ea6b4842c049247a11b2e17cde0c49c865b44
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6LNiXicJFFRGNzj3:4G05lO43bP7wRGpj3
TLSH
T1C8D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2ca3cf39f987c59d61af2bfefdc1575f735850940b32fc8bf97cb59c9c295949
MD5 58bcc2c46b381ade53cfc38084ef34d0
SHA1 77586b7c56fcebe362d7ce30cf4b362035789433
SHA512 334ea3beb04a32993f99a2c4355ef990bfa14ca3d7c9ee597e85c20ecff4664a5ec919ca7d02c1185ff177dce999dcfccbe3902e5d227b6bddf2a5fe5b15b869
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidns/TwSfVcYG3K/cJHlnFR+IGNe8jg:0a5POZ3BJt2pasx2+myLNiXicJFFRGNf
TLSH
T12C65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 db21f17df4e3fa55fb12055afd0c173822fd505eb386e340157585c208466c0c
MD5 5b3abbd84fd16e3cf456883473e9319f
SHA1 02d1d462127a259d8e1400ae3c57e76061f6e164
SHA512 62c804a7a6a11ef3a45119ec1f4083879b5fc16f5aae62e8300dd8e77d4e95fa4f2a5ba603d960680c466a71d45d3551da486fdb929e67017d97cacddf6f9f16
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ONc/zEOVHFdLNiXicJFFRGNzj3
TLSH
T10C858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9a00b4fafe1ebcfa3781eabcb5d8a4c06114c153864c685d920f7b4c3801f022
MD5 db82a503f288438e9d0ad02c262cf54f
SHA1 970da1eb89112623703b80924a8384eec5c6fecd
SHA512 366ed01e09b6238f8a878578a88ea052054013b50fd48c1b3e918eb1bb13b191ca80a9829d43a004d9e05de3f9bc17ad31f31e2a591948fcedb905a518137a31
SSDEEP 24576:sTkNvNnaFeYhJNtmZBm4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sTMwBtOm4LNiXicJFFRGNzj3
TLSH
T16355AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 e39c5286362a689cb70646b6126e6d1b22fac4014ad2704a53f93bc0938b15e9
MD5 968fe60b92fe8eb98617e43bd3e5efc2
SHA1 556b4301353c59a9e554834afb1fdd1a334841a3
SHA512 57c5831130623928b806e9d4a66ac56553c52a5b6068463909525dba7cb68b51b73bcda7e39576358d43d6d7d47462cd05b3ffdb747b34c12d339114db1a6e45
SSDEEP 24576:vPUr+NQq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vJQqLNiXicJFFRGNzj3
TLSH
T16A75F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0364def8fe5cee25c82fc2be728457b7b019f2706e77d75866156e26b6766602
MD5 a4cb2f00e9c443f32e197effd171446e
SHA1 db6ade6c60588aa8e44f2af5249e97436c02f494
SHA512 56224070e870012f68b9869586f9f613a45131d9f9688ad19b4fede6585e7f3ceddb57a159af25abb81bfe2f1a92abd6f380a5a7c94feb5d50c6b9e004dcb440
SSDEEP 24576:3D3FHshBIYQgA//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3DVHeBIAA/LNiXicJFFRGNzj3
TLSH
T1F585E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-108-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/240-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/240-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/240-313-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/240-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/240-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1496-65-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1496-73-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1496-308-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1496-67-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2208-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2208-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2208-138-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2208-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2208-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2932-40-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2932-52-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/2932-39-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/2932-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2932-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3076-114-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/3076-115-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3076-121-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3076-312-0x0000000140000000-0x000000014020F000-memory.dmp

Download

memory/3388-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3388-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3388-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3388-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4116-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4116-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4116-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4116-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4116-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4184-78-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4184-79-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4184-309-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4184-84-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4520-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4520-380-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4520-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4520-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4520-96-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4520-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5736-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5736-0-0x0000000140000000-0x00000001401C8000-memory.dmp

Download

memory/5736-77-0x0000000140000000-0x00000001401C8000-memory.dmp

Download

memory/5736-317-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5736-322-0x0000000140000000-0x00000001401C8000-memory.dmp

Download

memory/5736-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5736-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5856-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5856-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5856-54-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/5856-293-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/6056-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6056-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6056-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6056-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6056-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download