8a695ade82ad6e860561952dee9d007732facf12eed79fb0fdda293fb75a627e

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
Size 14.0MB
Sample260802-qqdkmsbj31
SHA256 8a695ade82ad6e860561952dee9d007732facf12eed79fb0fdda293fb75a627e
MD5 e8136737750153149f9af26a184fa20a
SHA1 9a6f0a1aee6b44a7d686e44fd09a7c07af16e648
SHA512 2f7dfc326004da9464d3b59d7c3d06414b8cc1defe0637b81481080b00febe1c7035ec22eb6d9d2f118db4e0dd74b8c2bb50cfe8d544868cdaf449a018b5800b
SSDEEP 98304:jxW2sUhKyJAM01FAZJaAcQgpyI3D527BWG:jx3rhbo+aZjprVQBWG
TLSH
T160E6A2364178CAA9C1526837C5494CF693ADBC10C6B352B7D6443D37FABE1C2CA7E286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3396	elevation_service.exe
2248	elevation_service.exe
4152	maintenanceservice.exe
4384	OSE.EXE
3412	PerceptionSimulationService.exe
4296	perfhost.exe
4492	ReFsDedupSvc.exe
300	SensorDataService.exe
5624	ssh-agent.exe
3944	AgentService.exe
3096	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\be97b091209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000715fc7c48222dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004a8dafc58222dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084efddc48222dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9dbbdc68222dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d2da9c58222dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
2248	elevation_service.exe
2248	elevation_service.exe
2248	elevation_service.exe
2248	elevation_service.exe
2248	elevation_service.exe
2248	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5628	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4492	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4492	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3944	AgentService.exe
Token: 33	3096	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3096	SearchIndexer.exe
Token: SeDebugPrivilege	3396	elevation_service.exe
Token: SeDebugPrivilege	2248	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5628	2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 932	3096	SearchIndexer.exe	100
PID 3096 wrote to memory of 5176	3096	SearchIndexer.exe	101
PID 3096 wrote to memory of 4484	3096	SearchIndexer.exe	102
PID 3096 wrote to memory of 5292	3096	SearchIndexer.exe	103
PID 3096 wrote to memory of 2104	3096	SearchIndexer.exe	105
PID 3096 wrote to memory of 5084	3096	SearchIndexer.exe	106
PID 3096 wrote to memory of 3292	3096	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e8136737750153149f9af26a184fa20a_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5624

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8f83159de1324c1d368fc75ec83fc03559ab7e6d874567a699d46d9b69140bd2
MD5 a8748a9f3dc19d535f0766711bdedf61
SHA1 ea12f3da79e06fb345ce8c3642fab54819721882
SHA512 0dd18e8eeccdd6529b87b4e8cf55e4d0f56e8b4b565423600b664cae4c39b0ce4184d4490943e6533b27f25ae0d6d47ecab2856b8a1698d5d7eb335de5ad89cd
SSDEEP 49152:ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZDmg27RnWGj:w3q6sjBWD527BWG
TLSH
T1A5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 19cc54d0f6ab80a72fc480dff995551b73e5a5fd7245b6f972dec915331ae38b
MD5 aef8fc27a170ef32a1bf625054ced4f5
SHA1 2e168690c7da3d6d3ce7617f9759a2cf17797e7e
SHA512 e618333a136f5b0f8de93fbd3da668ce4202160d0586cdd9384605ab321080d8bf0455442ac9470c3cd67fa53682e5bc931cc6bab6d02e7ac3af80649c72c988
SSDEEP 24576:bXYfDtczA2sqjnhMgeiCl7G0nehbGZpbD:+tcbDmg27RnWGj
TLSH
T14265F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2e3f5fd071876492424bc7d31b1bb694093f10b7018312c4a7956fb16813386e
MD5 d5c1d7bd0a557df848e60049619befac
SHA1 17c4b23296a4e7055bb6f71863e076d83a4eac36
SHA512 a9462e32685d2257784d47915de53ca0d17596a30deb03be67a7af58c3ac2eef96e039976ce879f3af13a68039cc9bf3adc8ed5198a0f4e50a94e1018adfe8a7
SSDEEP 24576:s0Le5ji0hmxxrMtsqjnhMgeiCl7G0nehbGZpbD:sPji0AjYDmg27RnWGj
TLSH
T15D859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 51eb32d730411df6133cb6a14a2ec76908f58db7d3a64f5d21eec46b8f7fc4d2
MD5 39fed38f581e57d52da9c3280e6d30b2
SHA1 e70799ff954fdc8c544c39c89bf54799296fe205
SHA512 c721f896715908cda0ba871e824f4156033c65ee9dba9322e8c2d0dd96ceddde534ba79f65dc25667ea0903c8278711ec8917ecd392857c81420607f9b7a7cba
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWn6q8wyuXsqjnhMgeiCl7G0nehbGZpbD:R/ezSC6vUzPveHjy8Dmg27RnWGj
TLSH
T1AB755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f06dc7bc3bff11128eadff625168622b1297174cb92b65b1d7b29054cdb6d56f
MD5 d26f532bf7530ecf09c218bbdc6acfee
SHA1 93a2fdeb8f1ab9a643896137eae9018064e35cfb
SHA512 9dcfc695a57cef7ee62b5db63f31b3b49bb70bbc0385f2eb2a7a468b0bddb9b1149f680b15cf5b5a465bdeaa8acda9fdae040d6b061ba1b6014c81e2a2f797fa
SSDEEP 24576:eVbqPb88hv/l+YisqjnhMgeiCl7G0nehbGZpbD:eVO88hXl+TDmg27RnWGj
TLSH
T1E9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ce5997a2b08a245fb2f25df2f3a55020557c2e02e1320c659102ebfbcc1cb479
MD5 ac721f484ace018f7100d1744932f418
SHA1 36f430ef5fbee9fa6c68fd2147ff89794f1b3e37
SHA512 b5e63859017b9278072773ae1db89c101dd544976966c3967d4688ac0b5f8a0cc66a91959de56e795e8a33f7b0d03f023bf9dd6787279924e621a9bd5901a23a
SSDEEP 12288:1LpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1LpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1644523BF964C50CAEA7608B5C3E9F11EAC137E56982008536A637DFEE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 dd631956632bafeb241f458027f031b1896fd77846eb84bb3777e06278a84d87
MD5 c22d5ed43b852f9a1fa5aa2334ab8ad8
SHA1 d72e28b606f7df2a080cebf57baefe8aca0cca3f
SHA512 52d32c3fe5afda3295805e1bcfe98afb9ca8532d1fbc582e60b93e38a57791fbce8696c7d676ef478fcbfb8c8f0002d96df889e4f55c7167b32bab3c19fee528
SSDEEP 12288:xeBNUbTVO86UqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:xJIUqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14365CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dd75bf8e66da527232a36d6f0e8d0091d3a7a0378f805308a40ebd42db0f8036
MD5 1f7a9304c9f9bd987b932c7a436fb359
SHA1 5a857a2017ff1085f76ac59f3822168ef2335f66
SHA512 83aac7d1131ed45c0d9a41d59f97cce5d9bbed9215739de79218799b38936f96db09d950bb7c4edad1075e76c654e2beaf37104655ae02fc416b7dc89046aad9
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:KQvGAdlCEL8c/DRNw5C7D527BWG
TLSH
T100266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 fe861fbd21bbd492624f1c2b0c34e6b92637217141c3912a21bb20d568fff303
MD5 b134a282f16d9354dc6ed9d2eeefa54b
SHA1 959ae31aca96feb83590863e2b7e43cf02312b7e
SHA512 de6b568aea84d01cfaef939bb338bd3c407a9a46861cfac38f8ec8892e0af063c0fe0e5bf353f4a499fe08665e739be973ec2cdb19bc01b7b2d23978391bb524
SSDEEP 12288:zAwSfxL/2Dc3RDLLmt0LDQewsAj8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:s0ewsAj8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f52f84b329c95c581a377b168d33f388deabf3d8039a270806f30b428555d54b
MD5 499efd6c3fcf4c55b84ff218651f7983
SHA1 ab754302eb53bc0f1ce4786666599741bcd71c65
SHA512 3d856d65fb104021125d20133641397383f61c54ac522df40ea2a695d0ad575d0c9e06b8b2e6779aec038e3195cd96c04b5707ce52b6a2d0352fb93ac3b3929b
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQVQBWG:fUEtQevvqc2W1cpV2tI32XB
TLSH
T1E1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 48c854de7d8401c5a974f2204822fb7152dc4cde9f7c7f2ce5ae514c187c1397
MD5 8f64361d3a757da39c05a6560d1d6c5f
SHA1 ab64b201ed4eb930866bc4d78cc1b60f6fa6bd9c
SHA512 fefdb05534382656219d8b1f31c5f6a98fbe3b651f0826e7bbb6df908989698f5c4fe656be814e92196f0d6dd6d6183a320a53b63ba8ccaf9817682186379a84
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/zIDmg27RnWGj:JoquVjnmfD527BWG
TLSH
T156D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d1d077a4bf36eb7c24b843647968d2486eb8c04502fb74cd334e9bb332317af1
MD5 3066cce191ab0740fb767da501673616
SHA1 8bc153e840a18d3c53d1169a6f55b5d2f01045fd
SHA512 c132c2db584cc7cfde7629c1c763ba3ddc906fa311330810a48a0f873ce842e94105ddd869616601ce65fa601eee97445f60e8e00e55f78379b7b2b5b88306ef
SSDEEP 24576:yAhGL3IFoiwtA5l7S53LsqjnhMgeiCl7G0nehbGZpbD:yAMUFoiq5vDmg27RnWGj
TLSH
T12C359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 90f4d849cbe7a7c1ce0430be29acb45d1e148e474a3bc1a494d4ba3c9d69006a
MD5 01c75799dc037dd4c6a210c920fbd561
SHA1 e975f10c88b69a149cd5eda3fe6a0ad34c782589
SHA512 69a3a5c3d0d4905fb2b85f26a43efee1fa42e1d13b0fa6a98096a3fd989dd4df574af9dcfef4ac5bed9c26f5165a78c87ac5e58f3f41a7d5c5cebe77394a3de0
SSDEEP 12288:tmw5HEjsChNVBFgl0WDm+C3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Iwu4OWgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16865F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a5993fd21cfb18dc694d6238c30ff5b0562faf9fec8e422285508e6e31292ffd
MD5 4fce64d473797687ea3a2e118c944a2b
SHA1 08adb01c2b7b57485a3be22676ab4d5b747dda9e
SHA512 cb7c97247b3ab4e6196fbdf7e2d6a2b1c87e948298059e0e8b691800c3f7f738a1f1101af3a4f5fd13909179c5f9d4776d7250271ff279134e1449167d69cfb9
SSDEEP 12288:9eZ1IyMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4Zu1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA5512AA239820FAE163417CC5E5D609E7333C62673043CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 55efd657ffaf640e2d0c47bfe42c6dc471d8e81243166e3f95ff5c9d2e8f949f
MD5 0fb2b4a6f54b0f3ef716849545e8d62e
SHA1 adebee9f63ef015ac76f4628d815df3dd506bf9f
SHA512 13678e7400face4fb68843ecb8b5be9f5625a22eae5c783ee46a604eb92ee65821d23f9a5e974498b1834ffc067d1e9b3a4eee72a87bb87585e3557cfbcec2b3
SSDEEP 98304:NQRQyi36YOcPbLvw2gAf+PN3SD527BWG:kQyiKa/X+PNCVQBWG
TLSH
T11A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4ffbe003d9b0a3d24982ce46433161e047723e9c87ff92ea777d4e8d1cb4a8dc
MD5 2b9c001a939cd393bb346adf01baf3b8
SHA1 dc1664a4d252ee8cc9166e265856fb55a80c4960
SHA512 448ba582a23d44e1bc0d065124d71afdebba6c308ad5ae81f9d79b1940a0eea99da92a9c76a101586fa751145f6963c868ef9814186e1e6ce4572ac07aeb9367
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3SD527BWG:XQyiKa/X+PNCVQBWG
TLSH
T15D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 59ab4201bcf7b245ae28c90f70194590485c21a07fe0c9be2f25ede613c85907
MD5 7090cc8fafbcd8ce6e880b193d73b6a6
SHA1 eff4986b12147044553c458dd1e02798bb364499
SHA512 9231857e3292e3bd0b9994c94488abdb55568c24122afff416ff16cbddfe8110d6f1ad78c4d6c2a9a63a384a823129cc5256c572914927fced5bd5d7a4749583
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0lsqjnhMgeiCl7Ge:g68Qg55nhceWu7PNU3/YDmg27RnWGj
TLSH
T13CB55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3c67982737c9fe87e9176b02a7785e36b8b52ffb5d47f05a3bf3e5b2e681784e
MD5 59c99644478ee22a2cf8f230fccb1eb1
SHA1 22ca204e77adf1e983279474ba03dd69829122ce
SHA512 b600b0bfbfab191bc6d97c202294f39ee67cb9ed70c08a0749a45dab4606154f772ca6e3181b43964e60b81972ef1cb8d875c9ecd5d2a85b74cdd16532980ac0
SSDEEP 98304:Uy5112gYy5azzVvt69nLKnhZtD527BWG:VLIHEWhHVQBWG
TLSH
T1DA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a8817c6698b70f4ec10ba5e5986883f5c7ac607caf1816cf59391f9dea0d3b13
MD5 751479937cfa916e5f5c0cdf977cf1cf
SHA1 8a3c9a743ef54857cac1a5e9ce9b84ec34a5acac
SHA512 e5e11229d77c8f0d2a6870603125bee673a9ecd4e577e3ba66e62eed607e7b060b38412e177fc05e84aec93e0f9b26eddf9f7250df24f5840d6c757d09eceb73
SSDEEP 49152:AB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glqDmg27RnWGj:au6Jmdxd2dqD527BWG
TLSH
T14ED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4e4348ed5fbef99fcf778e3cb44b178302778c925e417778d78ac58961c3d2a3
MD5 2c55e23f5b0d948e97f9442d98a5d378
SHA1 9f0f847a8febcf1ba1607cf903d3e1410cb53351
SHA512 3c235a260baaf8d5b6c89c83de5cb0fec944a807d54ba176a93d3d54bc7b9ce4ea2ad27b1c1451907e28bd82095bbbe1042fca041ba23e67c45b5af8477a3ce0
SSDEEP 49152:Y1hpsNoJpF1A63U44CwH7R4xeDmg27RnWGj:YmifPWRfD527BWG
TLSH
T16CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 51219f7cdb132bfa00dbf1ece1a780cceb24b0b9539c4edb8c9ce75dfb46fe13
MD5 d0cd23c8b911ddac4386dc0d74b80aa2
SHA1 8098f6b1a2dcaeb9623e6511aabb6295d4b7c5b3
SHA512 cbaf91c2274c88014387ccdb1cb9755d2799f86e6ac07ff1b70adbbfda8e44a0ffd925d7c6235ac32cf392392ff38c1feb2580e7712dd0dcf3dd9634a15c6cd2
SSDEEP 49152:5SuZQIY0Be2KcRVtOnks6NMHqpDmg27RnWGj:X5dKii61pD527BWG
TLSH
T1F7C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9f2da810ed7df02d71793cf290a0a866f98b831d754566ca17e978125f406a74
MD5 8c5a8976a5210ac8cc09e4b27f90b49b
SHA1 bf18a875fc0899c116d63123c150f7a14676b568
SHA512 878fd20a7da12b7178cf3081c633ccedc4e6f9dfa26cba4d67db141b23e13f29985461d4a9fb6663c22a06eb365963345923d9de9a377389bbcebde73fadc6ff
SSDEEP 49152:ZhtSn8EApI0fig3giDn0AP5w6Dmg27RnWGj:oX2imphjD527BWG
TLSH
T14A95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9320a2ef76290e9de96ae7a01f1b060e447077e1808788fd736eb403af126b28
MD5 c830f9d2a5c829035b3bdbd01081d25e
SHA1 bd3510843270837f915aeaadaef1fbf2b4fae4c6
SHA512 93f57211f5a539e4c25ede47a9f94a1c7da86e08121e6eac9884a72a4b601dfe17b607a312ba43e14470e6756177d1ef04e2ddf7e112c4a954735e40cea46e4a
SSDEEP 12288:2RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E24523BE964C41CAE52648B5C3E5F10EAC073E5BE92004937A9B7CBEF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8537b25a7729c0b6e263be91335832fa17072d53cfcc714a651ee631dc3f685f
MD5 820bf42503b33701b60a9aba33d4536b
SHA1 bec67bacc39bdb43152afd2f1b8e9333bb704ba8
SHA512 5b5df080692afc2b32226505f5dd876e4640f9c039381e212e7e052db575e2ad143b9adda70470691c0cc2e666098786d559b6219e8f396519cc55fa7b284191
SSDEEP 12288:1YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BE964C41CBE52644B5C3E9F14DAC073E5BE92004837A9B7CBAF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dd353a9739ad3beb53709001af1e6bdf7d30fbdbd268d61416da717a780baf3c
MD5 349f1eeda98889f61911d3c353c861ff
SHA1 cecd496de799b72c343628e24354a9ee725b1da9
SHA512 76bb5ada5a4ed9b06d29fe43dd97f2eb254d1c192766b0eb76ff44ff474171b65352b2878323b5d83fa8390ed7f3532e3aa0208612fadb6b5cbced463b0a8f7d
SSDEEP 12288:LSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1734523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2d630ad1644e515308c271823f62c2bcb2ad2e284f509dea4a22e72a1fbaeefa
MD5 4e6c70a1fc70195946ebe7f3cf3cb77b
SHA1 1374b6f72bd825aa9ff326540721d09b8a1b7deb
SHA512 ce8e5079c387e4ce837952aed816d03604c7e9b77d55b103811a2d00877c6ded8238dd3e7767c42afff82222fea2d13c35cffac28004f1ba56e6e6a18f2cb19a
SSDEEP 12288:PVrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A445236B675C00CAD83685B4C2F5E11DE8237D56EB3005DB6B532CEE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2bbd9bdfebbb82c0d625074999f53f4dd237968472c4cccb0de2110e4085647e
MD5 87588f4814bc49ae66001107b3b372f6
SHA1 36d490a7a4677d9f15edd949aa4abe8029f7a734
SHA512 ff66148f2282c905541ae6f7702823055c5e5a89c4a4f13f21e107b6c03ff6df98a33e683fbc212c6f5feb27038dda36d0e750e92ba36bf3671be4664086d266
SSDEEP 12288:RjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F4523BE964C41CAE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 72ae5b85d5362c223ba826417486db951787d6ab7dbcfd937c4943dfa1b4378c
MD5 3c460153928f981f62180f4086a9f6fd
SHA1 8a9acb045b3d3d610e4dff0de378ca1a66b0fdae
SHA512 f9853db6bb3ef305a94ecb9162384c9ac1683845368713a4718ed4e50373d38601680e02cb8d09fa4de98fd24fc8decd12d8035c81788f6628e7d6ab9132be13
SSDEEP 12288:jEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F4523BE964C41CBE52644B5C3E5F14EAC073E6BE92004837A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4ac882961c8342074a4a0a7631f7d628b3ba30f9ffe13865dd77ad2adfed9445
MD5 d8019728fc08c00ef427974df44d5a75
SHA1 8fd9f3799adab78b010bb6848088fad3bfeb62e6
SHA512 6a6e5f81a677acfbd7a29cf5a0ef82bd494b78353cb61fb0d3509de3931517dc82b94117bf9bd79a3f474daa35a712a3ca2c59e602b56f30dfc65c622458b2a7
SSDEEP 12288:GQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF4523BE964C41CAE52644B5C3E5F11DAC073E6BE9200483BA5B7CBEF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 de8522042c89a04b591447d72879ac2b1828262ce06e3e2ddccc7983689667bd
MD5 cb77e14222296658eb170e506f54fd0f
SHA1 febe3739d1ca351b6257ca3ec38a7cfbba3d452e
SHA512 ca4b1c2ee1a953debac1834a48a380ae1605801135e19bff06acda8dedf29781ec12279d64143d28d3f035cb128e4921d80aac880c4a8bfd381fd2c42e1f3253
SSDEEP 24576:0ZMRzFVSO4sqjnhMgeiCl7G0nehbGZpbD:0ZMRzfwDmg27RnWGj
TLSH
T1DB6501A9B39418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6ac344d3e9791e4a51648d1d4c280ec135fa8781d9fbc836a311a33af6caf2bd
MD5 de46e2142b69f10d0976e0cd00439f81
SHA1 bc55bff5ac623a04bb33186f195fd68b61b6dfd3
SHA512 c7a13d74737908c19ae9e522d2b24a0bd33fc02ebb6e2ae49387a6341a79b9121de204cbb24fbccd83c5cd47b7c4d121c657ede8d2694a977fce2935f5c86da2
SSDEEP 12288:FFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D4523BE964C41CAE52608B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e8ac83f938c7b3e83741612404bf122a4a645831614f2e23ff2504a7a287e300
MD5 0727a1f51eb853020a2c8b84fe3953f1
SHA1 575b11e190615a12829970a13b5e02d6ef44b89c
SHA512 d3d2bd43a79ac6da3174144f37a76502ffd52cb38245081f02172afeaaebd38a8f47f6d8a27cdaa850b3f39fa84960f37286d94266c71a44f621b8c746c5280d
SSDEEP 12288:w5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:w5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C4523BF964C41CAE52644B5C3E9F14DAC173E6BE9200483BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 68f3f1cef68b479be85d96c0664a2661c262cc1ea6676a9e317ed4ebc62ea10e
MD5 30c60229920fa9ff678a728c3bba00cf
SHA1 40db2045cac6eff33f753e6ee8aaa8b851ff8aa9
SHA512 20d3b0be07b8451da11a83413d9277e3a9317c0d2142ca733cde88b26be06c2d66597766bd16a8302185d95f6769098454fcec1dbf5c89d37309d7e51b38d6a2
SSDEEP 12288:DyPz5L8MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uzyMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18155025B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5ecea454918e40b14d0c45532e01a86f27b23c69847e53c64bbac36176370bb3
MD5 9ed5d33ac59bd8fd6bd272e3d5db48eb
SHA1 6c77d217edc1f2417868b1357d6b735cc1b108eb
SHA512 867e9fe2a9cb0fb86b29151ca993acf3a42396505b3c4d4e7a18a1aae58e158998a8439675d72b2fa28429bc9efb0e5fd0646a784da7e741f167655689ad8ce1
SSDEEP 12288:uFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1704523BE965C41CAE52608B5C3E9F14DAC073E5BE9200483BA9B7CBDF6B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8f91362cde0ab79a1f9a5a180694655a1946e98752826f1c2f1d771e5c11e77a
MD5 b2b6f3eb2f9879bda077a7afe41fb07f
SHA1 ed5808d355b332240e2c447817fbfe9fc3a099d3
SHA512 eb81668fb0ce5262e2d11b77dd4d2f805e2ea64d1c8408b1f6587abdd9f6da91183aeac2ef9d47edafdef7be5283b3bd707bf2d2c6f0aaba608e5ee24388f04e
SSDEEP 12288:fFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A4523BE965C41CAE52608B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1d5bf95c1b0fb4ff57baac927c9be5953b0312bf66193408a8568d5fa27a3d36
MD5 fb4db20483645dac08242f892ba38b3a
SHA1 e9132a3d19f03b78c834240ca378348b427d1282
SHA512 86ac2ed0ea88318c82021b56e8ef438a97441764ff027044e4093f646987a77900e43e8fc87e8f70e9cfa80a449d06beaf78000f1981909f5fcc9a11639b2f5a
SSDEEP 12288:MyPz5L8MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VzyMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C655125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8930f56b86a0672de8cb5f8edb88a0c1f9f122807e5b48894239d9337a34a04e
MD5 9695ab741578211dd5eacc090e637a90
SHA1 7c8f1de81858e131ab291fad2c8457f45793e1e4
SHA512 b9804d48a7a6c4a255e4b3be1fde2e0e23e6bbd6c89a53ef3401d4d4a64fd91cc4ec9eb824ede890066986e06316267d5c61af787a3026ba893aba5417d337d3
SSDEEP 24576:9TDaLl3z0zDCsqjnhMgeiCl7G0nehbGZpbDO:9TuLljrDmg27RnWGj
TLSH
T1346501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 04160ef3f49c88351af0dd3c059f0986ccbe8d98ce16edc778f103eb76d4c44e
MD5 4768900576000f7f7df83b36099e81a8
SHA1 99d95bc7e341b0a032b0ccbc98510375e148febc
SHA512 3f9ebe37867f44bf110ca865cee2d532c90444b1e9592a61a84650dee92c2a47b56f5a8febc2cacbcf6db08251e93d251567a8c9885bcef9a8eba6df7772c46a
SSDEEP 24576:Z3vd9CHKy7GZesqjnhMgeiCl7G0nehbGZpbDO:pvd9CHKyawDmg27RnWGj
TLSH
T12C75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1b6fa590304db7811ee27e2f63ad1342d58012e1b8d7825f5927d94c53d50f5d
MD5 82c761d2142ebb68fae128b116324f77
SHA1 02f90747e3a0e85994c2dfef2e9844569cfb3465
SHA512 72b13b233400018b6135612135410875be91e37e9aa04640b085a9d5dbbef882a83548c203ad6af3c510698fb05a76011824eb935d487754176d69c44b8b183f
SSDEEP 12288:YyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BE964C41CAE52608B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e3978b6561c5430b1c622f3599183407a764a8d84beedc88e773e8994843145c
MD5 02776a12f6fab2c941868883dcac2ef6
SHA1 f69c3f44306d7540eddb4b60acdaf53cd73cfc41
SHA512 6c55618ddadeb725694e5ae0400bacdc1eae5548ae356938bec80db2f38ee170bd67ec66c7b1452678d712c1f2d7bcf606b9a3cb0ebeef14307d66025b3e7eba
SSDEEP 12288:/sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D74523BE965C41CAE52644F5C3E9E10DAC073E6BE9200483BA977CBEE7F54584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1f53267a2d05393d165406d60196c5f48e3f5add23e30142dd03381aa9cafab4
MD5 5800ab7472eb05e307d43378503e9b6e
SHA1 0fda440b006139a806886aefffebb15d466c73f9
SHA512 73e325c939cdbe490f261c927bb0d839ea3bfb017d5dfe84e8c05899e6c444a246f3a1e2c389a7497e6473b62d9f3c409c648d3cd41828b2b10b64904d682d64
SSDEEP 12288:iPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BE965C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 194954b1fe56aa9bd5fae902051f9214ae19b1a914ac1985e7cc1285077f266d
MD5 d65b3fe422b93a3d19878da5e19d90b3
SHA1 7631c690b06a41a6eaef701f8ace577739a0c1de
SHA512 0a10bd8d21337d1b0bf543978b0292cbe0f88a4af1c63d9de1e38d08c60a4dbf42ad27f6fc987d6d1b406c208009c07275b4f720a800500f9e6708aca57f8b84
SSDEEP 12288:4FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1114523BE964C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDFAB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 27ad0fb5208e58dec08d1a8b14e8e19dfb50496f279636e055cf22ecfb47cef6
MD5 7186cc16e2ff994549d1952b47587cb5
SHA1 c84c9959fbfcedff41576bb9de5bd4893a789e5e
SHA512 2e2356a406c07b2d1b6605f27ca039c24852f82a7df7180cbd20c19c55263c857f0372b8b356d089d58c43732fd9f68e13c67f6d607783eae4a3061026f06dfd
SSDEEP 12288:VyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VysqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4ed311a4d710355370d1e92591639d56262b09d82df7c200518ebb4ea1f6f8ee
MD5 8205a1566b6860adcd73615f021ad58b
SHA1 10975e1fb25d4ac9e7822d8de9ac3f86cc27f0a5
SHA512 0b3add48b16899358baef3647e6274329db9c99dffed86c996d02e45d252d48f8f9e50f6c5928d2b974055a5c81581cf426a3eda5324c9ebc7c761cbece6e953
SSDEEP 12288:3dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BE965C41CAE52644F5C3E5E11EAC073E5BE9200483BA577CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 08a3743030233db435fdd052b68d38d1f72a9e2c287405b93a7555fbcb4ea644
MD5 136599cfba9d137a1e136a32ceb6c20b
SHA1 e10f3788d88895f70b4ce79311fc10981f2a4028
SHA512 5a4de83f93d723b7d9e602cb15a6cd29a9e3bbaafac33a5b75963737cd070b8466871cd31dc0cf485e7886951b89eb238ec5d1ba3a5002b76d5735eb67072cd7
SSDEEP 12288:pjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 98f75a2efc9587c4118a55783d6af6966a0f9b9ee3067723b2f171ec9f23cdba
MD5 c82dca1de7267e83e0361b0659b25c22
SHA1 fc14f31a74f94eb5129489958601ecbe9396ea71
SHA512 2270daf78bd7ce74d4283637f4c90ae1833c3394a0a9d5e3e00db9337adc083dc7b59962082126050b56893c832737ad082fe67706bfefb1790486f3b3243504
SSDEEP 12288:s6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A4523BE965C41CAE52648F5C3E9E11DAC073E6BE9200483BA577CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 1704f37f6431c5b35f48dcaebb10f469c45880dcd0488bf36c22182cbeaf6f9a
MD5 db2fa7bfa140eeb6689b0e788de3f811
SHA1 b6ec7c5f559687fff1d9ee9d4428f5df0ea9e102
SHA512 98051a998acfc6b97e13c4b2170560d4c32d7900538e7444c7059866c75639d20f6f180ca3cbb606360af0141835381fc394852b7ea7eada75fa2750a26ff177
SSDEEP 12288:VjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1824523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 69e91266f560e4aef2310c8c48295979aa1644901df772b90a38e1f90c88c790
MD5 a0094affa8c7914f44aa6133e09a0e4d
SHA1 2db70b6884fcb09eb24941d68caac0a4cadc28da
SHA512 74e8502f6f01db2c184f279ece40e3fdf417d317dbe7357b1511126a12db24219ebc00932b486b50aaf8507321eea1dc5b00a025c9f7ea60aac7a5c24c4cd2b2
SSDEEP 24576:2fwvUk9RX6wkyAIJsqjnhMgeiCl7G0nehbGZpbD:+MnYINDmg27RnWGj
TLSH
T17285D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3ce4b8d9a44616791873fce5105b6545e477daa1746f00c5d43261092d7baae9
MD5 3e417ea641408d910dc0850d7953b647
SHA1 fcb55fac05c5b680cb47592753fc204a38711a77
SHA512 bbd6081037f670a4c0b8e8991413ee40e365b238f27dcdde60888b02f1930d2741bbaf2deac3c70a6ef998ee07fe01c2fd232ab185ed11c0071b2235f0a5492d
SSDEEP 49152:NYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aDmg27RnWGj:AySzPyD527BWG
TLSH
T12B066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cc039df72a7c4b7ac7f52c9f52dca8ed268b195c801539d403b403695bbd643f
MD5 843bd052542beaa739bc618fd01e4840
SHA1 7f257f5b8c5e27ae22f013f77aa812f6f5cd0b61
SHA512 bb93e6d8ea8a470924e6980e7982d6b5d62f1a46695fab682cc4f643fcbecbd6691ebc0611785b8d020be24ba5f9b8c5b790f081a0927aed8f25683fb7be95bb
SSDEEP 24576:E47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYIsqjnhMgeiCl7G0nehbGZpbD:E47JUQjTirIhCnDHUPfF/qDmg27RnWGj
TLSH
T1E565AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 00b4bfec921c54c7b6e8085ce852227264bc507f0c2591f0fdd7cd490283eb3c
MD5 1878f79a5c15d95ee32f15c9d7e17a4b
SHA1 3839f2fbfacfce5ef513b948b58a4d551e55ca1c
SHA512 b51e8adaf163d7fc30ae96f703a2754920daebdeff8e49cac0ccca707ff309c19d4acc4c87b363ae9e31c2a1b01ce290c2063f950c54e41e4e9626de0d7ea0da
SSDEEP 12288:bbsf1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 90c639752f11bde039412bc2ce7394fd005e2ba402119f9d386ed0096b447239
MD5 610b2ac0679bb824fb96868b76a867a2
SHA1 cde643990a0b1d6b501b57546b190c467298edbc
SHA512 899e00d7af88f2c9d9670960dc3abdc2a76d4e4b265551fb8e49d98e92bdbcecf454de0785a59525724e603f837ab935efdd2c22ae19f928bbc921e1d89abc56
SSDEEP 12288:/pkeU3f5z+JRGo/puPCsH9F+zLDMyUgP+VmjARMaxwfbS7:/pHUP2RG8J69F+vD+SARMax827
TLSH
T153452840766AC74FC6AD84325E32D5CCA7707D01EE456F0373C88B3F9576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2d64884af90700dfc44a50d197e979c6730a2783e47fa04337c48bf5716b497d
MD5 95a4ce31b4c74d556c61f0b2a1af7742
SHA1 08be3ac206a82be3160211eab4d4541dfcabf626
SHA512 81ee91adfe1e8d641e937df6de1ca568e784ba1b558c393ecd1030505437b967511acfb641ec9421d04353e2345995782e1b627afe7291d846d44381cf91f2a5
SSDEEP 12288:3ekNM/89ir/pCO9tkyH5EBJZGNHWVPHdAR:3RNM/vVWNd6
TLSH
T1DA65E9816437D38FC1FB6032072A5B4CA764EC06B7496F26B3C5453AD86AB25A4FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e92498d7b5cf39a1aa067894b864b5900dc4743091bc7114e4fbc2d13b89d01a
MD5 07d70eab9ca23acf8a24a2bb173ed380
SHA1 b7761b5acd77e93e9fe1b70c78683ad55996d68e
SHA512 59af90c547c603032362d20ebb6f4256066d4a237d9e1da20cbb56f32530d8c73a28b8f9e27f08dca828d6d6954334eec7bcda6d7f05f5f53717debdb35f2de8
SSDEEP 12288:T07NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B545237B934C518AF93609B482E9E12DA80B7E669F1044C3B94778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7fec40918c769f0b2088a81c3226793168b84e1da6b5e7d0d26209947c572f9f
MD5 3ffd756057bb389fba8823250068d2af
SHA1 c194694073d1536d24f65beb107410d4f9fecdb3
SHA512 cdef895d277904fcd5b2ff78c5dde29c681805878adf1ba13030d82d6d4f4e3b3a6de90e31b3baa66bce0b039121b5b555915a35055f4143e35bd82d30ed6c3d
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYXsqjnhMgeiCl7G0nehbGZpbD:igb4mBIBhGF0Dmg27RnWGj
TLSH
T125659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 00342b55fb46f92e9bb685b1e7b66b97f49c4701ffab4a80ca8b8fa633e6b8f7
MD5 fca9fa5443effd8c86700184ef433b38
SHA1 8497d8d22daf0c152fa1d4f17bd19ef39054193b
SHA512 cb04d09587f461116fe5900a70781c13c5363496fdb26aaf8c949eac73a0f6e721aca277148dd0987eada674fb00c810de82d92300bda2f529261f532724c963
SSDEEP 24576:2G88u8FpJqH1bzria7/m4sqjnhMgeiCl7G0nehbGZpbD:d7ZFPqVea7/TDmg27RnWGj
TLSH
T15B85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 60c7e50ef045686f389251d5eea9ba46949371f9fda965b21ea7cd7014acb4cf
MD5 7980d74029aef05ad16092a0d682d36c
SHA1 717b7f05d8249a9746a7001ca38e314020362edf
SHA512 fe61b41abb2a0a550afa54e738bfb04b7867907dd35f95baf409546b8396ce99e48f2603018194bbb40a8e614f441dec2facc78aa51dd3679ed716532ce64e7d
SSDEEP 12288:1HvUrBFrEjwaQUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:1PUr+NQUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13265F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0d1eeae3f3ca4d9beed5c7b28dbbdcb54728afb99a8e6a3ac6c188997abdf4a0
MD5 f3d7826ac183d501409a41829e3f354f
SHA1 1cf72e3a8cb2872b66e36edf6ca421baab37ff1d
SHA512 7965db99b22a1c18636671b5199d6684ee388926e76aa8eb075229491bc83e9914a80407602e2948e32b4c3b0279bf753222f3948fae10220d8f32ab5f8a8ccf
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgDmg27RnWGj:mG05lO43b1D527BWG
TLSH
T17ED5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9cbec546eb0099e7f8b8fa788637f9d74b4a32b3856971ee6ba2741039a2bb33
MD5 59d020807c4dc8da4d0aa3157cce74c7
SHA1 724e65a70fa4ca8819ccc0ee9a181a9d081ebf4d
SHA512 a70491a83a9cc5d739de2b639a8436be4ec8eb4301119bdd1f8363623589fb3b09b9f6691763f5e95950224886b10145cf459a257830f0f011f4b6d3eb47b347
SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnWsqjnhMgeiCl7G0nehbGZpbD:ha5POZ3BJt2pasx2+mYDmg27RnWGj
TLSH
T12665BF5EA7FC01D5D179D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c38ebdcd470b7219bfeb7cb72fe8951af1818ec272b0310dcafa11f24592e9d2
MD5 7924dd9686a59c3aa9dee1ef36e03645
SHA1 961841e3f0b66f5e19b66a1b82a6a8e29cf99bd4
SHA512 d9d4aa6f067c72eb5a3373dfba3f0ba0f66e9cca182e4b7babcf8ef7d50b4ffd30556c7858b7a5d34aa8572a766f76356fea03c55296565752ad5556f6dffa3f
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7FkAsqjnhMgeiCl7G0nehbGZpbD:XNc/zEOVHFzDmg27RnWGj
TLSH
T1A3857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7015b72ea5500f39c7fca0070c037a26e39f6e33852a324217deb387830df46b
MD5 f82d5b663a08c1846e8274c7b0b9c2fc
SHA1 67a68e0e0d554615636c039c3daa24a711a96fae
SHA512 6506babde0b4f100b0e321fa984dff2761be7869040cc5f86424d460e4ae2d7558b29113ad16dc8ecf8c84df54a276fde7544205ca90f0a2689fb0f49288d02d
SSDEEP 24576:mTkNvNnaFeYhJNtmZBm6sqjnhMgeiCl7G0nehbGZpbD:mTMwBtOmODmg27RnWGj
TLSH
T1F655AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0b07cc8d0564620fa9fc61b14e1ec94144d1883c436b8cbbcce1525168a64147
MD5 00de6770a368441a37b67491bcb5003c
SHA1 9ff53e780f4f3911e96479f49df234fb58e16ff8
SHA512 9beb272d0faddb410fdc1a5b91552e116dac44240466edaa79b5b8f4877b6f2eaf9ed63244ca485d2645ca7aa8e973369225b4f74a8553329eddc71147981535
SSDEEP 24576:GD3FHshBIYQgAxsqjnhMgeiCl7G0nehbGZpbD:GDVHeBIAAFDmg27RnWGj
TLSH
T18F75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/300-354-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/300-356-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/300-99-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/300-93-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/300-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2248-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2248-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2248-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2248-104-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3096-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3096-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3096-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3096-358-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3396-20-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3396-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3396-21-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3396-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3396-14-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3412-253-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3412-63-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3412-72-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3412-65-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3944-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3944-128-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3944-118-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3944-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3944-124-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4152-48-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/4152-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4152-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4152-44-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/4152-38-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/4296-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4296-288-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4384-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4384-134-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4384-53-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4384-59-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4492-86-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4492-79-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4492-80-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4492-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4492-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4492-361-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5624-357-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5624-106-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/5624-113-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/5624-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5628-11-0x0000000140000000-0x0000000140E10000-memory.dmp

Download

memory/5628-339-0x0000000140000000-0x0000000140E10000-memory.dmp

Download

memory/5628-0-0x0000000001210000-0x0000000001270000-memory.dmp

Download

memory/5628-285-0x0000000001210000-0x0000000001270000-memory.dmp

Download

memory/5628-6-0x0000000001210000-0x0000000001270000-memory.dmp

Download

memory/5628-75-0x0000000140000000-0x0000000140E10000-memory.dmp

Download