505f885501a1e432948b4b413afce905d38e35279c5207347fb91db86216f577

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
Size 14.0MB
Sample260804-sa296szycw
SHA256 505f885501a1e432948b4b413afce905d38e35279c5207347fb91db86216f577
MD5 93bcb46e242291cc3552f29f4da5c390
SHA1 423a6963cf791ae1d28389ace21ed3b7b8d22932
SHA512 b42a88adf1148f0c889e13522801d0776f95fa0ec779fae14e7659162e4ce5f11dd6a628572644d8514404b34bb1cb08b6f33168b837bc2da8b92fd40e2152f3
SSDEEP 98304:MMmoXIjMTOdGN6cPs60ShPslo5gGC9AALHGOIcCFhXzeloomqrWETR9b:M+CUUShsd9b
TLSH
T182E6B3364578CAA9C1526837C4494CF693ADBC10C6B352B7D6443D37FABE4C2CA7E286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2208	elevation_service.exe
2528	elevation_service.exe
572	maintenanceservice.exe
4280	OSE.EXE
5164	PerceptionSimulationService.exe
3788	perfhost.exe
3880	ReFsDedupSvc.exe
2412	SensorDataService.exe
6060	ssh-agent.exe
2436	AgentService.exe
5452	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f573e087b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053b45eb32124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004aafcdb32124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005dd5ec742124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c492dd752124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe
2528	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4300	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
Token: SeAssignPrimaryTokenPrivilege	2436	AgentService.exe
Token: 33	5452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5452	SearchIndexer.exe
Token: SeBackupPrivilege	3880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3880	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2208	elevation_service.exe
Token: SeDebugPrivilege	2528	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4300	2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 5668	5452	SearchIndexer.exe	101
PID 5452 wrote to memory of 1252	5452	SearchIndexer.exe	102
PID 5452 wrote to memory of 4204	5452	SearchIndexer.exe	103
PID 5452 wrote to memory of 3096	5452	SearchIndexer.exe	104
PID 5452 wrote to memory of 260	5452	SearchIndexer.exe	108
PID 5452 wrote to memory of 4728	5452	SearchIndexer.exe	109
PID 5452 wrote to memory of 5712	5452	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_93bcb46e242291cc3552f29f4da5c390_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3788

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2412

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6060

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2984 2980 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 3004 3024 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 3004 3024 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2984 2980 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 de714bc319009d0cf852263c078481bf5e94718b945f19fe4b9f2ac70f353ac2
MD5 7c890f0b77c3263f85346ede65716efa
SHA1 732783f88f27908e59200e280292e236b78bc39b
SHA512 57a6de8c1c76d3a7993d6d01452da7e1fb0eb8a58a877545ce7ef4154448ce0c2c09f64a1d69af8a3135346315eb78d071867a8b9f96ea7bf85b449f5e03ee07
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAm+brLC2hTR9quLB:x3q6HjBRmqrWETR9b
TLSH
T13DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 cdc121f3f97269e993d0bdcde9b403f20c4188e1df3cc3c5ddfcf7a19bbc87d6
MD5 4abc81df3a2346ecc22df3094d9a2b0e
SHA1 e531398913f7a0fb811553ed60b5fb3e6376f9c9
SHA512 bb9e56c6972fc160dee16087665773a603ec4211d572bb4d4e48bf2dc896e634438fbdc1548c696d683a646763eae46036060a2d13d2b9c9d7896a2084a3e470
SSDEEP 24576:SXYfDtczA1Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:5tc+m+brLC2hTR9quLB
TLSH
T13105022867E408F9ED6B827CC9A2C401EA73BC914760E78F03E499651F336D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e80bb3c68571ffa7c9c1da5899d0e59b84ff645c31384236ccfa4a2a12a14743
MD5 7337cf4d7e5651142108ced9c7c38392
SHA1 df0b24e15643d90f9789cdcc557dcbd8e63b2866
SHA512 8b3951e1258f37551a3e249837c4524509988006b7d22196b8ce582a3a6f42f8dee4128c1dac701c6a8d06e78abb950dafc466b8834fccdd5af0bf1acd7f5bcf
SSDEEP 24576:Z0Le5ji0hmxirMIRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:ZPji0AcHm+brLC2hTR9quLB
TLSH
T188359E15F6788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 464491986a0fd39520f077d9ec9d55b0b86bd4688d723d55bc06f0f56c3adb1f
MD5 2c97885f6b424ac91f9e17fa07f9e40b
SHA1 f555785c6f6b6f91fd42695314d9d666a294fb44
SHA512 e89274c9dba843459bf823f0c002fa3675d6e0b33d9b5b95051e5e0dc98e4fff89bdb1c24a4da16b730abeb601ad31c8bb14903ab620e37781fb68b6aec2d10e
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyuORmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:O/ezSC6vUzPvxHjy7m+brLC2hTR9quLB
TLSH
T108755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f0bdc4a8b2f947bc70e6a7f6dd421637de0588481f77a80e33aea5ced77213af
MD5 2aae484071862fb0019beb8bc63639ba
SHA1 f27aef6005239d460384edb7986409bd344e148b
SHA512 45e7312f41f0b4d041fed5c47ea4216c324768a82e61a2be5221c1e8b57d8cdad4746ca09762dea65311390d0a7fbc0a3066af7e92356b79925c5f23c116c6ce
SSDEEP 24576:pVbqPb88hv/l+6hRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:pVO88hXl+Mm+brLC2hTR9quLB
TLSH
T1B055AE65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 404fe832ad9c3d9ec61e98c886c7b2f7ad89d75df9e5804118b2a481ed4f07cf
MD5 bcfa4b77ae266c48125a1d17747f9a7a
SHA1 7e714b049fb237dca9281477efa15e463f8d34b4
SHA512 6e3a514db62ea4767f1e93e4483fc77c431174eb06871bcc907ffce217bb1b54f6febd19d9cf6eeb4d509bb7dbfeae278acfe75f039d9e33d9f7b3277ed95237
SSDEEP 12288:tRZWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQoN:tRkRmlh8t0D+7y8G2G9yL0cMoThTR9P/
TLSH
T1DDC42318CF6D0082F35FA2B1B2E198D6997DFCF1EA84AD0EF0C17DD01674CA4962599E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7d6b98eb5ca9ceb7d8051fe8c516eabc3588d2df4693c4362d23d7c0a036aafe
MD5 6d4c61e9365fb5053eb956d5f291b8f8
SHA1 4bd2e0ce3918e288be6a4ba0bff73ef5fb091320
SHA512 47ca1ee5073d21ea14008cf1059c831fcb712169057355f82d655ed2d3e1513f53a64e9c5aa7f190b6d2393e6084662aeafdd32a14b77204d652d0ffd53a1924
SSDEEP 24576:lJIUJRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:lJIUJm+brLC2hTR9quLB
TLSH
T1D105CF3BEE28ECD2C27E9DB85791C640D77278704F51A3CBE165824E9E239E05E39C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6c2306c2b7727277f18fc5461174c135446ebafd6ce32aa2a9871b9d7540e494
MD5 fdc4e0a06af6935535c9c216800656b8
SHA1 5361511bbb18bd93b1ebdd43ee40a0081e8cbab4
SHA512 8db483c253c6b682254b636082b5e81f6b441584c04ca7c38e5001799a2ed2c7e9421453b534c3be604208b4cff60e197b4ad2a4af5f67fe37a76d04a243c9c7
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THv:6QvGAdlCEL8c/yRNw5CemqrWETR9b
TLSH
T158267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0bc0cea9c46a87292cc5b2d9816d8f48077c369a610665e356e4fb06953d86c4
MD5 f7c863d19302d92a4757fc670eb5dbb2
SHA1 aae2719ed64a78e0d2292a2c5fe9e4afc2eedd55
SHA512 9ee890a53826e2cbfe78ef609f877cd9f4d056e5bdacc2a945c856794c230b7e4c9230860f0ae260790f18a440313555c72c0c7901f3a1fce60f4665b8cdc738
SSDEEP 24576:odewsAjXRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQoz:oljXm+brLC2hTR9quLB
TLSH
T1E415EF31FE74D032C3BF0DB22B62C716587DB9604B511AC3E3A89E9D59706D22736A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 848246a54deac38c7b90af60e61c5a76b7680906259fa97b30cf88bcc360fc51
MD5 0a8e01c07d0ea5e66811beda9f9bcc00
SHA1 2c5fa4f84bceb6bc732703a9b68f49c296992c60
SHA512 540b8b26f08566dc92c954b2907699d97e0ed6cbc1d8743f1900b42e8df9561007259063e92b4af4d71492654ea5c061bb4fb6388743006cb56414a99e886cf8
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZ9b:HUEtQevvqc2W1cpV2EI32n
TLSH
T1DF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5162bce2761859a2532a1ce96104d6a09c83f8873413ab22a2e77e0e05e37bc1
MD5 e2e332f93603000606f56410bb1e7a93
SHA1 5cdc5686a2cb67a7dd5831034722e9bf206a965d
SHA512 ca90387fab68385bf0d64979c946dd44886097b71902facf630d7b9fce153874ca5e25c9ee9b750d389a1793140b24debae9dddd17daf8180588a16d5bf11fe1
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/z3m+brLC2hTR9quLB:ZoqtVjnmimqrWETR9b
TLSH
T1ECD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a7670cb23b103a6c83b3a676902a69f8e61e25630d9f46c4e87d5d8600213592
MD5 2c17a955aa057f3437f3357554d55c72
SHA1 6068beae062ef343898d618386b03427646df71e
SHA512 f39334dfa20110052c74a3b34b3e4ea5656b2eacc37a1d147bc0a780b063db4835eb0411204bbf8564070226e3c339b97931746cf1d98601408a0a7cec4ea397
SSDEEP 24576:pAhGLJIFoiwtA5l7S53CRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:pAMyFoiq5ym+brLC2hTR9quLB
TLSH
T13C359D80EBF945D4F5B3AAB899B68571EA76BCA65E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f38833a1b9c763b940174ab518b7756d8c065bafbdad9f3d516461d69c65dc8a
MD5 d9cf78e1e410cfaabb4e6d7c317d18cf
SHA1 e0495984b0c097c310ebc1c4247b413476c7bb16
SHA512 e2c1fff1906d04e2caf54efd86ff7f39123a3ddaeb0b8925c2d0c14fb7021d16046235cd1c3ded954bb230180a4c11822010e733935f063e0ab7085a9d30bb62
SSDEEP 24576:mwuoOWbRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:mwDO2m+brLC2hTR9quLB
TLSH
T16B05F14976A80CF9E5679238C193C536F7F2BC112A21DB1F53A0C65B1F376616E2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 43372466426ec6b67c7a2fdc0b3ae9cfb72f49964ca25494d2717ca3fdc77465
MD5 f659483fab3fd27b3f58186fef8fde53
SHA1 323dfbc2f6783cbb616ddb28523f253c95f76c5e
SHA512 e3df5fd57fdd5e242bfac97f6e0e63e8de5cf9bb8c482ab235289d3584a4435e10434bb515621239c7799bb65f96bc548d4a5b3ab8d9fb0f78975edef2662f51
SSDEEP 12288:XBZ1IyWWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:xZuQRmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T131E4224927E820F6E2AB9278D1F18985D7B2BCA2673183CF219056E51F33DC11E39736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 23f04bfa705a20a6460980d5fb3c41e6a66d3c237a6a75a95c16bfc0ec525c75
MD5 0cd66e5da454f84673317b3c5731dac7
SHA1 c4a0bba8c80ff187681525c8653f4583dcd22ac1
SHA512 0af15e520319ba854e58f87d3231d8647ac56a0c49a54cbe5e51672d1855bebb9ad95a071a4d85f3261cbbea79011a343c984280d7bf906329f6b1b2fc827f6e
SSDEEP 98304:LQRQyi36YOcPQLvw2gAf+PN3dmqrWETR9b:6QyiKayX+PN39b
TLSH
T1D2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0846db91df2cfabeca8d4630e28d3ad3e7e89d9a3175fc89fc7aad00e68b1942
MD5 8f7a01c39b1c37e032301af7d1959c45
SHA1 81ea41d083c8aa3d1271f3373916812c3a929cda
SHA512 682e4ca941afcc4ff7e248bfa07b77568965bb846b1f4d7b8d572d0f3bde7b2207ae8fb4ba6d85a668199363e7eb80a34ad0514023424589202a64372834758a
SSDEEP 98304:pQRQyi36YOcPQLvw2gAf+PN3dmqrWETR9b:AQyiKayX+PN39b
TLSH
T1DF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 04b1d6b75805721b8f0a5b62f2f02cc5619ca3b9f3a89450d6ae70766c7b4e2d
MD5 e50f793609eacd6b4568f54dfdcf9901
SHA1 17a1f23aa966b627e459c4fee2d9d5bd3524221b
SHA512 1a1f48dedf94a7201046760d75b44003de4c2fd7fc754f57effeca5a6bcf9bef31fdeb07bbaf9b559aaa140d714ef35932839c9f7f0b98daf9f622994dd293ef
SSDEEP 49152:Y68Qg55nhheWu7PNU3/Hm+brLC2hTR9quLB:ithWRc/HmqrWETR9b
TLSH
T10BB54933B2F600A9C04DE1769F46872196E27C75CFE0E3DB815172561BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d137ee40e91d19163437e24d3befa41468347adb1b8bb10b4defef7a21e344bb
MD5 26793ccec22e212c13d41b6af56421c5
SHA1 37677687851e1178c36a4ad626c1c1c66042d17a
SHA512 25fa7a89c5081707799e7844fc2313fa2cad43cecb3ae2a32db4a2b18cf63cdf5ba512dac30bda5a3787e5f7bdc70ea2e32d378706413e34c3c192fe4ecdbab7
SSDEEP 98304:oy5112gYy5azzVvL69nLKnhZkmqrWETR9b:BLIHmWhg9b
TLSH
T102167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c034a3be521e706447537ed4b9e0fa16f3c876cea80caf5f3f696dc596219c47
MD5 25b84755c5da99558838eb6cdad7495b
SHA1 cbec4b8b7218bf6a2a1fcb2c7a9068ed1497fd1f
SHA512 b8d9b4ed846df2a94a9fe6bc570330b49f550df0c53e44d7ada59d40515ad80e02331f0c6471b0087b61eb00d0be9c8074bfd59550f0ba8965a22a98da6a125b
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllm+brLC2hTR9quLB:bu6JmVxd2dlmqrWETR9b
TLSH
T197D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f4efd6ce2d3b9150d3143bbad428a90a8d9848c14c0cf1e3f1562e1537e21fae
MD5 363e09d87a283b0b806db17b5ec11230
SHA1 49f46af513858708522464790d179d236f0d82ef
SHA512 0b6c2a34e81f25386eade282e3132ce03065368b50d006264418326a2c50a61a638af79d6e47a7d9e98ba9c4f9cdb5fc446274c34b3703943e3fbf5bc7304d0d
SSDEEP 49152:B1hpsNoJpF1A6UU44CwH7R4xpm+brLC2hTR9quLB:BmifPbRimqrWETR9b
TLSH
T1AFB5AE13F29900E8D06ED17887569632EA72BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0e63019da3ed9aaea51ca917c5d20e7a912f4f2776568aa07ab7b9d2edbb9793
MD5 69cc1bd1802eae7465ebf82a0c862beb
SHA1 24da293d0e0436adad9192d09c320e916c32319d
SHA512 25f6457212d1db400cee3c397a94ddb97064c1070954a5c25f0886942ae6319bded43ad53df8ec4fc8543be9f0df194bb076cfa07530446b8151e8d728b81c65
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHqQm+brLC2hTR9quLB:y5dKTi61QmqrWETR9b
TLSH
T1F3C5BE03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cd48b55e9df71e342633bd97d798192dad24626eea313bf7391303426578a2ec
MD5 9249e6a683495b3f59c0301bd18c3304
SHA1 3c31dece14c12850239830310905fa43711b6c30
SHA512 e2a17dbe09af0e474fd014a1d2879b232d8c278dfa932b64a09fd8dad3996cf6365afa3924291b7ca497a18e20813c633e43e7d014b93d80f0b1d110784abae5
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5w1m+brLC2hTR9quLB:jX2iyphWmqrWETR9b
TLSH
T18C95BE13F2D900E8D05ED178C7468632E962BC160B34AAEF0A90B6561F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 cecd032f2f10235ac49ed654077694947f07e15fb613c908c05f27dd31f24176
MD5 a9ba9f59900fdfed67f947f8cb4dec8d
SHA1 2228e8ef44dfb5c43a49887c07a6adbe9da0ea28
SHA512 4db248f6866b2d650439197ed32655c50b86ece551fe7e93598801d3cffe2a288cab1594dcc893aae28752d8c36cff2a443406d514c22f7f3635fcad0414f652
SSDEEP 12288:4RWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:4MRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T171C423088E6E0086F24EA3F1E2E184C5D8BDFDE2FB45644EF1C578E117B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a60ac709d0b87e6822e4b5468b9516ee42b30b0f8f825446bcd606cc65cc3e7a
MD5 17105f59ede0fb8957ad8f79e195952d
SHA1 6e3952ce538d9939bad0a5011cee2535c9c514eb
SHA512 433193e7e7009b71e45e299ec0e7478c0cd9cade03fe34519b3c90732ede2e3c1d5a56e28c4d151afae9e39a38c1b7c9964e50aa16f3be8350ecb21e436e06ca
SSDEEP 12288:SCWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:SzRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T122C423189E6E0082F20EA2F1E2E184C5D87DFDF2FA45A44EF1C578D017B5CA42B259AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0f098c278f2701ee100c111d896fb2975fc243b85ae3746a9a8b5d0768f4c7e3
MD5 1e2c2a460af96e830fad6f785083fd9d
SHA1 bdbf427409ff76b77f99bb8e300d0a9373181a0f
SHA512 ae4cdb3598d036af6020b7dbd0e0516d7e346ba306465f3c8e0bc53f53cdc03a06d55c759e4e8abee6a14b9918e1848aaa1f53f57be8bec991fc71319c35b60b
SSDEEP 12288:S8WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:SRRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1F6C423189E7E0086F24EA2F1E2E184C5D8BDFCE2FA45A44EF1C578D017B5CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ace2eb369455a4d4efed24c97bb7dcbce77f8d7b9cdbfe541692762ba34c27ed
MD5 bd48744b5da84c3bc42b448dd4ac0ae5
SHA1 aa24c05fd465fbb9317dad32864cc004c6a68289
SHA512 b419aec35adecf5bc3b5713af193ce40037a7ce8eff8bcf9454bcbbf5c54fe890b10ab80cbdf1d260ef99f16cd90c32bbf09b4c771e3dd9b63131b06c4ada879
SSDEEP 12288:mVTWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:/Rmlh8t0D+7y8G2G9yL0cMoThTR9Pyul
TLSH
T1D5D423185B7D00C2E15BE2B1D2E284D5D5BDFCE2EB11A68FE28028D50F71DA46A34E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d9c971679b8231c5d3e1317ce9506f899794b161494b6808cdfb80a34e4742da
MD5 5bc62c4bf55882dc5ed3537679aa28b7
SHA1 66dd5f818b706e0d1abacb08b9aac7cfcdee2db8
SHA512 5651f263336585371e28f7359e64e4b84b7863350e3659b87cbf1ea6bf9fcae741e9ba9b03672f46840a549f59280f45610a07375630f230262e7e9c13ffe241
SSDEEP 12288:BbWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:B6Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1DCC423189E6E0086F24EA2F1E2E184C5D8BDFCF3FA45A44EF1C578D017B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 391c9bd41d4645709ab8e10896f87ddc5722b59801b6e98ea201da107c653a08
MD5 24d41b9ebb3e6db68873be1501985aa4
SHA1 051424d8eb53ded436a45ce99961dcc056704fc9
SHA512 6fb3bef18f55d66c16a857e4e02aeb1f7c3988d3af0e23f04e70cd39afdb4ac721ac44c17d46810a7219f95254f57f853e411deb1efde6160852a561735a0c3a
SSDEEP 12288:deWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:d/Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1B8C423189E6E0082F20EA2F1E2E184C5D8BDFDF3FA45A44EF1C578D017B5CA427259AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 da9af860c0938d23c247390f994d798c854cff93990b2f6439f2c4da09867111
MD5 6d340f67bd43d4955f08983e898506e5
SHA1 9404f4bbad0fc2576c27ae0a03ba4af49995342c
SHA512 af0b4efe77382d2cc0a2c22ff90d84fe8b99ef921eefa955d0b3d02e4efab0038ebbe2d1c4741839a5496620c03544748987c1ad5bbd44bd9977f19417ce4eb6
SSDEEP 12288:XqWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:XLRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T171C423188E6E0482F20EA2F1E2E184C5D8BDFDF2FA45A54EF1C578D017B5CA42725DAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b63935a358cfb9a4b0995d9f29a47e3ca5af3ef01186b4e5a0e1dd6723a6f2e5
MD5 56cf301d42181d854c04d49564cec151
SHA1 bf93b6089ad08110c06dddfd1b70690580aba3ef
SHA512 8c3d3fadf11ddf4383f0eb6514d61582e1cb87d8cfee20afe6e0a17755802148499a13a233546542c22f1c5c60773c021844d27b299bb70d278efd703cefbd02
SSDEEP 24576:oZMSzFVSOTRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:oZMSzfPm+brLC2hTR9quLB
TLSH
T1C0050294B36408F4EC67827EC9618946D6B2BC664B60C60F13E436671F337A11D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 5a33725e6a264cb562520562e73bcfbecb3fb13335c9b9743dcc7d31fe8f6476
MD5 fddbc6258fb670cbb0098b80f70d76f7
SHA1 7639ab87a92221dfbddfb4030a383315679b0e95
SHA512 62606a7ecac0bf5c8371f5417e9cb28cb01489b0b70b4c6a2887a96cb93cc98fee4c05fce8f55552bd203d2e06da3f4aa0ce0e17f20ddf247ec3287687aee750
SSDEEP 12288:lFWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:lgRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T13CC4231C9E6D0086F24EA2F1E2E188C5D8BDFDF2FA85A44EF1C578D01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 da121376768ee7db1761f8c1057942f1dc4072ab0eee0432eb6b4e3afb048d36
MD5 df9d76678ddf1edd6a5b9463ef55993e
SHA1 248e4e39e12f695af166e95dc9d64c43d1d98f45
SHA512 8da16b510c7697bef56e86ca47033b2d739b1c38121bf2fa25c556fb6073c618e8bd475637441dd786f0293b558e18c8e24ca32e865bf3e34c62ffdd7eb57de7
SSDEEP 12288:2pWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:20Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1FFC4231C9E6D0086F20EA2F1E2E188C5D87CFDF2FA45A54EF1C578D017B5CA42B259AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 fe68b084453cfa92663a9fda35b6ce7492356c8e604c47e2f8ff77b8a0cc4cd2
MD5 d3e0350d64f9098b8e3ac4a9a767b046
SHA1 25884a3561a33242e220ed9fb953a4e2ff1a4b75
SHA512 e1b8092904a54daf91362758ce45b7bf5bd61dcf60c1a1c80b1cf6883c2cde8a71197c891f26f3d989fc6c4ecd7d90b0af993775907df94b9515948ea065f3ee
SSDEEP 12288:DyPz5L8WWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:uzynRmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T1BDF4120777A520F9E13B9274C5A20942F775BC7257209E9F639016B62F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 737359d204e057768be3455544ca3f71301ea9d28d3f3af61bbdcabe32a9ba35
MD5 73252a7fe63fac7d44ee55b2d467b218
SHA1 47c9473220f7fe296622a97e7ca71aeaef920f4e
SHA512 9d587c4c950e7235828aca602a3d557ecae11bf4e9ed7ffaf098332eb44364027c09d7703aef0f72795924226fde4e87c036157c47cb37cfe9abfabc2ad194f0
SSDEEP 12288:RFWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:RgRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T104C4231C9E6D0086F24EA2F1E2E188C5D8BDFDF2FA85A44EF1C578E01775CA4272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5c881e5cae588637f42f19f24930be048de92083c02d33536a32e17637dc561a
MD5 e85190c07ff8d5b4d9d4ec8aa236275d
SHA1 6beb3a99aea6b71ab5189bca9951b6e068547a30
SHA512 0451fe3263e93490853607abe6fcfcdb17a3a7f8c1d756d339b89d26c63afcb173aa85af1adfdba7147c8890225280ecd6e2a4cd15b9ab42a81c76128ad6f34a
SSDEEP 12288:6FWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:6gRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T10BC4231C9E6D0086F24EA2F1E2E188C5D8BDFDF2FA85A44EF1C578D01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a6ed00ebff9b762ddcd6a6371c6c86da5828961a588aa88f5036e7620b5c4183
MD5 ae46bfdc03807503862d9622d877598c
SHA1 b2f82afbbfb74ff580f2a0580bae513c954439cd
SHA512 293ded7014a1574d600b5a0b2f76ee26c3583ce0692a8a268280bb7e20e47e2991aff81ea1246bc07cad2beb72d16a8d00b4ca9ef063fd3934469a65caed6c39
SSDEEP 12288:gyPz5L8WWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:RzynRmlh8t0D+7y8G2G9yL0cMoThTR91
TLSH
T19FF4120777A520F9E13B9274C5A20942F775BC7257209E9F639016B62F33AE05E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 7481cfb42d50f44e93be557c6b9dba74a2f2ada7b9e96ed858a8e0c41b2cccac
MD5 89eb9d0bda3902b2fd5881c2ec69a8bd
SHA1 5a5434fbc11e7079e33b1d7410837f464e1058d9
SHA512 bee30a82da815be432e6bbe38e6b50c2c5b4cefbd4777a2e08f7da39e4e65f5adaf6cc40e34317f59d0e014595586e3a484548c97f3e9ee930b185f06c111e5c
SSDEEP 24576:OTHaLl3z0zDBRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:OT6LljOm+brLC2hTR9quLB
TLSH
T1FC050298B36408F8EC67827EC9618946D6B2BC664B60C61F13E436671F337A01D3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 48d929b4c689e7088ad160838fe5a5467948c410c06e3bbf3198d372d6bba313
MD5 ab1fd34e20e184b3422db53d5a94d2c1
SHA1 5e4297547739cc77bc7390004e422516ed94e9fd
SHA512 00972253e38dd407e1f2ce5fa751146050528e6171e694fefa8e687e71ee9f5ad9fd82a3432cdbe6afa63d1bc02e1019e81b485d0d9320273a645ddd9c392d76
SSDEEP 24576:137d9CHKy7GZ9Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:V7d9CHKyaPm+brLC2hTR9quLB
TLSH
T19225CF90F3E810E4F1B7DA35C9728511DAB67C9A5B21DE8F03A4255A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 2f2b970884a9074a75fc13245f19e6b01080fe24a14ce1df0557ba8ce7d732e6
MD5 a18b764981703bdd7211d2f97f77b0c2
SHA1 88652f4f64aa61250f6939cb84dcc3a1b3fb0d78
SHA512 d0f3b5249e985f8fd28a2af0cd0b739949bd69e88c1f5faf1a45e03fc8749722fb5c97db761c0289efd865f128d562dc5c04bbad1c1af0865a0a829ad9bf1527
SSDEEP 12288:9cWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:9xRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T13EC423189E6E0086F24EA2F1E2E184C5D8BDFCF3FA45A44EF1C578E017B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 946e35b293f677729ca6bb1087906d65174a342b21da968ea0259bf2f9bd15e9
MD5 c88f26dd1370604cfe90db577ed62d30
SHA1 5bd45261ad383ba91789b93ce6f46374ccada11d
SHA512 f3cd9f25a9bb2fedacde9fd5918dc0760b9e2ffacc3077424113103d3b42b679b21d58d80f0aee03b5ba2ff652964ae3630184bafa58bbb111796b9c1614ddae
SSDEEP 12288:t2WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:tHRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T173C423188E7D00C6F21EA2F1E2E188C5D8BCFDF2FA45A54EF1C578D017B5CA426259AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 9de70a69a11a691ba66256fc8e8dcfb28b51d20ae546683472503520e34c6e34
MD5 430b751736611725e3cab8cdf5ce2dd9
SHA1 0db097696aed2b1ca109e2b408fc42b5476329b7
SHA512 a24e14e238c9acd29611dc440141e940864bc8ed7dc041df5e7c5d173cdb57820f472641930a2d7ce4d3dc1222b5febc19cef4317ff046bcba28119abea791b1
SSDEEP 12288:z3WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:zmRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T192C423189E7E0082F24EA2F1E2E184C5D8BCFDE3FA85A44EF1C578D01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 301237e1fc2a2bae49ffc0cf154d74461a4773035f34b5cc51e38a9c7251078c
MD5 27a707ac012710fa833ba8c0ece97c76
SHA1 93e7492e94a9f07201a8fb3878e42b4b62f6725b
SHA512 55cdf236afee43f61c36c6d8306d1a7a772851f502a551d6202f6c37bab1c6fd4c72d46bf3e5017a5b4bfef89ebffac9ce32362926be0f71c6883762d0eb70d2
SSDEEP 12288:dFWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:dgRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T133C4231C9E6E0086F24EA2F1E2E188C5D8BDFDE2FA45A44EF1C578D01775CA8272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 612e6c90b0a770231d94fe77fbede6300c7c1a7da37e21bed840e02728fe0f31
MD5 603cb08d8484ed928006ce3c76037aa1
SHA1 2f17873a789370cdc2ee0397dd3965707d31232a
SHA512 7373550463185b0c9b8aaea948c7577ef56b029affa5e3abc2f943b2f02b383ac9d319c0787c56fe66933827c2db527f6891a9d803c34cacbfc52e68c6e6ee21
SSDEEP 12288:icWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:ixRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T192C423189E6E0086F24EA2F1E2E184C5D8BDFCF3FA45A44EF1C578E017B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 ea67ee74f2d518f44dc5c001631e0f30c09b085386ac79e3eef5c0e79f8e680d
MD5 87bc3183b98d6b6777ca9866f27e6fcb
SHA1 4295856be2b947dec64f371e8e8113a7ae1fa43f
SHA512 1df82481197f29e2924152c9f60b7bacfb8409896d418ed540f033a511f0c1df09cf36a92ddccfaab5e8bdfeb5e74941e58c0432e19383994964ce11a932b599
SSDEEP 12288:EtWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:E4Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1C4C4231C9E6D00C6F24EA2F1E2E188C5D8BCFDF2FA85A54EF1C578D01775CA8262589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 abb3d2813bf0afd274e7e3c1489c0d92a2eca6dd6b915a44ac762522df2f4018
MD5 34ca44235bf8d4e5ef273e9dddae0621
SHA1 5169fe81be2ad6b44f8809bff2563b17a581cbb7
SHA512 e3518e994acbb78288770bba854af0a11b4dce100d5b6ff940a4810ab4abd47c38ab966952aedff1cf357dcfc83a99fa212dcbc89232e72d36b6f720b1c90532
SSDEEP 12288:BbWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:B6Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T16DC423189E6E0086F24EA2F1E2E184C5D8BDFCF3FA85A44EF1C578D017B5CA4272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 a37262248a5901133d24f39334be2468caf40c6541d370e9c30200b79f56a113
MD5 070c7be63b9510f1e0489447d2540089
SHA1 2fe5d60d6c56bf5ce65e428adcba7fe77b68adb8
SHA512 529544b60bca97b206f165a185537f4ef8a5d7643d757a9266e706f51e409f2b230bf10542caee0a4cbc84d81b244f399abe000fb1786fd291d782c33504318f
SSDEEP 12288:cUWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:cZRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1A8C4231C9E6E0486F20EA2F1E2E188C5D8BCFDF2FA85A54EF1C578D01775CA4272589D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 3eb2825adc6ed9c3e9574f8228601fbf2a87db493474e22fb1a1f9c5ddd704c2
MD5 bb5c2fcfcbf32264b4c83e8af764f3b1
SHA1 e7f40ef9ca15c3d125840a4adace74e765eebf3a
SHA512 ac5ea863e6f9f81007839bd7c060c30253b8583bac919071ddc59749be18ecd8470f43b49591250984c35e31f7f05748f26dbe894e348b850fdb6dc1d7abf43e
SSDEEP 12288:RbWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:R6Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T1CCC423189E6E0086F24EA2F1E2E184C5D8BDFCF3FA45A44EF1C578D017B5CA8272599D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 b557408495794e1ac65f085584bd85e30153f95c590d5b7410de4a2493ed25ab
MD5 6657601081a51b9ed425804aadf9edad
SHA1 bfbb7fc57e7c573c64ebf3dd25bf0c5b830e87a6
SHA512 811947fe782c9b078eb76587ed275530adf0b6fb324a7d98981821b78a6ff274cf8ea72887591d3635b3fdb16f9ca4f67c9f12c9f794b82b7cfd3e92fc1f0c97
SSDEEP 24576:Zfwvok9RX6wkyAIERmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:/MnYIEm+brLC2hTR9quLB
TLSH
T14E35D029EBDC04E5E177923C99B3460AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 25db01b26a176160b81fbff2df1d161e39f8313dd1ce16bcb4cb446024df0e96
MD5 616e8683a4c20bd4c45a3146fc5ffd95
SHA1 e6fc27031a9b65b321d2b93c210a096784205984
SHA512 e71202c9328fc117680271eac8c5f546cb5ad8ae654426ba6cbc56275dbf97e5f4f6d6f177159094619f0796be4363379e8ed39aa6deef4dbf34f2e6b047c85e
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Vm+brLC2hTR91:SySzP9mqrWETR9b
TLSH
T197067C96A16801D5C1B9C1B98B17CC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4b774962a99ff549955a4a388386d4653c74b967057f3cd3274ecdea261e2769
MD5 ed0e55ce54f757488a2fc3b79283c05c
SHA1 414de3e3d57356dfdd36697de111e006a0ae53ab
SHA512 a1f989a243ea6dc1fba1754b82f898df8eed69110a33a04021a3d5b3290620d62c79c86ad20ad0517ec1e78083565dd8b13c35dd36e24c7c1ed0df350d14965d
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYjRmlh8t0D+7y8G2G9yL0cMoThTR9PN:147JUQj1irIhCnDHUPfF/lm+brLC2hTd
TLSH
T18965AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a1d561dcd8f02c4e4db5c0d16fa8b1b10879ca2af5cddf328d15b4851304e11e
MD5 00eb9f7002ba870309d09a43951e2393
SHA1 3704a289a5c9c05658bc86bdd4aaad84a42b8d0f
SHA512 85911dbf0d91ef7a16bc71daa59baced90658dc9737a4a9ec5bbf76a3d4956b12b7d64dd9c8508451377f7405e91b54ba7f352031e58f047decca409517bd1e0
SSDEEP 12288:kNsf1WRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:1QRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
TLSH
T118E40119D2A801D8D06EA275C3928A81F3377C6197E1D3CB62C0F47E1F769905EE9B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 982f31919011f07c8c86a8165253c6a110d150ad5b39581338c5936bb514b622
MD5 fec08d98137d8e0564435312e0b080cb
SHA1 cef41166fced1eeb8ee7a0d51cf3503678409e59
SHA512 7d4bc9be180f84cddf6e86594402c7017f6204eb7da250238a8fc8d93b9d6fb2bfc77c0c0923534a55069bdddfbdf6150ea60dc784984b4e645bcdac831fdb1a
SSDEEP 12288:ffMRrK7U3fsci1ihWyClAdItm1e7rAnEzzqQWFOAnKjwtuO2c52lQLkWqyVD:ffwrsUPsO7BKcAO262lktqyl
TLSH
T105452840762AD75FC69D80321E33D6CCA7707D01EE05AF0773C98B3F9576669BAA2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 03209f1671419dfd36dafbd47bf792eb4fca5f4dea342ad10e88bbe0667765ae
MD5 542b6fb3c9704531cf45a8ab8bb03935
SHA1 50055d83c2839fc9b36fd8bff39423cfafe6eda0
SHA512 a75dfcbecb081e33515e6e0c90f95060f15a5b93151c4c0567cc4121832274493050be52898c6a6d6dee6583af82d2ec4235c9f42b41132238450aafa9563fcf
SSDEEP 12288:g+R9gfGz+znzZyRRikc0uvBi4VvT6WW99I:g+R9vRGpT6WWnI
TLSH
T12855D8816537E3CFD1F76032032A6B4DB7A4EC07B7055F26B389453AD82A721A4B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9a3cf09f2c3243d62005807d07d3c656d8683c4b48a56d3135d0975711fb6bea
MD5 8a7219c5c98339b3af1e88116d3d7583
SHA1 5951086512ccbf0e2728cda4571e27a2507798a9
SHA512 1f3dd501606ac13c3e126cd1079c248098923b096be422045aba29cc4cb60b27671f0fd6f6b6dda35a8da83b818daf122ebddda91540c64669e3d92660c5944b
SSDEEP 12288:PM7dWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQoI:koRmlh8t0D+7y8G2G9yL0cMoThTR9PyV
TLSH
T1B1D42318CB6D4482F27EA2F0A2E2C4A5A57EFDB1AF40D4CBF08179D12671CD45E34A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 df592150a08114a80bed6cc69b584bc76367fbb942e5e5c751460927fe83200b
MD5 37a0c805f2485cf1f2a2e3076633e78d
SHA1 585eab2cc8d3acddcd3d719f88a088276ac4633f
SHA512 fe324c3f2f22f8361ec54e6e491657ea395f8b8bc1bb447d8c6bd6f808c177f044cfd78984f3f1457f5b1eeccfc1348aa3a46c48623402019c87dc2cb6901bbd
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYORmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:sgb4mBIBhGFjm+brLC2hTR9quLB
TLSH
T18165AE1E22EC02F5E0FAE2B8DDA64417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0ec0071c4d759700363967e8a71696ec101c5aba6d1794703643acd9a1c8160f
MD5 33416782ad9f543c75c34fc8ca5de090
SHA1 9e4af747d90460a0cd3feca5028eb442c0197599
SHA512 e0995fce31f2bb327ab3b86f901642ed08c1a531f479f11c86f8ba5a4c8afdac363598c0d0e0e4bd5cf66d1dbe2be5be026a47ba0f242e28cdf2d5bc0b268671
SSDEEP 24576:cG88u8FpJqH1bzria7/mTRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:f7ZFPqVea7/Gm+brLC2hTR9quLB
TLSH
T10535F16577E501F1D07BD138868246A3F6B2B8251364EFDF07A88A511F23AE50B3EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a752e1ca27beb1476df9b85007e0c366e7fb6c397ca9239d5b062fed1b7fdfb5
MD5 f217b17f934fba322954962aa94fb030
SHA1 3945a3af41b3781d03de4c1d3f483152039c5939
SHA512 028801c630ea12c5e04fcc66dfbf2be2adfcfe6cfd606cc832332f00edfdad735ef1247f79c96b0ab1515026571b7bf84e6c3ff347d1a342729e182e7d4d2d2d
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/m+brLC2hTR9quLB:yG05lO43bcmqrWETR9b
TLSH
T19ED5CF6E62EC01F9D1BBD17CDAC64A0BEBB23825032556CF02A486A91F27FF4557E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b2cf4f3b104387bd69319317fe2a4fb6d1988150547802478f7a1d59660075e7
MD5 9c44cd5bc2fb7a7a831e9f086d26b634
SHA1 485cccfd108def87a3af2ce77e145cfbbd9d5c96
SHA512 87a91d0c2d856447f92105835873e63ba440c8d60802c39f5e4649447f6ade99766f941ba52b422ee40311a8edb7f098ba13a8ca82972f563de84df47bda8bc8
SSDEEP 24576:2fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVRmlh8t0D+7y8G2G9yL0cMoThTRD:ua5POZ3+Jt2pasx2+mHm+brLC2hTR9qU
TLSH
T1F465AF5EA6FC01D5D179D17DC583861AE5B1342253319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c0636ccf666edd78c361afd6614dc2cc85e179bd5bdb04da0582576a0af3230a
MD5 2aeccba40892083329acd2b491b5adb6
SHA1 bf4a5a89aa25bf224c43897d23da55b6dfaa1f3b
SHA512 e8a3f1a4e450ebaf48945a35a96032906e09ffac764ca278e9f0109dafe9b1949fe0ef82984e3bbf074b647e16b797c506b7ad11fd3ead4dc78566b804da06a1
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7Fk7Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:JNc/zEOVHFmm+brLC2hTR9quLB
TLSH
T1D1858C1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 01e6f07c560646f9327534a5ada4610a0816169ab485473d2f75a3308fa56146
MD5 887daf071fdacfddf0d199154dc2a887
SHA1 a628760397a4df110b2effbf91a09a03b202c5af
SHA512 95b25e6d93e0cba23b01667017ca09cba1a0d57f606690f2a9a625cd7911cc5921464075e77224ae5d7f3c9d9845adc1a1fffcf9d092d925eb960a56cf80fda3
SSDEEP 24576:+8kNvNnaFeYhJNtmZBmZRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:+8MwBtOmZm+brLC2hTR9quLB
TLSH
T1E255AF6EBAB805E4D1FEC6B5CD238512E6727861173293CF5290C13E0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 6da4dcb96041becb3e65d038e6311065e087267da5ec8c5a2d6ffd6de8173fef
MD5 14b0219d8227a88f08f10299ce8abe1b
SHA1 34de932c4c17f71d058e5ed2969c40db407af1ff
SHA512 8ffe607dfc9cb0deee68bd8f9d395aae65e7cc0b501c975a37ccf723b2a14bf5db937b650a33d4de112cab309eed6c58076db38e87634ee53722f07166ab84eb
SSDEEP 24576:MPUr+NQPRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:MJQPm+brLC2hTR9quLB
TLSH
T14A05E12E66AD18E5E27AE17D85828609F771B8621712D2CF02D0817E0F77DE8BD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 ba5c08a39e15b920d967a466e7a3cbd0ffc5cf3ab4edac5b29ea33210441efa0
MD5 b0ef907572e8a265788ceb83cb5f622b
SHA1 413cb9b35b62a5d3941c611298f48faa6cbc52d7
SHA512 6f0eb1af704edb46c6397dbd31f49138c0d44b08135faaad8409970dd14758cd134f2b32d2374dadc50df60779dced06cf128069f7d67adb4ff14791a97d4c0b
SSDEEP 24576:gD3FHshBIYQgAsRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:gDVHeBIAAsm+brLC2hTR9quLB
TLSH
T1A925E13DEA5C04E4E57BD1BCD6A38A06E77178A9032265CB12D481B61F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-49-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/572-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/572-36-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/572-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2208-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2208-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2208-19-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2208-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2412-103-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2412-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2412-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2412-362-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2412-361-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2412-96-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2436-129-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2436-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2436-134-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2436-123-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2436-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2528-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2528-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2528-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2528-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3096-395-0x0000014C1FC70000-0x0000014C202F0000-memory.dmp

Download

memory/3096-375-0x0000014C1FC70000-0x0000014C202F0000-memory.dmp

Download

memory/3788-305-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3788-80-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/3788-74-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3788-75-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/3880-378-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3880-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3880-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3880-380-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3880-85-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3880-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4280-58-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4280-51-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4280-273-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4280-52-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4300-6-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4300-360-0x0000000140000000-0x0000000140E12000-memory.dmp

Download

memory/4300-12-0x0000000140000000-0x0000000140E12000-memory.dmp

Download

memory/4300-306-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4300-0-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5164-64-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5164-62-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5164-70-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5164-290-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5452-366-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5452-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5452-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5452-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6060-365-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6060-109-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6060-117-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download