1f5ff2c945212a0c913f2aaedaac26563aaa7ef931245f865a0b6f9832223889

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
Size 936KB
Sample260814-lebjpazfpe
SHA256 1f5ff2c945212a0c913f2aaedaac26563aaa7ef931245f865a0b6f9832223889
MD5 e9b8b6b2a0e8aa674c3aa8a432cbc980
SHA1 6007ef6a23e48ef892607a3d53aa386ece0598cd
SHA512 f941d4e5383c8a25d86e6501ecae098c5117657f440882d7bb35666e9437ca115c8730b96b56e92abddeaac67e83aa304b58b274d9cfbe1ca13ffcdcc88a0a28
SSDEEP 24576:DyE3mD88XGpVLBhvn/+r17LNyBo4kx929bL3Hnx:GE3mDdX4ZBh3qKB+kn3Hnx
TLSH
T1FD15120277A840F8E1779A38CDA10A16E5767C464B30C75F0765277B9F33BA1AE36B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
852	elevation_service.exe
4948	elevation_service.exe
1376	maintenanceservice.exe
4508	OSE.EXE
916	PerceptionSimulationService.exe
5248	perfhost.exe
5604	ReFsDedupSvc.exe
980	SensorDataService.exe
3664	ssh-agent.exe
5836	AgentService.exe
5516	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\be4c3e8d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8de0404cf2bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a1f3646cf2bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5c12d04cf2bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4fa2804cf2bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
852	elevation_service.exe
852	elevation_service.exe
852	elevation_service.exe
852	elevation_service.exe
852	elevation_service.exe
852	elevation_service.exe
852	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5220	2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5836	AgentService.exe
Token: 33	5516	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5516	SearchIndexer.exe
Token: SeDebugPrivilege	852	elevation_service.exe
Token: SeDebugPrivilege	4948	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 2540	5516	SearchIndexer.exe	100
PID 5516 wrote to memory of 5892	5516	SearchIndexer.exe	101
PID 5516 wrote to memory of 1272	5516	SearchIndexer.exe	102
PID 5516 wrote to memory of 2888	5516	SearchIndexer.exe	103
PID 5516 wrote to memory of 4228	5516	SearchIndexer.exe	105
PID 5516 wrote to memory of 5144	5516	SearchIndexer.exe	106
PID 5516 wrote to memory of 3576	5516	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e9b8b6b2a0e8aa674c3aa8a432cbc980_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4508

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:916

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:980

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1772 1768 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1744 1536 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1772 1768 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1744 1536 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 92a87e212fe70252e0fe8cf5837bc762b87ef2173df64123794da2124268012b
MD5 8a844b9697ba3405d87a1907fc2d192a
SHA1 ab7a3fc23edd4cbe1b4f06bd5bf47252b1c92234
SHA512 91973f0ab585351389c986e090c43ea8ce419c2af18f6af69d684f1ac299f50b331931e2389217aa60e5c907d60496c00fe07ec8a4dfea467d25a89933d401ee
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxndB+kn3Hnx:63q6sjBQ+k
TLSH
T169D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4a0995091b81e24181ee1bad6a167a16406ae11a40f0b81d9b967079a164ab98
MD5 b2139744ed9a420fd0bd040eda95b23d
SHA1 2261e9bf008538f0704ddac2cf99224cfeeb45d3
SHA512 f660c6a4b5c647da731c9166ccf1e335f32fc7c62a6774bbad470069d683670d9a1f419a6ea28a9e689b33d9267b24886eb1f20099a51c1af7d2097a4324b386
SSDEEP 12288:01XLsswWkxy2lRq2czAILDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:SXYfDtczAXNyBo4kx929bL3Hnx
TLSH
T12205012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e0706fb71397becd083da66674f13b1d57579fb12cec33e143e85a762c2458bc
MD5 f92fe9cbf46eef4548e73fdc5a69b85d
SHA1 eb47d1337d0a20d97ef8408a74af343afdc4e0f5
SHA512 545d8129370d7273a88a48aeac622c25a61fb72a9d64acb6a68beb3c96b2443dd958b84b5311af1aa17219d71d1f51d56a7661e2367f3c338686cd63cb003370
SSDEEP 12288:SXZNYVLeyUji0h90ZD0wxpGZIVuCrHsRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:W0Le5ji0hmxxrMuNyBo4kx929bL3Hnx
TLSH
T155359E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c6452387241abddb3c47d885efd31967f8ed819e3418ea4871b04da2c88353d4
MD5 fb392329fe779cc25393e8f2a114b4da
SHA1 afbef9b7aec5e48ebe9c1af273340e2802f9a097
SHA512 4798faca9d70e07657a61ec70d672ba60d8c30b2861d69b9412a3178044c3a3c4ebbca082e8feb6331b7c67f752749cfa6186a0cd18a56af6ff6cf08497a29f6
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWn6q8wyuINyBo4kx929bL3Hnx:W/ezSC6vUzPveHjyOB+kn3Hnx
TLSH
T10D755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 250f7028dad45c053110d4359a3ca47c19ec698396cd3aff5cb68cef294a96a5
MD5 170553aa0e627d49838005e38ebcbbc1
SHA1 e92d1c925fc613b9804f038d5dd1b57b025f0acc
SHA512 98ee1cde0049ae3ee9c59e4520e7547073b7e353713a2d1c7cf7eb73b5a77275a8c48d3440be9ac0ea2be842741b2d9ea3a164d582eeb7fc8d78becf66643df3
SSDEEP 12288:4VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98MLDAptNyvUgXZ32dT4ePc7N29CD:4VbqPb88hv/l+YTNyBo4kx929bL3Hnx
TLSH
T1D9559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a24a345b3d8809017f1703372e7d31e00d7e030898783f8473e0c3a1c8fbdd51
MD5 bcfdc180b6a89b5a4c4df45b9d9323bf
SHA1 a7dea3ec456761486536de160461d47d1ab47bc1
SHA512 d9cd9cb34d406ef366438c210532d1e8e7c0e09b2f9ef8a544939cadc62d7e7cb11f82f20f37b0d88a3956953ae74d9ca0a00bfaabdd83c1c6e14e3bd545c8a1
SSDEEP 12288:4LFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4LaNyBo4kx929bL3Hnx
TLSH
T170C42313470C627AFBBD3F70789E8454CC35BC890D95DB94DE62ACBB58BC9A2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 67a11dc34edb11a6f0bb536fa232eb59b5a8286d088cd625a6ddc9093eee9a34
MD5 8ba01697d8c8fe51f2657a2bc4241812
SHA1 753d3dacab93e7db23533c78fde44d4b3942f872
SHA512 975df380df733719661147b7ec5294bfda78b566bb6e2d68f30690f9bf6925bd1a5c914983c9a196c09a870f2a93e05627f3f4b5a0174a7d45c90699935cd41f
SSDEEP 12288:veBNUbTVO86U0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vJIUrNyBo4kx929bL3Hnx
TLSH
T16205CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 98df4e9e19e390e1d1a6f04bb83c004128e343a2fde2d326068fb0796d5f919c
MD5 beb01568bfff93f6d7f30a3c8a451d78
SHA1 08767675b4c70fb97c930494fb0f8fe1c91d8852
SHA512 f7a987cefb82ab92983a14f87fd9bb2b23d4490ec62ddf2a748033115d3f43ef35c735367bbcfc458af58508227df830d1830b2b0d5d7b00fdbe7351c671946b
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THG:uQvGAdlCEL8c/DRNw5Ct+k
TLSH
T14E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9de1cc6b7f2c1b1c2b8892609276b712adcd3ffe0e02f9bba8a380419ceb9552
MD5 e988c128620bbd20b0232563d8f537f4
SHA1 5a389d94b208285d95e4c78cbe2118a481e1e558
SHA512 1af30a064b188306e6776fcb5fdd9f83bf7e048ac16a8c5e265e06f4c80766ad9aa9d345043084e0780ccffcad4f622589e6ec989ec51b0babbc7a6163a907ac
SSDEEP 12288:2AwSfxL/2Dc3RDLLmt0LDQewsAjGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:L0ewsAjFNyBo4kx929bL3Hnx
TLSH
T1F715E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 362c8788f9a81cfe0c385b545a76432a9f587735c705fafb7ff5f5ae91f19b3b
MD5 c32282ccf16d64fcd066d17dbf3a4e8d
SHA1 e53862321b8de5c05946940ee2c452dee157f4be
SHA512 02996e72dfd35e170af09d3f2f4149a4b5a70cc38ed29b73ce899418978bfedf02527810fe6732d6f54338b6661079e7607d09afda1d0bd28470a9a297291476
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHi+k:bUEtQevvqc2W1cpV2tI32i
TLSH
T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 606aab3eb3885d9293e9f5ab2fe729b6dbe307bf7b0d64f174ae039499e321ae
MD5 e93d4c873a1bfafefa2c0b27ea5da612
SHA1 6cd92724d31f510cf74cc11db43f90074d522b5d
SHA512 b19734ea2c72d6c1d930439b4259c401d49f3e319df7bfc3561a019749ac73a0c08235640edc7e89aa6b8f0493b9800bf40b2a7f5529d22e8c5381a95ba8b9c7
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/zyB+kn3Hnx:+oquVjnmx+k
TLSH
T1ECD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5d492252ea1b7b856041c2e44490b692f35a04c017845c4d4332ae449190d92f
MD5 83bbc4ef71b6b18149bfdcc07adc76c4
SHA1 e03b3a8242d4526560de2bc73d3991bd1dcce5b1
SHA512 4d8e5dc48e31c65ddcf7b0eafc1c44f9a0e1c709fefe9ed9b2f29817a475b202b83433424495f075ebb67aff8307e587e6b4673ba7bf8d01ebcfd192d02dadf1
SSDEEP 24576:/AhGL3IFoiwtA5l7S53MNyBo4kx929bL3Hnx:/AMUFoiq5nB+kn3Hnx
TLSH
T107359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4c5502aea3c07d040dc4353d216ee4442ef638927a9d4601f52632248f9193d9
MD5 faa798e5835201146bd267f95ab72d3c
SHA1 df8b0e944ba44645a8ed4ee4de0ca60e19cbd6b4
SHA512 a5485704dacdd5ad7c62e8cb02302483ad1ffd3a248ace28c1fc885270867717306277c45798d9f1ecb2560fc3bc331248a4a54ed4e6e5632ab4ee28acb0c8ee
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+CrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:wwu4OWJNyBo4kx929bL3Hnx
TLSH
T10505F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6f6fc5a7377016890eada4bbdd3f1ccc74d3d673d576296bcf59d8645a403c4d
MD5 2faae03345e1578a17cf567250be5d34
SHA1 3f1b5e2712d70e0ae6b41b148361ced27c4da0f6
SHA512 664f8089677887283448aa42f75cc8a313f81619b399314953f203212d8c6595f8f80995d5de5ab2e95b4e4111c49a3ea6e199970aa5583bd8cf4b18ff45e490
SSDEEP 12288:MeZ1Iy2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VZumNyBo4kx929bL3Hnx
TLSH
T118E41216239831FAF2AB2678D8E58505CB32BC461B7183CF5A2185BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d8ab389c444e59b12eaca7d752f2d7309aa0507852d2f338d6fc36d6c990bf14
MD5 05af415598550ac285b9b4c486b422f9
SHA1 0caf55b0e4e7ebdfc66053e6fb7f76f37244179e
SHA512 d92bcf8ca713748e00ce185b0fcb5360e233133aca954f9dd203063d388f0c411598c06555a3534dcc4306dd66c16f2db8c9d37153314991ad819bce88556a35
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uq:pQRQyi36YOcPbLvw2gAf+PN38+k
TLSH
T1E0666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8429cdde50eab59fa9fdce4390579e7c5818305c9c5fd228335988f29ea4996e
MD5 ab9b1aba8316305da4fd6eea9b756535
SHA1 21d962e7e225f6f84758231bb19a48b2b34cd648
SHA512 4bfb9340ddd9f70c73c0aca24c86e86fd9de69422e062a8abba0103e2243cdc056213f011df2595c3a5f7081502b8da9498cbc74323b4a75d17f03d4a7122f4e
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uq:+QRQyi36YOcPbLvw2gAf+PN38+k
TLSH
T1CD666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d401608d4d6eb59e6671760864a1236ff01b9683564dc0df30c1a70f6193618a
MD5 8f763d2a889e8215be16687e5cd855fe
SHA1 215338ec3dabad386bc3dcb8b8b55f2b5171fa19
SHA512 564788dcb6d31156a73b8d6c039b7b7ebfd9f13f44783c246c89356cb27949244f51aaf5af36dfb33e8fc20d92b6256aef6a0cda083805e07374a09712681141
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0WNyBo4kx929bL3R:y68Qg55nhceWu7PNU3/iB+kn3Hnx
TLSH
T145B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 484a89da29acafbd22a8e42dd2286ff7527f7ff1fdca0f2acd29f6c71fc267ca
MD5 d4f082542d54f38a5bbe214df7975a6b
SHA1 0234199e9e071fbc2ca1c8545b8ec30de93a2435
SHA512 824d99a0aa2e78e56ca1e4a8a836b3d7c9146c74eb1c0be41ddb288e6d1547096e1efa298cf24eb42a61606d09e0e90989efdb9d24b472934ea9ad5981644f7e
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99s:zy5112gYy5azzVvt69nLKnhZf+k
TLSH
T1D9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 23adc0e11601f098ee1d26610649c54e4ede113d5fa404abde5dd2d4d62e0f72
MD5 a195724d72b10f5362ef15b00e53ff01
SHA1 fb189e4fa3cecbc4510a916dd244a3825bf978f9
SHA512 ea27eb437fe374b689f19af7237b64a2e7b82bc7f88658b2dd4c6a0e88030aaeed1aad63ac76d3c6827cc045fec9f16dee048165c2e7600f7aa1885d2a99c47b
SSDEEP 49152:xB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gloB+kn3Hnx:nu6Jmdxd2d0+k
TLSH
T13ED5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ac5357186884bf0adb6c1d04debbce1d58342754f664f8e596bb53d717820c54
MD5 1da5a33b3861e081363a76a13f785bc1
SHA1 eee898a342bb69cff5611693965df423e076871c
SHA512 1016acf5d152a33f96bedd0e20fc44be7e2bec6a623878983e8a502706f9a50f7d3ec077229ff7578fae1dae94b18766b4d4a5821684d9b74632719bbbc90320
SSDEEP 49152:f1hpsNoJpF1A63U44CwH7R4xEB+kn3Hnx:fmifPWRx+k
TLSH
T120B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9422f14b8be04f1a324bfb478e27eb944339726bb111b665ff2753a684e4cf9e
MD5 d3dab8c32a6baf1ee768bd713adbd970
SHA1 d912aa932298a323e2b159550c82dc1b8e37fcb9
SHA512 01a2fc00dd7690bc63863bf63c08e69133b4f9ffd1e8af9e39655de577c2096327564c3a2c5113f05e96df359ce8634c00d0cff9ace71932a94f41e0762e1e50
SSDEEP 49152:ESuZQIY0Be2KcRVtOnks6NMHqNB+kn3Hnx:W5dKii61r+k
TLSH
T1AAC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c945b5eb898ca071f24bee66df2db390fdd2fd7335d752e07f105cdefbd32b03
MD5 1b55cd6c5180a271fafd95caf6f76da6
SHA1 f85b5f2f7a237779eba5b94e5332a0b3db3bfa65
SHA512 fbb7b1fdfb552418cbd4d50968263b459fb0b4c68ded0f6e48fd06a8a45eb13502bea414a4931b35a4308b77eadb6a8be7d7a181b14b72e183b750fa539c4f10
SSDEEP 49152:vhtSn8EApI0fig3giDn0AP5wYB+kn3Hnx:+X2imph1+k
TLSH
T1D395BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d4547260e51b508066bbb656ccb86c632a03b204a668289fe2e7720fb545663e
MD5 07633a7f23ed50dcdfb820a76ec89466
SHA1 cca220c019188696307201ab81bf0f963ea77857
SHA512 e19a1922a3f49ed46f4b45d836594a5517152e0bbc00aada5447242b17585dcd0300259ff0bce09fda922d4c1510e80542e9514c377817d92b84a7bce60551bd
SSDEEP 12288:5NLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5SNyBo4kx929bL3Hnx
TLSH
T134C423025A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA24B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a4bc1532511a4c4f970abfa90c52312a0d312c37fbde6cf3a8e76a7c8ab5ef8c
MD5 056277fe4ff78f23c3aa314bf580832d
SHA1 82072f044545de8c0bf8ee60abddab2648820dad
SHA512 349d8e2dc3c8eac498088f7b0f163b7c370f449e16a61e3524663220038ead48cfef5ac0c0289095749329a6f35637fac6968fb9028468baf36fb9b666901133
SSDEEP 12288:26LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2RNyBo4kx929bL3Hnx
TLSH
T139C423125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA25B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 18ab49d95e65a74e33da414dae75cd9921a2a08f11aa824f03ccc4fff170f650
MD5 2ec1773488f8024797d81ca99f5b5595
SHA1 ded911427388c34222a7d406f79ba71b3e6b2eb0
SHA512 f9cee84a55b7a15dde0beee2cb9b4e6af648c95d3a970eb94b93b0d9ead6e150c819baa4e238c8e2d539fff605b2efb92e931512c7a44e8a6b5f779a9e046906
SSDEEP 12288:kcLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:kDNyBo4kx929bL3Hnx
TLSH
T1E4C423125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0cac23833321b569c30f8e37c01970b2a60c655883f938c08a1cfb343c092d40
MD5 1aac062f8f5cbbb6bdd0f9173ffed70b
SHA1 dd0ec608a477093cfa2579fb5cee337c966fdd7d
SHA512 bc7e4ca58343ab31ae3a1ff605241fe42a245bef0a6f09fde016640813724522fefcda43ed89079e6764f45039cca6454e29538e8d318cbbdad46ca922ee8ecc
SSDEEP 12288:qVXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:BNyBo4kx929bL3Hnx
TLSH
T121D423025B5C12BAF97E7BB098568054C835BC8A5B7197DFDF124CBB0EB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 1aaf0dbf96d301325029baaa3748e45c339479d4d612c08c84836afbe52b4fd9
MD5 0455169689b206525629bc86e8ae7bb7
SHA1 9799cb27af88ea3e508fa7c696858fc3fae10417
SHA512 891ab5dfbfd977494563a1dae409e197b13a15eec3b370520d400d0ee82d19d685dbe60facd4357f7274669ff4191278b25565dcb273a4df9292927769344e13
SSDEEP 12288:VPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:V0NyBo4kx929bL3Hnx
TLSH
T17AC423125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA24B21147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 cfd4957f3e1627b08e86d61fa276c1ef7ce83f09cde8921cda42c5cd0b6909d2
MD5 b259427b671004a9e4e6e0730210be52
SHA1 8fd39ec2a66225987661f8b51399bfba1edbd362
SHA512 0c09d12c0030aed8254d840cd0a42ccc1b1ac9349fccb69d9b22ca46b489bd85eddfb1b88ab83279f9fc122c9af56d45f8c4d38963afce4bd567059dd0584b6a
SSDEEP 12288:9uLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9dNyBo4kx929bL3Hnx
TLSH
T1D9C423125A0C627AF76D3FB069498198CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 1f23e268748d4199354d5af064ebbccdbebf3ee77edced1ed87248405e6888d1
MD5 21b06366f6a1bf2a06381ded15b6fc98
SHA1 9fe1276261fa152ce3c182e22a8470b308b89d0c
SHA512 6cd40c6eae035f15cbc71c310c868d02d4452e1362d838042284f4693e8209f3ab18b5251bbc0425c896ce79fbed4227c87b0ed446bf9e9d4e0ec76d0006cc42
SSDEEP 12288:VSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:V5NyBo4kx929bL3Hnx
TLSH
T183C423129A0C623AF76D3FB065498598CC34BC8F1E95D3D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1087d77ec3c344f3538eede3ac54f4d2d6597085848efabfa6866f6761cc7c62
MD5 e7843eadfca61ab4b3e5c29e14eefa2c
SHA1 7ab1635be96a64cbf13162bb048d220535a550fb
SHA512 f27749be7ee45c7855a628e4bf404a9126f0374700d21c32e8df51f9ca5a1f61a1407f699b7336aef1a0be6233f8d5e49a0607e3e2ae7ea23bd990d28e1a0354
SSDEEP 12288:IiZwbVzzFEoS2cPvyaLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:LZMRzFVSOxNyBo4kx929bL3Hnx
TLSH
T12B050195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 24d5ff91685fe1523754d37d65b972554afc3e9304f7ee2e6054961ea59f866a
MD5 77ec857cdcb55473fc18861d0f2df125
SHA1 ab7dfdae7f70c31e4f793fc1717d305aecd188d2
SHA512 63b582119180338673b99bbec5427d89c1124bbcbd7e12981bcee8e1b49bbe28770b8f79439f3559c6b4f00eda65adf66030180e5af9c15618a23838c694cdbb
SSDEEP 12288:SpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:S2NyBo4kx929bL3Hnx
TLSH
T18FC423135A0C627AF76D3FB0654A8198CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 76d2c81317e065dca14b96b64bf7f5ee298ab6c9c7b2140aa8923ebf0ae63db9
MD5 80f2bc6ac79a3e661755e0c03bd42da9
SHA1 ca3df1e7647ab76af511c5df72739a65105d4baa
SHA512 5b8910ef4b593d25283b79a04e1c55c8ce03f5d7961581289a11c6b40a8a7475206d4a9b699d0d3de8a96a41956fd8e49fe7e0ede6eced82ff9467b9990a7364
SSDEEP 12288:r1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:rqNyBo4kx929bL3Hnx
TLSH
T15FC423125A0C627AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 58731e8ec155951757fb07a4cd8df0bdd664954b52840c9bc53859b75a87be19
MD5 c79187cac99807ee27e9506c5f6c2603
SHA1 c157a7f5fc7f76fa1d63e333a26e7006dc077183
SHA512 3d728ccc4770c5021b48ee9cee08b579cba90a00faca00ab5b02dea508a7e33f2bce371cdddb8b62b450138c43b8bc00d42ff5746bc27b23ba5e8bf4bc0c6ccf
SSDEEP 12288:AyPz5L82LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xzyVNyBo4kx929bL3Hnx
TLSH
T136F4120773A831F9E17A6234C8960A05E731BC760B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 81815e37f3c139c59c6b6e9df9055980b298e87b14e629595ebe0dc4858163f1
MD5 7a0f8163bf9a2dd0ff73fb56984a58d1
SHA1 e9384c1c94bc2aacf6838fd1be08921ed4112c5c
SHA512 c00ac8e1c1aeed8d56bda7019ee0283b6f42fd82d7f008bb39f04aaff7085cbb596c9d8cd78279f10baf5855a8be6d890cd973e34e1f0e5870e0b7ea07eb1077
SSDEEP 12288:qpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:q2NyBo4kx929bL3Hnx
TLSH
T103C423135A0C627AF76D3FB0654A8198CC34BC8F1E9593D8EF27987759BCEA24B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 457881ed1ea87aaae250e054bbec530cd2b8d1a3610d6506753a40e88c7316b9
MD5 24085f7af9f86b80b5b3117754c4a2ed
SHA1 5319dc1187cdda8a220f96afa4e5221440b38891
SHA512 df10ffa71bddc21c6a300a159c9e9736fa47fb72bc4bcce7ae02f158002f8104a8c62d86351a1a561e6ceae814394625dfc5b2f12fff5ea13a7a4d0a6657fca4
SSDEEP 12288:kpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:k2NyBo4kx929bL3Hnx
TLSH
T198C423125A0C227AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 72c3ea572b6ef0c9e49dae90fd2c74d518dc8ff1a781cdad084ea2f77322a6c7
MD5 0e8e93fbd3af81414e8b399c85c462b1
SHA1 87c12290e44a496b94f3c5338a82933186444557
SHA512 a346fa67f464ee61b52d4f39dc4733291c47f53bc5dc737c8a32e81d6be479d1122f543bd877b81f30695bcce1493c9b4d8aa0ab6f9980ffff2777bc686478b5
SSDEEP 12288:eyPz5L82LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DzyVNyBo4kx929bL3Hnx
TLSH
T1C2F4120773A831F9E17A6234C8960A05E731BC360B608BEF576046771F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8e67954f606e9f1f85fdba71cc23d614fb84a1b7cf866eca0a35afec5ac0d992
MD5 72ddff966649e6aceb366a456a8d2a82
SHA1 d210e1dd6b68ca9b446a7f7379ee11650cf80080
SHA512 5114680945f9f5b885490404fcbb87ddd8eabf5ec4a714d3a243e1ac2f8a64e37dd45867e1d1405b061a4b1dd0fad352dbceeaa05ea20648eab514610070fc21
SSDEEP 12288:SCd9CWYoaLHF3z0z04PDvhsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:zTDaLl3z0zDzNyBo4kx929bL3Hnx
TLSH
T1BA0501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 152ab157bc15b151704c027d1745c348489e82c43193f600c1ae1ade1f3e2533
MD5 bc1555b361cda879a1029c44c3bcffea
SHA1 a14fd64c75450231d9860dc60ffcda9b3ab2a9e6
SHA512 d661cd57d7416e7f6b6ae5e95ac765fdc7fef2261e0f75435b86651f02f0410cb698ec091a93018f7fe47787b8b9e1191219562937ab3260ee075c68d2c5e997
SSDEEP 12288:Hi4e7KRdTfgwCHKy7GLbbdIvDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:H3vd9CHKy7GZvNyBo4kx929bL3Hnx
TLSH
T1ED25CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b0f883002b79eba28450a9e9557082946e8f098bf9f1df9264c6eff881b8f4c6
MD5 06b70dfec83aa20005a57db6da04b6c2
SHA1 63ce14ac5f7d798f1b36ee9d7130d7cd67f1e0bd
SHA512 3a752169d07fff42b7fc1ee27484e2b55e2421868224eb485d6a1e12b8b40ccc40ad920eb8128949084dfcdcf446f6cbd86de241d1b3e4d1e44226089ad31697
SSDEEP 12288:I8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IjNyBo4kx929bL3Hnx
TLSH
T178C423125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 4bee7e10efbb5387e2d4ca68fbf9b5471ae8264a7de0c47b7ea3e11d7adfcef8
MD5 b8ebba10a95c706e624f6838337089b1
SHA1 09ff3dcd3e4fab47fa8c8738a7c611bda42c5308
SHA512 864c434bd9b3950d9c2cc3986520d86f935561ed1b510a443d095c4f049128ee5eb58079d1044da92c827529fa34adf48eecfc08e274e7210ee4130f59b34a25
SSDEEP 12288:2WLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:21NyBo4kx929bL3Hnx
TLSH
T1C8C423125A0C627AF66D3FB0644A8558CC34BC8F1E9597D8EF279C7759FCEA24A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 bfb1684ab764a55bed7c640ee2fb0af4c8a2da2e10c509318e325e4c6a61fdd2
MD5 6e9f94a6cc0bfb2b8c3e15a1c5ceeba7
SHA1 53b3c792e37e2c58ef50d3e6e8e85dc432e37cc9
SHA512 d023a56639444a322325902ee8369a3ce2b93b65c3699c0befb54090b4f7d61f3cd85c3adad58ff87d3b1b7a8b411304a3790ff47d1f35f35faf6d1b79d80fa5
SSDEEP 12288:vDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vQNyBo4kx929bL3Hnx
TLSH
T1ACC423125A0C627AF76D3FB0654A8198CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 3453ce57843d84b2e513de1de860ba6071d382ebd371cb4851252ff9150361dc
MD5 c8778ad0cbe014322df87696e08735c7
SHA1 b19203a226163da693b407da623d6c61a736f26d
SHA512 39a60dea14fc1de70526455173f0311e29537091c6f7bcd04483f3b02dc7199dc95c9b40bee3d29332b2a7115c37a2b5d32d87b03b0bda616bb7604779d979cc
SSDEEP 12288:2pLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:22NyBo4kx929bL3Hnx
TLSH
T1B1C423125A0C627AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 fe3f2ba81ff0084d75c744f513c1cbf16e6dd701ad70a8bda4e236804497e4f8
MD5 a198759d5bbd1503dbd497b6585eb27c
SHA1 43f372196f74c7fa97dde6962916c34ecb170354
SHA512 7020348058557c3eff915e16212f25240f37173f142e09e398195742086ef14dae447bd06a71f27dd24d7ffbd01ddf193ddb80c9697d5086c1b77786f37def04
SSDEEP 12288:58LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5jNyBo4kx929bL3Hnx
TLSH
T105C423125A0C627AF76C3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B21147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 68f6fb466c3e754785dec39e324bc1cf9dbedaa4845e6af745736e4d6319bf31
MD5 8e985857f4a7b09c8c1df2aeff9f9849
SHA1 43a589fa96062337a49723340e2cf72668979ebf
SHA512 95fa983bd34c77928bfd33b095351409762fcc4bedd91424ecf4e065e1349a9e8a516a7161e8fb4cfaf38982d0e97ff2f83762dbf229798220d5a53dedd9bb19
SSDEEP 12288:khLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:keNyBo4kx929bL3Hnx
TLSH
T169C423125A0C227AF76D3FB0654A8554CC34BC8F1E9693D8EF27987B59FCEA34A21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 a0acff20277a56405e1fed3f2b9dda6c44fdae507a313766d9a6c2e33dd94820
MD5 335bd8c33023eb462b84aa2516799d5e
SHA1 dd5ffa81a72f14bb7f43706daf239383d3ce6606
SHA512 ee6893eec557b2ee26249c478cb4ac97b116360ad944a705414304b7f19af0984859fdcdf9057a375678bb22b86656218a3fbda52cb0c0ec2bbc0844e4c9d0f0
SSDEEP 12288:dPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:d0NyBo4kx929bL3Hnx
TLSH
T170C423125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 c317da0dfd162c488429b40ff8f0150521247a90cffcfac9ce129ad85a414b0e
MD5 af84af7576188fefbbed6ab10b5764bf
SHA1 2cee5187c65538675cd0bc5bba4a2ba8932d9252
SHA512 4d514241799ca9343c39a62776cde49be39d1377b34bf44e22e270c0ad1a5c151544d5fa3a08dde9c059f316fcf63032dbade862633ecbf9b40f4238542bfa78
SSDEEP 12288:7kLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:77NyBo4kx929bL3Hnx
TLSH
T140C423125A0C227AF76D3FB0654A8554CC34BC8F1E9693D8EF279C7759FCEA24A21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 1828bdf7b1a47e39f4e2db6677efbea8c4fcf53635e708327136cc3e76012431
MD5 2ce9cfe7f238e541a62c15abdebe08f5
SHA1 7816a3456b981d9d453f647262a57088c3917628
SHA512 585815d1e55035919e26cddb8d41df0e90dae9122a3665348937095ba267ac39c2261c8c1ac574d6e578d9c3ad3f2497d89088c72cc5bfda03699b00ab4a5303
SSDEEP 24576:EfwvUk9RX6wkyAI6NyBo4kx929bL3Hnx:AMnYIpB+kn3Hnx
TLSH
T1FA35DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0bdb652bd4bd08879735fdb2e1334bb0db60d713339be770d1382490a6b162d5
MD5 a7f89f2af5b84eed7091282c53770bbf
SHA1 ea9489297cd8e53c758688f7ee3c671f1c567edd
SHA512 5b64eec3b3cc01b5697b837186a8a206a19c3fe226218cb6e3bb103969f316a7a848efa8015239b2cacb0bb59668ffee786bdd5e8c0edbb7a0e52f27d9a2d370
SSDEEP 49152:DYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04B+kn3Hnx:2ySzPc+k
TLSH
T119066C56A1A801D9C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d5635b39c812dc8795461d2939fda929e5a6265e79c20ae14793e08b0cc81a40
MD5 6546cef098b3d4c610946234c9b3f7e3
SHA1 ef511e51a930698eab64cf399922ec4f0bc8c5d6
SHA512 93628cb92344e3f928d99a96307766ef0336764e5c05adc18cf2d47315d3ed45185f67f85c899410377b28e5a6a59d40a3ff3136dacaa30d850cdbd6aef49096
SSDEEP 24576:I47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYBNyBo4kx929bL3Hnx:I47JUQjTirIhCnDHUPfF/oB+kn3Hnx
TLSH
T10665BE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 11921d3ece0d58bebaeb4a0d60aca2552c1bdb211033811ffce0c408ee10b0bc
MD5 b7163f0396f2d5b071021e1099714596
SHA1 a243aa4ec59f6ff89eeb9cf82e47902f62b338e8
SHA512 fefec73bda795e24dc9d916e6f10da1d4ebf78ba722bb27a27d6e2757296600ded912f6d56e30c7099962ba2d52103291b9889dab6cff12d31ae550e3308e1a5
SSDEEP 12288:wbsf5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XmNyBo4kx929bL3Hnx
TLSH
T1A4E4F01AD25812E8D16E2274C7468A40F7337C5A47E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 714d2f284595d417cb1ff215dc97499c63f75322bce795f99d35e43cc520f9a3
MD5 6d54797728fae5545780513482dc31de
SHA1 919f563643708f28efe3704c4cbed6f93aafefa0
SHA512 d728660d13c12e8102d037c856d49b2edd6e04a6e708078b664a0e6c40382ecce3aac7810109e6b19822e257a05ae4a2bd5f228caa3e54272fa6d7f5a47294c2
SSDEEP 12288:sfQ1PcLU3fyBUAoYe4t/kycqUFwaRMW9JgfVfGn:sfoPSUPkUBSZGwaRMWjgfVfg
TLSH
T1EA351841766ACB5FC6A940321E32D2CCAB707D45EE056F0373C8973FD576668BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c1aba2586195fa3df2cc05ddc2168c14f365cc67e1771d6c289293afc8979e72
MD5 37c7dbe25802bd5f0d6203be0f178a02
SHA1 5a36ae622b9b955817c283315f0ce716b5a82538
SHA512 242435fd2a6720278212a59085208bf59dfc202283d8e4a2cb8aae038cccb713d2e260c4ef83a3d515a9bf3cd55d81fdbef3c347a57ee90c162ada3c1b86cb7d
SSDEEP 6144:3A6vtyfv5Dcx2iNu5j152kVJuSD8PknDjskPetMxBnJyw0/LJ5QSY/2H0M2g5iPO:3A6vtqRFiNut8knkH2g53RoY
TLSH
T12A65FA815137A38FD5FB6032076A5B4CBB64EC06B7056F27F388453AD86A725A0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 02943bcebf4d51151ceb897c75188ac4317b41b7021b7f4bcd4c1dcc79a7d494
MD5 00df54934ffbde74e28d8702fcaa888e
SHA1 85e4261fde6d58d5c4b31013df58b398bd559d8e
SHA512 df40d51543fcb5a4377417253fbad0bb45eed3c4faf9bdd5e1367e1f28a55197170a567e6796a741f8d72b95aed93c1d98168de4ab8a0d1894b760d27fff8016
SSDEEP 12288:i07xLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zONyBo4kx929bL3Hnx
TLSH
T1BBD42312975C663AFA7D3BB0645E8124CC39BC490F50D6D7EE1698BB59BCED28E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 09e72091ba3d9fc44bf1115ac8a5b21475ae6ad239bd220cb1f37605ebb49c06
MD5 30826513ef6d33e8e014fff0f51ee560
SHA1 8b308a02ef20464c4dd9868d487ef58f979d977f
SHA512 4dd6a498ad1197fd8d185d29511514aed506ce5f21165f9576c4bd442252da702351072a24ca2d08e28d688b3b48eb44e5fe3dd84c11864f17f273a99370408b
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYINyBo4kx929bL3Hnx:0gb4mBIBhGFWB+kn3Hnx
TLSH
T18865AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 210e5a151110e478e63a31bec6b9a25703a938b7b7d611a9391a5244ca9dd81f
MD5 f56a1d103db360d33419e90c895c89a2
SHA1 67c9226488281bf5de47e876442ae89251a185f1
SHA512 5e3290abcb784a7eb385842539518c3318839de33cbf60e4b060629d62d9624e055bda75bf42f8d14c0b8c2f7908f8e8f9bc751d201919928d94275806855291
SSDEEP 24576:4G88u8FpJqH1bzria7/mxNyBo4kx929bL3Hnx:77ZFPqVea7/DB+kn3Hnx
TLSH
T10635F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 6a749866199c93753ceb021664dba4b711507740524d2db7d1d4a654ab717a74
MD5 89e726b6c7dd63adfab05712588fd1c0
SHA1 0d552606a0e46e5b13fba1566369eece462c50b0
SHA512 c2253b46987c0698e399dd4241188427b8408d92045ca73ca6d68724fa99c1d4f5ff7d4c93804c552cce0cd22d065fb8f3e0d20fbd7a107d8b39e68ae95c0b13
SSDEEP 12288:QHvUrBFrEjwaQeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QPUr+NQtNyBo4kx929bL3Hnx
TLSH
T1D805F21F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7b39d46a742775b26e63821b600e748f3c2cbcae5e7a8aa65576995563d39734
MD5 f99b98ba31e46fc3d4abd0f2e98efc9e
SHA1 ec495aa2f9b151a4553014b37a92151e8a9de9bf
SHA512 9dbdfdabcdf24791820c95f50bde1093dd4513848055ccbe57bef787dd5ceaa4cb25d81bff770c239dc8a65a41d7e55e693767e904efb0b4bd005efe1e37deea
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaB+kn3Hnx:QG05lO43bH+k
TLSH
T164D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f46102845861a28a8629e7e9b62bf27679d46b8e1c7d93231cbafe275f9e60ce
MD5 0069148b2b64e20b71425ebe444a3217
SHA1 e734a51d8868fe3714e96fce51e283832de51627
SHA512 a3c2513d179d882e86472297ff61b6294e1d81a14990ff339b2267b5ddf491cf72fdb918db91bce558c226dc7a987017c7d10ec18c9c7c5802e384cdd7848ca1
SSDEEP 24576:Cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn3NyBo4kx929bL3Hnx:Ka5POZ3BJt2pasx2+miB+kn3Hnx
TLSH
T18865AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 503487795f0faafa6a3203a68ccc351d8299381662b18249c033e4981e913b07
MD5 f82f5413970f76c787d2f2e26abfc011
SHA1 d385a2203ad554e6c953cbe8d170b18ee79af3b6
SHA512 7f67804929c237547621635f1a3f76180bc78f6c13ce39c62686af1e25d1c345622706af4ca70ba79e4b6011f5924b44287078b327134e7871499c0041e5389c
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkpNyBo4kx929bL3Hnx:HNc/zEOVHFjB+kn3Hnx
TLSH
T18C858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 729a562ffbaa42de137cd92a21b707b411edf63eef5e9749bc58db299911f9b4
MD5 e6ab16d20ac1fac230a017fbb3556cf2
SHA1 a91e8f8bd5047d701ea7e8f1a8fa143861400c36
SHA512 732aeb3056a532ff1e9fc512e087ba1a7697d0d8167f4ef1e56a9e0f8879e658d8c4695a24566655d5787a17755524645eecc9ae25afa20332c4bcefd99aa1ae
SSDEEP 24576:nTkNvNnaFeYhJNtmZBm7NyBo4kx929bL3Hnx:nTMwBtOmUB+kn3Hnx
TLSH
T1D455AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 0ba3fdbc733d373979eb4dba145e3e4c53517f651201d4c12f787ead9d5ca16a
MD5 d4c75f38cb155362f5ffbed79d2edcb9
SHA1 b3a311c75c256d89cee50271251ae0f1f6ff021e
SHA512 dd4394bd31afa3465603e8f0e0fcd4f429b0033b3057c6f6492d83ea721a0abd5b0896617b1144bcafe8babaafbb26527acbcbe744a26595b5dc423d5e1c79ca
SSDEEP 12288:fQcMxWDXN1Dp/fshBItT1IQgAtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:nD3FHshBIYQgAyNyBo4kx929bL3Hnx
TLSH
T14225E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/852-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/852-21-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/852-16-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/852-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/916-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/916-72-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/916-286-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/916-66-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/980-305-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/980-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/980-92-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/980-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/980-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/980-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1376-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1376-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1376-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1376-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1376-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3664-114-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3664-106-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3664-304-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3664-108-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4508-269-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4508-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4508-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4508-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4948-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4948-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4948-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4948-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4948-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5220-308-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5220-7-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5220-8-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5220-312-0x0000000140000000-0x00000001400F8000-memory.dmp

Download

memory/5220-79-0x0000000140000000-0x00000001400F8000-memory.dmp

Download

memory/5220-0-0x0000000140000000-0x00000001400F8000-memory.dmp

Download

memory/5220-1-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5248-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5248-301-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5516-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5516-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5516-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5516-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5604-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5604-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5604-81-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5604-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5604-373-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5604-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5836-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5836-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5836-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5836-126-0x0000000000750000-0x00000000007B0000-memory.dmp

Download