ea0914694bdaa4a9cfae81c4e526fd28fb66569807d92b06f763f15affa01d53

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
Size 2.4MB
Sample260816-bcgmtaxwhx
SHA256 ea0914694bdaa4a9cfae81c4e526fd28fb66569807d92b06f763f15affa01d53
MD5 09299318db8bb21b6093a810504e2ac2
SHA1 a8a9dc307ae1044273368638d3a4cd167b14e5ab
SHA512 49097684d6779659e6cf609179b459156f899b223c6b6373bfd0860779554972ec920cf50efb85a1f7ba6e96c8d7b994cde138f9b4d26cbc328fb9bd17aa095f
SSDEEP 49152:SpojL/+cPZpJGmF+Dl7mbN6ZNjshcYpKkjsVc2ot4+Ej2ED+l3eFq8umYDmg27RN:tZplknGMkjsVc2ot4+Ej2ED+l3eFqcYW
TLSH
T1AFC5AF29F6488195C17AC17C8AD6CB4BE7B1B40D87359ACF508507DE1E63BE18D3EAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4728	elevation_service.exe
1812	elevation_service.exe
2572	maintenanceservice.exe
6036	OSE.EXE
1044	PerceptionSimulationService.exe
2648	perfhost.exe
5348	ReFsDedupSvc.exe
3292	SensorDataService.exe
2960	ssh-agent.exe
5292	AgentService.exe
2856	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\91f561da238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a64fb951a2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bac39a951a2ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ccfca951a2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5387e921a2ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008df800961a2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba022a931a2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe
4728	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
Token: SeAssignPrimaryTokenPrivilege	5292	AgentService.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: 33	2856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2856	SearchIndexer.exe
Token: SeDebugPrivilege	2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2560	2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4728	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4084	2856	SearchIndexer.exe	101
PID 2856 wrote to memory of 1924	2856	SearchIndexer.exe	102
PID 2856 wrote to memory of 1656	2856	SearchIndexer.exe	103
PID 2856 wrote to memory of 4132	2856	SearchIndexer.exe	104
PID 2856 wrote to memory of 952	2856	SearchIndexer.exe	106
PID 2856 wrote to memory of 4628	2856	SearchIndexer.exe	107
PID 2856 wrote to memory of 5024	2856	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_09299318db8bb21b6093a810504e2ac2_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1812

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3292

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2720 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2720 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f7ab631fecc1ad28a16778631950b154a9da86b9a7a649ff29db944d37050e37
MD5 4e1e8955780d1f604b64b435b08eef92
SHA1 3719c209e5d7fe8f72104a5d88684390c47fa9fc
SHA512 988ffe5c03b60d72c6bf900803cebb1fca44ce9d08415fc53cf84c6bfef9baf2fcdafde9416e2cdda079400a1a864adea2c8f05a4ebd53b5dff5f9117de54abd
SSDEEP 49152:bb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnfDmg27RnWGj:p3q60jBUD527BWG
TLSH
T19CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b3ce9bdc8dcbf35744d8469a5e5addc58b4ae8eaa413d2d2f9bb38e7253004ea
MD5 d6dd51d3dd391f1ac8443f622bcc948b
SHA1 6ab918ffed59bb72a86ddc2c2b784c5fec8d48e7
SHA512 30b248d7bb635b0d361546caad811d68911fa0808ac0a58c22420ae42dc226779f485744405f022cb3d84a3bf45e0457cfecb7ce73a8f2e9ad6dba342395992a
SSDEEP 24576:9XYfDtczAUsqjnhMgeiCl7G0nehbGZpbD:otcNDmg27RnWGj
TLSH
T1DE650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f2fdd9fad408ada6905d0b0055027e2082be2a3ab4ebf9e05c9d87d050531afd
MD5 79888b6047fbdb0cc5fdb0653eac3209
SHA1 9bc50a212097d7196122cd57980c5efbd0349395
SHA512 52dd77099f8acd0956456dcd3baac561db4b5f898ab22df458aef5619476c31cad4ec7ae4cdf436ae41950db64bd6eddd2c5269b1aff1198dc1ad0f47717f9a9
SSDEEP 24576:e0Le5ji0hmxNrMzsqjnhMgeiCl7G0nehbGZpbD:ePji0A7SDmg27RnWGj
TLSH
T16D859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d59964e09a0e588d805f02a69eda0f90060612393f2663e89db25fb7f1a81773
MD5 e9960887c1ff894321499cd47a3191bd
SHA1 d59342d99c1f9fa3442594f79c34cab0b098b651
SHA512 f60e3df89ecf92a772961fb6e832556ed79923a95b6af2ef7eb72f7cad744dd9c859f7e02642b1b410c13d4bee6d06397796913e418aa43fe1500b369d9295d0
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWr6q8wyu5sqjnhMgeiCl7G0nehbGZpbD:N/ezSC6vUzPviHjy+Dmg27RnWGj
TLSH
T16E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 abafc2cedbbed2a1dac2e0a9d2c66eccc36a2c05f3040d2d95ca1f26e6a6546e
MD5 e765302217e61c405a0e98f9d78e055d
SHA1 635f0d7f48e4c369ad34d7133df5503c3fdeb090
SHA512 70a06efe8f99188322650c048943617069cc4cb29de34660228f63ca8b65bf4be3e6ed09ebcf4eeae0322b10b65c7548a2e3f20878e0d59ad4dc8a9d7d6cac9f
SSDEEP 24576:yVbqPb88hv/l+bYsqjnhMgeiCl7G0nehbGZpbD:yVO88hXl+YDmg27RnWGj
TLSH
T1E8559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ba392be978850da30533736519920c84e5a673b6dd2272f44f916abd0694fbfc
MD5 756f75d115fa2c24b7746594a01419c3
SHA1 36a1c005fdfa94dffd1ce2f6fb0675b90490a0e5
SHA512 532b3d896f2ad03d804286e9810ac7b7037fbf5dc57341a04308357c752c10702224a27f1b6086562a94c86eb4b3c681e781600b969d623c6d22bebf28b1e033
SSDEEP 12288:ujnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ujnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BF964C50CAEB7608B5C3E9F11EAC137E5698200853AA637DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9531ef584a06c762b141363d0b8640a6a709e01e9987cf31592300353cab55e7
MD5 935617ae4c23a8427e735b85f9cee606
SHA1 7fa2bd666f986e8a91aa718c4385dc2a08c70a36
SHA512 2ef66852ada25cd6db2f42ba786a100d64dc5b7c6165f36a98e6963593e35c3fc9fa55538cc03e86629b7ed6dac8b5ddaa2a689ccfb3b2cd40159362a3ed279b
SSDEEP 12288:HeBNUbTVO86UgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:HJIUgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ae80052df2239cf6ebc8bb7d2ce6b973003259657eecc16ae1fd9061de7f6dc6
MD5 70d79c33be3cbb58634192d6e6fbc691
SHA1 85e66d2cce7993c4b7760fd2e6c283671c912b01
SHA512 0567b60eb1bd7e2acef9684831703f365ef644db776be4eebf1c0a55a2076e084e391bbb226a3c79b159fdb239300a00f4835b0dc51e3b425b7c31ce381a3277
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THP:UQvGAdlCEL8c/RRNw5CtD527BWG
TLSH
T1BE266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f43ff03f4d8ea39434988ea9249f30fb35b13d7b09848650a5dbffc40d9dd7cd
MD5 1dcff945fa7eb8ad5f37a814a793674f
SHA1 4029ee7ea6a7841399b4e111a8368359409b08b3
SHA512 a5202c2a5255fb98d22e096efbe0919e9c94ad2ea3649d914d7668c64df2560439cf9ac3d5c9a06191c7035c9959f7f069607c9daa240090eeef33dc8bf339bf
SSDEEP 12288:xAwSfxL/2Dc3DDLLmt0LDQewsAjuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:SSewsAjusqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7b42f13031effa89e97c9da1ccff9669ef99efba3af5f0080fa1ec2d2d10088d
MD5 068f924e819e16fac2a9ee5cca6df91a
SHA1 a2ed3e911c35623ba0d6ab3734499ff1d0de6f3c
SHA512 dfa1c0f8cd5b75972b7d7310ac4db3a698f400b23764b91e023348cf7d5a24b75c3d28f50fbbe9fe343bb50ef7edda78d4587d5d2ee0f6151bc3c21663bd37f2
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHKVQBWG:CUEtQevvqc2W1cpV2RI32dB
TLSH
T195474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 09e7bba38d67ea6a7b1f08b21f627fbb23ae0e4a90358140653035f441895da9
MD5 a4e0d6120b421a0a8da87cdbfe44988f
SHA1 d124853a9b2d17c283e13cca97e1574975d1f53c
SHA512 6a790f19aad78f2e99691bd12e9297052326fed11017dda6a7637610d5607c6090de2058f2d75a773c7094cb3416632590b53d9c2f9cd436aec36995a7325356
SSDEEP 49152:NCbRquA/m2yL5zLfFiV+XenmE3/ziDmg27RnWGj:qoq2VjnmZD527BWG
TLSH
T1F6D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 975fd1dbf949972890af2a8bec5c510e7b8cb119d4a9eb287e31be5a952f9cc7
MD5 1f3ffd7ead2ff587368c624870a28456
SHA1 2f8d18f9f2c02948d6b4e91c0586ae8b56b8462f
SHA512 7cfa69a336e2946d2d8ca35d925c1df216abbb6e7ea26601f4b97fea33a473e1176f0d40be57ad0b91bd14934dbda52be525cc3bc02cd9229f611698715026f9
SSDEEP 24576:fAhGL2IFoiwtA5l7S53FsqjnhMgeiCl7G0nehbGZpbD:fAM1Foiq5JDmg27RnWGj
TLSH
T173359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0f8e18713263cabb1d8a38c5da6b32bc6e17211d894795d6ace0bae5fea52697
MD5 09d19c130b026b4a6d4a450766e49f62
SHA1 cd759f75043e12e17d7bf559cc3f5f43ae67e131
SHA512 cd9e2145dd839af91ce84e3dc76e6d9c7d718a535f587ef566df7e76cad69e941cfe286df55dc9c6d0541f641028f19e28a670954e6cd5d5f3afac9d94888dea
SSDEEP 12288:Bmw5HEjsChNSBFgl0WDm+CZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:cwuXOWKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A165F15A76A80CF9E9674138C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 98b5da1a9c682c7dd3a2406004cebb455c45500edcca8ee5e9540adfb04626ec
MD5 d44b5446aec47fbf9b8fc1f62129c151
SHA1 d93be3ae416beb582d53501e59232bf3800af797
SHA512 2c9175af2a2d57406073b7e530a566b97c9692de143cc487126768853c575814aab2f496e8eba7f35e9843950cddd7ad553fecce63fb290dec865ced3beb7d48
SSDEEP 12288:Z/Z1IyeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RZubsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB5512AA239820FAE163417CC5E5D609E7333C62673043CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 172a402bffca4257b3f76a61d8f25f08173049bf2839d566ea2f156281d427ce
MD5 8387133a59dacca31c9871bd74d3fa3b
SHA1 57638b4dfa744d6f11262d9df46cb1eb74d8cdbc
SHA512 d0b6da7e9da3589869258b4e25a4e3c45741f43cd83a63025d02cb3f029dcf731f2295fdbd530d4cfe25ac18b453426e4b192a823cc95006e2c8b4d6c7227b6c
SSDEEP 98304:vQRQyi36YOcPhLvw2gAf+PN3ID527BWG:eQyiKahX+PNYVQBWG
TLSH
T120667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9641f7402fd044246dc799eb334f4ad959ca74a5d777d01e4dbf01315bbf8178
MD5 2e2ea3fc6df637f7a7f1c58a76cbbcd5
SHA1 26e1d4bc34dde330e144ce4e51ca43784a49e2c8
SHA512 f5f4f38a8c6311bf1c358beb88027d5efbcc77f02665429e0162fc09149dce0ece19198091ac12a051510491bf7d4d4744fa1365786f2768a5682d4328168cb8
SSDEEP 98304:sQRQyi36YOcPhLvw2gAf+PN3ID527BWG:zQyiKahX+PNYVQBWG
TLSH
T14A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0a58baddd5c24ffd4450de07e3efcde8b3bb58d770da396a7c33bba577fa394a
MD5 aa15d14444731fec6268157b2dc8f1d7
SHA1 51c006ba07469b59a24e2e6138188710f7908f09
SHA512 7db784ab5dfbe0453208566421f09ac5ba189fce116d259b69d321d70cd1eb31b49aa7f82d240107a4276f02e79d720f783bb67adca5135a1f5ab61bdd2960c2
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0rsqjnhMgeiCl7Ge:Q68Qg55nhceWu7PNU3/SDmg27RnWGj
TLSH
T142B55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b3125029f68710747d83e8737105f0fe57a7d8acdfb92360e3981044166264b8
MD5 f25ee312c0c559dc8b94ca9e1f98021b
SHA1 524242587364359000f7e547ceecc9b1fffd26d3
SHA512 6ee71e0dd6d7ad280394ee6d28e7c7f2e1251467bfec70613c8aeecfb955d1b58d8a5924874a164b15854618b74d52fc7b4a78301a79761eccdfe4cdeffb91dd
SSDEEP 98304:ny5112gYy5azzVva69nLKnhZ7D527BWG:6LIHjWhBVQBWG
TLSH
T1AF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e400d836498a7048d51d8bd9881020d3ea4c5122c6f6aa9982852f044765af8e
MD5 2a65e1de57fb1fda5a36c95403953125
SHA1 03173d86a6df6124947f4bf023948d78aedc65b2
SHA512 d6a88916f2379c8fce276f85aa992d1e6bcd362b0699a1cb2473aeeec1bd5a61e0bd5797b056cafcd06105300a953207b94171058e8d5398be0acb4d40c2e27c
SSDEEP 49152:/B+taZ3usBWOBr4tEG20bqx0z+n217aau1glADmg27RnWGj:Bu6JmUxd2dAD527BWG
TLSH
T1EDD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b76e15d3722d150ec8b4e83c56dd19a32369ac1d29daea3d0bfdbb3981b93a70
MD5 2f89ea42d0a7b9660e207865e4462521
SHA1 0a82bc93b639f617bc05722e98fc9f3aa9f4bdaf
SHA512 9afaca733ed5b5b5b0e72cee13d6a633d3b5df6bd5bf605e5441bc180314cec8c1b2232a31ab53acbba2c1e37bccd56c9a131629ed9d916d9129b211add5964f
SSDEEP 49152:j1hpsNoJpF1A6BU44CwH7R4x8Dmg27RnWGj:jmifPkRZD527BWG
TLSH
T17FB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 93a0fecd9a4dedf1100d93491fd71f7a9739fd684536df20a3953b789e31ec3b
MD5 e9dbb083e2179afeac84ed53fbb3e736
SHA1 5de4c7200a3551be2c14d1ef63c444197f1ad062
SHA512 7530f8d0739bad52461a0dcc0b3ffb7a3dcdf14efb07af02412113a2e515db4f2a687cfe6dd2fc68b0e122e918c15ac045e91244d572de1148fa1b46bfd9343c
SSDEEP 49152:zSuZQIY0Be2KNRVtOnks6NMHqPDmg27RnWGj:x5dKvi61PD527BWG
TLSH
T1A1C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0627b34b8ca8f304ab455327d83f2eac324438fec42e934b9d13b7e6ca38973e
MD5 6cd8dcf0b8eaa4ef3999bbc77bb0578c
SHA1 16b2bdee302a68d66b5e749e3edcbbeac20384eb
SHA512 3cd3f637be66ce604e566ee14cd05713a4974cd8b680a4d76c7a8caf6a8349d5227b0caf263249c528e4b85de3173fb11bb84056a3fed13945981378ec85eb5a
SSDEEP 49152:LhtSn8EApI0figXgiDn0AP5wwDmg27RnWGj:KX2iyphVD527BWG
TLSH
T1A695BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e80da818138cf9353b146cc502f2d46d8600db54ba4a32ec8d5920b3e34a9e8c
MD5 1cc7b867244b3c086a4133098c81597e
SHA1 fde4bb7d16ce05cc2ddcea40af473b2a14fca387
SHA512 5116fc2c9725f6fd06da3b24342f3fb628e93bd02e35fa1076c6f4118be6f83c0099bf08ae93aed4f298f87448bf392dbe1101cdaff6ea9385d3ce647980e7be
SSDEEP 12288:LPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B4523BE964C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ac9b379d0bcd1aa8b27c17f5af01de5b2a4ad70da9b6f82ab34971a40d5f17c9
MD5 c25e42c4bee6f258263cae603ffdbe96
SHA1 57aff9e511d31b328182de97d4fc38c2c498a5ef
SHA512 e35ba00df7a7032dac0cf33388c6f9d07371c1dcbe275a4c4c6fe8cda4b607bbaa3aa8886871a2b360254f379de10e4407dc3ff983219f084583a42a3323ea30
SSDEEP 12288:VCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BE964C41CBE52648B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a3eea4ca45974739c04b9c3f9c848b5c9878ec45ae586d6bb693f6c898e467cf
MD5 752eae8162789bd8cb5fc6667be9c828
SHA1 967ee733a88ad047bbadd482062cb586933cb305
SHA512 58aa090f0200e8cb30d49de941ac13e80e64357fc8e99aa1d015d173ccf7e650f85b265bbdff8afac3f4b10b23cfeb34e4225c9093d30abee1647054fd6ff4c2
SSDEEP 12288:CoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 269e29e285b4fcf23aac6f630842c262b95eb6fbf348842809b5bf9bc608e032
MD5 5b43780b0b10dd3f1af97be71b6efd42
SHA1 40ac7e73166fb376b9732010d516338995bef3d4
SHA512 fc5ba426b813b3cc0f2ed2c535dac650d86a283ef0cce7783cbabb6ed9f1a25f73dd252c32d6c28020b337d834f5e753f7541c52aedecf9fd1efa64181a8a0e9
SSDEEP 12288:kVlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T19145237F675C00CAD83285B4C2F5E11DE8237D56EB30059B6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d865164f187f791d1c9aecb7dd558d05351974e49172a411a94144f7d9770266
MD5 733f9bd4609e671caf54f65c1e79cfd6
SHA1 7e94b44fa298320157f4498409a984ad45b33394
SHA512 b6611429ad10463bbd95b49bf23c90b6b77b3591677b671aeea193f47bdc00949d41fd2c69dbc3b1eec497e3b02bdeacfd2af8913827860364b322d398f80f3b
SSDEEP 12288:l9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:l9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1524523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4a49379c008efda5d0e958ea74b61c8bc3695ddb4b0c46649f161f2d053e60fb
MD5 a04fa2c709d37b45cba3698cfd661ffe
SHA1 87a4f91cf243231c47fdba3574be3985a6246e09
SHA512 35132c288ef0493720934cba47a36364ae554322bc61397f90f176f19b1388cceb5d3db83c3416878802a2b5d07dc155d824d6411ea6baaaacea15aa44e76219
SSDEEP 12288:r2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BE964C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b3d68ff760a29ce3c876f7f66895d49602212305e060774b617d07496c5ce831
MD5 49a0ecbfe84bf036aef8a958f159cfe2
SHA1 f0c6efed6b9c6aaafb9162cc30186f4b3a830c36
SHA512 ee11fc162369006fc1be03a6a8cfd45550907e14da39c0eb7d4a4b4b46fbabe5b6e35b7ff7d7ec16c013de074984b119003c0e295387138b16ba1e471abd481d
SSDEEP 12288:daXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BE964C41CBE52644B5C3E5F15DAC073E5BE9200483BA6B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 949acad6c592b22450c54df1a49268c3bf5f36ac40a712e2088bf8de7ad74c5d
MD5 a6ac9af5b68281ef1446fa29ed88dd1b
SHA1 e5c9e1475ce7fd762589165c49a55dda5a277205
SHA512 44e3608d3e1d872726bdc375d05ac0f52c1fdcd4d8c6853dbcd7794151b430c644efaba44287f3089d554fafb1eaea147228da4b0677bd09be85a12eb2be05da
SSDEEP 24576:cZMMzFVSOisqjnhMgeiCl7G0nehbGZpbD:cZMMzfqDmg27RnWGj
TLSH
T15C6501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fda75295a84c75cb6ffeca0c412f6019ded9f1dda0783743035ed3c99f05a87d
MD5 6747532d3ecb580d994965fbb320e215
SHA1 911f0dfcc542ced3aad8565b111828810c8cd9ef
SHA512 2a3214991065e480db93c41d43b04aa9b5c2c74a457876407a8f926825b39dfd9a0bc06a5bb5e29a3b5790c605bec15c993352c072c0285ac561036300632d1d
SSDEEP 12288:OLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ef633f4a2ba7bfe2f206084572386fe30218de4178889405daf6415df2bae8de
MD5 4606b3ba6b9a8cabe9b474bba1860ce5
SHA1 d10b5e249881a734ac60dbe9f0b8e8baeb9298bd
SHA512 0830aad0779cd355c7bf057303f098e23e41876886339df9ac9383cf85f468c71818fae260b182e30e5d460586e971f0d7f38e2134dd6b3449520b6c513adf9d
SSDEEP 12288:CXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BE964C41CAE52644B5C3E5F14DAC173E5BE9200483BAAB7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 20750688147b8d2185d818566f72145c83dd021fac4071acc396acc85b8f9cc6
MD5 11ffab63a5ebce6cf722ebc5eb85a3ee
SHA1 fd4d67d196f6cd90f2e52e10467f0b7ebd500495
SHA512 7ba3a2bfb91a778c79d34415c6f571316c47eac240d1089b3aca5d4ccbac7486e6b0c615515ded9891961a77a337376816ca20c06c166aee0698a462a08a6442
SSDEEP 12288:/yPz5L8eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yzyesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD55025B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9391115781b79e686eb9934461240dedf2fe8c8b3835f9f27a7ac695fd9aab80
MD5 9dd36b3693ff95db874bc0774ee6e942
SHA1 c20ec00fcd8b6bd9c7e8bc1ef14b1e312e969eff
SHA512 1c18bbd9235e781a104ac9272e7603e49a646063d5972a3c71b20a68a12b3643c05850306632c72424044399931f367c02622a4d240d27078bbe3565f29b6eb0
SSDEEP 12288:zLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BE964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 569053161427b170b5cc313444c9e92b27c80469af6ded80ca30f60338ec492b
MD5 474ebdf58c799cbab7d0d577ef02fd89
SHA1 2a7fd253baeaaa1b1d001f20b2d9b1e13e8ab952
SHA512 4e5eb9a9bb0369780f18e6eeaba5b42de61ead2389b06582502ce9fd5b0a9334d7c24e1f717572e4e0f67558898cedeafef96c69d3bcfdad93cd57e952ab5d39
SSDEEP 12288:BLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BE964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 723e5ee1ca74130b0f17f02bd9017fb9004a7a5e0cb275d7c510d7462321f830
MD5 af68e9ae1e9b331243c064d470d92c47
SHA1 3e11acf05465c336f7aec7f82f928ba51615bf6a
SHA512 0c1b9c2294911ce2f169b473d30f792c8e8e71f7eb1fb7cd9098c548be6525a87318028b3c5aac8ab9fae280098a4383fbdc322ef6e3cf135b11bb5a2c7ccf5f
SSDEEP 12288:1yPz5L8eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:czyesqjnhMgeiCl7G0nehbGZpbD
TLSH
T15355025B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 adc3b53f0e8322e16fdd99e5d85735fcdeee57d15edcd5f70881cd8e30175fa6
MD5 19a332128bc819501f6c574444193433
SHA1 928f515cd00c8cf6bee37fb81a38d55625a8dfb1
SHA512 a04dd5cf75da222910971a4df47979f272014bdd3fbea3e6bd7cd48ff1f1890021b061d150d8c1fcfc5d0ffe4ad475fc68eda752d89e45a27e6cbcdd3b2255e1
SSDEEP 24576:AT9aLl3z0zD4sqjnhMgeiCl7G0nehbGZpbD:ATQLlj9Dmg27RnWGj
TLSH
T1D46501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0bfbe5fc215f806e300977885f04c6a643281b8e9ccd6e0487d0a1cc82229ca8
MD5 3ee77a0494e21bb6bd97ace5040c6af0
SHA1 b3e6f2a45dc4aee810c2a2d244cb6014993fbae1
SHA512 e54d9a68ee63ffd2c936eeb8a119c214e78617690d8b3c0908c4bf348fbe47c52ba7c5a95f2c0d303d8b5e1e891ef2dc1c841f694e1767dd41cd6e0e81d27810
SSDEEP 24576:Z3td9CHKy7GZ8sqjnhMgeiCl7G0nehbGZpbD:ptd9CHKyaqDmg27RnWGj
TLSH
T19075CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 376861d8014808bddb70aad55ce53fdc1528865e32ee46b31fa0eb8463cd66d0
MD5 486077368775c6c269fae16a4a42152b
SHA1 dad3d5b7d826679eeb83e706541af76f01a18fcb
SHA512 8fca3e9bd5dc7e97c264ba0fd7d90c2726ef9a32014b551ccae003b8d73e25216bb809043635c4b88d041a093ef07fe88228f420bd9b092a8f6b0574b7770dc7
SSDEEP 12288:XIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bf45dfc6c141d2fcfa673fde8a8b6c55647389d313c5105c1346b55c8ac95964
MD5 d5565bebd6f342d32145b554bb528ca7
SHA1 446c88d76f61404e339337d7fbb33b65ea5216ee
SHA512 392f6a76ae19a9c474476db476502f9f5ace0a20e78ca5cc664f3dd65168a083f194f14d27ef6a3dd97a199c7dba10b0469e8182939ec00464a429405155947d
SSDEEP 12288:3+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E4523BE965C41CBE52644F5C3E9E14DAC073E5BE9200483BA977CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 48f2f555f642073392201b4b09278828c495b6355fe94d30d5d1b68e9fd6e185
MD5 087011489bc72df5a064eb76775cb30d
SHA1 c7a389996e0acfe17d6511c60466173351b9c04f
SHA512 a54d0cf850c8d7402f0b3fc06eac892fdc3a766c5a7bec48f317571a4f7536978eb7c8542e8034a390d2db14dbc2394b74a18fd86b327d0a76bbf2384a6ace6b
SSDEEP 12288:kxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1234523BE964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ee07d1f2f1632bdeb1590d37baacb5320f47571e0c6ca5f4a294a63b80486794
MD5 9760b945c9f8379ece397927a538c012
SHA1 415e936260a99c975c0e7294c4bba39aaeeba022
SHA512 41b88507d16fbb39e909fdf337650255d83c07a64c6ba9ff2990a49a3b46822193c041f84c2727e2df2e2c4bad29a2fb8def806b997ca4599e92a2ded2317bd0
SSDEEP 12288:tLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E74523BE964C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3f2e6de5941aafa43e01908165f859ff4456f29fa22510a16f61629322074c2f
MD5 14ee42ed27aa23341830e3bb6d61e2dd
SHA1 f08b38f999a455cddfa6c816af2001b01fe08835
SHA512 6498e8d86be7ccfc2b4b4ff9dd94d6d05d800368be839fdde394c9b1a1681b3d1d988f5ef0bbbf7ef78bda6dd00c5e1381acfa933adbac341f87b03469dc4e90
SSDEEP 12288:YIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6adcf9ab06cc76abd331455cb813f6eac707f9461a28c8a3acf85d3b334f4661
MD5 ba85e35f6418f0f2df86b0b5554bf05f
SHA1 a8961b75cb3bf9f5f1d339e7b2a10bf26d110f95
SHA512 01b4dc2e91387354dd8e7632f7e6c927aaceb1b56054196c71f6aa848ac8b2c32bd934f96a5d9cd18b7f0fcf8f7b867428280c49b4542b6778447e393a6666e1
SSDEEP 12288:bDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BE964C41CAE52648F5C3E5E15DAC073E5BE9200483BA9B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c8da26cb94ffbf1e9f5a0fbf085165ae4a74110e973cff46e3219497087f0793
MD5 6ba72ea21c1e9ed78b0c4d3261fb9572
SHA1 9ff9a3c9a2f2e00af08a832f349d51455bdb3546
SHA512 82a07bcde8d2d887254ec989db3fe37e650b0eb3331077e6886b48f2822ba1a267d1904b18a6113961b05d8568b9b037d616b0933d94932ea21c0a5c1b5929e4
SSDEEP 12288:T9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:T9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1534523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6c403d557ce65585da6d19bfbd7f39d7bfa0bb05dd381388489e77e52530065d
MD5 973d29d2647283c0a9f32163e0f6d204
SHA1 31016d8ee5618c05bec8c53130702778125c80e3
SHA512 e7a7a4386a11d73ca9600aeac2b15cb85c0d65b14e38eb3a6a13b3698f119f4505f466ea5e174517264c1106ea8e56a9b735375dab7c2d5371a2ff1c6bf0db50
SSDEEP 24576:0fwvok9RX6wkyAIHsqjnhMgeiCl7G0nehbGZpbD:EMnYIbDmg27RnWGj
TLSH
T1D285D029EBDC04E5E177913C89B7860AF6B178591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2a89a5ab74c875dfe0157f392a65284ee8f18761f4e6a78f9e1a49215889970c
MD5 7fadd3002e95cc49028a6b50c9ccdef5
SHA1 f5e779fee7651d3decf13efd435f73ab183b00fe
SHA512 893364bfa3e7d04894a329160f7f41326098850ca136f2a03efb13c7177b3f6079283a188cf8ff53a72d48514278a5c7ac9f577f1b861fe6d802ecf1192f6371
SSDEEP 49152:XYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QDmg27RnWGj:BySzPoD527BWG
TLSH
T11E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c3a4efa610fe98e37982c4db59a95dabccd9332a57b0eb4dbae51db635d695be
MD5 5c5db87cc9d69200f15abb808edabde0
SHA1 27f5c587c4ad08cc0681702d472120e245af442a
SHA512 ea6fc8856202708c5176702a35085d046b4aa203ac984d4890b39017c1382e0f75dd72e056ed6134495a9b25cc27936442345fd4a838d75619917d7ef3541fb6
SSDEEP 24576:T47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYSsqjnhMgeiCl7G0nehbGZpbD:T47JUQj4irIhCnDHUPfF/ADmg27RnWGj
TLSH
T18265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a229b3c891590a4eaf90056cc6521779cf4e606d6dc8b8c52a966e0ebe76e66a
MD5 9a3cea2cb7367e257e4b9ccf4d3821db
SHA1 c2a9251edfa12d3c595be4974d46355f4d849eef
SHA512 673a2587e4cfa64f90841c9bdecd1542b3e4a184a04f6269a7f23cb9ff7d0821085e1cb02ed7bce3d131ddf89e7e450a674db75855ed9b0a7bc5c02f7da54a5a
SSDEEP 12288:8GsfbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 248a261d89934432c2cd2ae873bd442f0d36c3422bbdd0df6c80242bdbe3d90e
MD5 659d1df47014f4e66ddc093729e46d9f
SHA1 3ea06d80a8ef61f0bc2511436fe494e69f5df204
SHA512 67114df5d888546a0a327bf0dd2953dc1f0ac97e69a9f90dc1b171ba7e26b5adfcd23e974e58f5df418a5b8603380e997640a9a04b10e73b6f7581d67e7d5c8c
SSDEEP 6144:WcsBC2na2fJ+KrERifKDexHM4/y5dZvkvwEORZqXeDIiwVH6ooHq3BKO9zIyf9Ui:WjIREy5nbhnqtVaooHqxKOFIYcaXl
TLSH
T10F350701762BC75FC6A940325E76D1CCAB707D41EE456F0772C8873FC576A68BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 c3f3ac0ea057aff38c64f4495517d0473030556e629f5b6662c69d98f8c280d9
MD5 f05fc90491d6f87102f61c47ed7a1c19
SHA1 479f16f1880bacba7addd95ae62629e881a973fe
SHA512 eccc35d68b8ef1314f859373f1d8aecc6ff2e64cdffb68f8f253604b5fb6f0c218ccc801522beb1f65041b5b3af3a423fec08e2492d8d67c7478c800c2ea5e8c
SSDEEP 6144:mGleQdbes9RoED/hE1at+kvh+kvKd+Ef+gAIHLLgRTWk12XL0tgkJbk+8JiDMuCd:msRzW1atPEf+v+Z1+Tl7dS
TLSH
T1AE75E6815537E38FC5FB5032073AAB4DA7B4EC1677046F267788443AD82AB25B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c2acaccc6974acada2ebddab4df513c63c6ae2d05d3bba17362bf41bb4be6e11
MD5 f2d581ab1560ba0940b2a93632d956c7
SHA1 425c8a90e80f39a024d8535c25bd1cebe937fb74
SHA512 352ae13e1c7505a9446b31cc2ec3f91c7cd1ce1d43369d3ed9a509b9348f29d2903cbefa68189799cf911d3c7613008785b6c3b0b9aef0fe0c546d26e5ddb67e
SSDEEP 12288:qF7TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19645237B934C518AF93609B482E9E12D680B7E669F1044C3BA4778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 67bde1e7fc7c1b7de2fb87d3c1f412f83b7d52325cfbe4d3255a5bf914d85a92
MD5 3781aea44c5d7912ed1629e913f1495c
SHA1 feb7c2111bc5ec5a7b2761da114207d2a7b85705
SHA512 8e986042edd655ff7c4ec293c74a89efb4caf75fb167d184276472325ea91dc1a979b314d459b2f67076b1c67626bfc46a1fc96af01176600a850d2a753055f2
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bY5sqjnhMgeiCl7G0nehbGZpbD:Igb4mBIBhGFWDmg27RnWGj
TLSH
T1FC659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 cbd6d830714752756cf81bd7ed107b6ad70e442c7efc0bd8e8431fa48854d113
MD5 40c1d88001e55236dd30a8e2b9eb0fc1
SHA1 60f671fb962f1adaec1b1e99e24c4f34ef2aabda
SHA512 e9e0823e757ef865ffe902fee9bd0efe6e8e9243289ebf9f4451e4af21859b7108fe14234d6764a88759194ea647a4d3e01e8a647fb946e68125f0b5eb17d71f
SSDEEP 24576:9G88u8FpJqH1Wzria7/misqjnhMgeiCl7G0nehbGZpbD:Q7ZFPqVha7/lDmg27RnWGj
TLSH
T1D785016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2aeb44fb3304eea904a39efcd0207f21fab51b6aefafe05587764e149df77bf8
MD5 a82582ac2ff3e8aa38d19b7ac19fc696
SHA1 93e55c78fa81b2cb8bfe3db0c283147ace126842
SHA512 9a427c39da5b0d78bb65095fccd83ced4a879253b0611dbdddb43c64f3d99d34a6be91fe831d4f3d0eae6c3f4bd0179230a7ce50ffb890b7215ca0ab3bab2b05
SSDEEP 12288:MHvUrBFrEjwaQmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:MPUr+NQmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E765F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 152cc9791f4655d95007d092ef4aaa02032afbdcab06ac90a093a5308a358856
MD5 7bc8160a11e5201ea4233648be03c30f
SHA1 126a36a4add2261cec590efe8cb596047f41bfe7
SHA512 dc545b9ff8a0d89f97d69bb29d91a02bb8b2d9493764f765cd234bc8227a0de64007de2ce2aa46065996e7c2136a586d33200b216c0d3c6a9fbf3198e054b315
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6Dmg27RnWGj:uG05lO43bjD527BWG
TLSH
T19ED5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c4ab0b439920caccb120816703f30c8fe720c5f034aab7d125c87eb57f1cd0cd
MD5 eaddf64e1f7441762f1aa85d95ea3815
SHA1 b6c115bb8859c023447c3a954f6a6b8a59270469
SHA512 6d7138763a81770f5e239b6e479fd312655c5ea8f8d1bb5c618b0bf448d2f81f5c8ffe856a1e100f0970601211294bc7abac19a188f9463e17d5f77274a37f7f
SSDEEP 24576:sfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn0sqjnhMgeiCl7G0nehbGZpbD:0a5POZ39Jt2pasx2+mSDmg27RnWGj
TLSH
T15E65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b4caa0ff404542383f5122aa66f3f470532233a90cfb4dc0e6b4dd35c34fee2b
MD5 e84d6b0a858e10a706b2c2514dc22526
SHA1 15e37ebd4240187879a4ed25e193587ffa4ffe36
SHA512 e297d20a9043f0dfbac509feb6532b76ea7b73908f3eb2b10ed69e5a98ba1c8291da96d37d7606b82413b1a84a1df485e639691c985cc13f488f3edb7f2845eb
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkqsqjnhMgeiCl7G0nehbGZpbD:vNc/zEOVHFFDmg27RnWGj
TLSH
T138857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9a3cc5b1633b0bcc6a81f3e8a7716014c4875f1d221df74e32a19a704c783198
MD5 e05a7eb9f1df9bda2ef401d97c972275
SHA1 b07e192f5436a4d7531793922ea4d17a7080a886
SHA512 77cf10583a9a5a3351a31c40f8c652b12b64ef2aaafd2d51ed2634e24d757bb0c1ac247f4109e0d68a189eff5471d116e0d79ac350119ecdfd584580a9ca5719
SSDEEP 24576:UtkNvNnaFeYhJNtmZBmQsqjnhMgeiCl7G0nehbGZpbD:UtMwBtOmMDmg27RnWGj
TLSH
T19655AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 90aca1ca8f6bb6afbf03940de29f080a431b99b59c50fe6a1ade981683220e9f
MD5 43c7de75e5ee7e1cec9ed8ae2cc5dcec
SHA1 1da41e4f3418ea1c44d5c4287e072a955bde4691
SHA512 79ca034eb341ece5079588a150d9b01784011119b197bb2e73f832279d55298f1131b98f5ae67d54eddf186da8c3c4540c2d1e638b40d56e0124733d993fdc19
SSDEEP 24576:JD3FHshBIYQgAvsqjnhMgeiCl7G0nehbGZpbD:JDVHeBIAATDmg27RnWGj
TLSH
T16675E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1044-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1044-310-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1044-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1044-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1812-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1812-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1812-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1812-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1812-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2560-8-0x0000000000490000-0x00000000004F0000-memory.dmp

Download

memory/2560-0-0x0000000140000000-0x0000000140272000-memory.dmp

Download

memory/2560-78-0x0000000140000000-0x0000000140272000-memory.dmp

Download

memory/2560-1-0x0000000000490000-0x00000000004F0000-memory.dmp

Download

memory/2560-7-0x0000000000490000-0x00000000004F0000-memory.dmp

Download

memory/2572-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2572-40-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/2572-51-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/2572-48-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/2572-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2648-85-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/2648-80-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/2648-311-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2648-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2856-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2856-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2856-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2856-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2960-314-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2960-116-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2960-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2960-122-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3292-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3292-109-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3292-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3292-103-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3292-315-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3292-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4728-21-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4728-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4728-23-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4728-15-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4728-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5292-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5292-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5292-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5292-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5292-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5348-96-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5348-90-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5348-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5348-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5348-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5348-329-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6036-62-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6036-56-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6036-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6036-283-0x0000000140000000-0x000000014020E000-memory.dmp

Download