598b7cbccc1ed6e414c12b6f89c783fabd9cba604a76e546ffea5bcb87113f49

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
Size 2.3MB
Sample260820-sg2l8aeb26
SHA256 598b7cbccc1ed6e414c12b6f89c783fabd9cba604a76e546ffea5bcb87113f49
MD5 8c609fc4e86b6746ac031b24006dfeac
SHA1 c0380ece8bf3e7a4bce6701311197ac09547373e
SHA512 2a931b0549f16b4a4784c32372f02eb56683dc4497a1b93e369185d35aa62f9f04b30602213195b7032d53e7c491561e6e23ae68639f21f5625c65513d8584eb
SSDEEP 49152:0bgTJkk2m4x4tLn0LqHEzkjsVc2ot4+Ej2hqjdmLNiXicJFFRGNzj3:9urzkjsVc2ot4+Ej2i07wRGpj3
TLSH
T145B5BE24F6489295C1BBC17DCA8A8B4BE7A1F40947349ADF508507DE2E737E14D3EAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
256	elevation_service.exe
4548	elevation_service.exe
2780	maintenanceservice.exe
4676	OSE.EXE
5700	PerceptionSimulationService.exe
2408	perfhost.exe
1776	ReFsDedupSvc.exe
5240	SensorDataService.exe
6008	ssh-agent.exe
2984	AgentService.exe
5572	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ad038fdce05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000ee34196b530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3fe17d7b530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051250696b530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
256	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe
256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	1776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1776	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1776	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1776	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2984	AgentService.exe
Token: 33	5572	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5572	SearchIndexer.exe
Token: SeDebugPrivilege	4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4300	2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	256	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5572 wrote to memory of 2332	5572	SearchIndexer.exe	100
PID 5572 wrote to memory of 5420	5572	SearchIndexer.exe	101
PID 5572 wrote to memory of 520	5572	SearchIndexer.exe	103
PID 5572 wrote to memory of 3844	5572	SearchIndexer.exe	104
PID 5572 wrote to memory of 6048	5572	SearchIndexer.exe	105
PID 5572 wrote to memory of 2944	5572	SearchIndexer.exe	106
PID 5572 wrote to memory of 1380	5572	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_8c609fc4e86b6746ac031b24006dfeac_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4548

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2780

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5700

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 96aa3a47db08a72dbabb3d00834721abd0c07e50ac19b49ad1a52e432d3ebcf2
MD5 e1ee751e13bd7b181c2782fe1be9479a
SHA1 7f3cd809c358b36ff5d491e8388a2042b1e0b9e5
SHA512 b3ae6b9d0bdd39d3e261009c47196d24be8b54f61215936d3cd91c0fde362c8573b76fe7c9393e73353692af67f5a3a64da44b3b9162634de2470738d2b69c34
SSDEEP 49152:Fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6LNiXicJFFRGNzj3:b3q6mjB17wRGpj3
TLSH
T145D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 1a964052f06dbce4e7461e83e342298596232a7f9f7c63fc0dc9adb331d9931a
MD5 4e93de525085e224b2e8476209f17ddc
SHA1 ba2d5399a1c86ebc4ef23ca472138915a7b777fe
SHA512 dab04e47afdcac2306dedc4e22298a183405e7de1c021fc9b8afda80637241e70aadc3036d14e8ac4da3dbba51fe959a15453c36f625c10d67b0b0cf46874e32
SSDEEP 24576:fXYfDtczAZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qtckLNiXicJFFRGNzj3
TLSH
T18285012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 edd0c432a0ca260d731854f112359586e0262acfd19a2ff14e5222c9aff4bf8f
MD5 38997dd1138d2107819936cf8e2efd5e
SHA1 7079a75f3691cee42738ea2b5ad6d23671d6d8b2
SHA512 560068479e6773121a3ced95f5a9fa736d67cc56cacbc4640f0e4df17dafbc6251bceefe3019d0bb24441b4d2444ee263f24fb5e25e4f84dd9021dcf18f7b1d0
SSDEEP 24576:y0Le5ji0hmx0rMi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yPji0AWXLNiXicJFFRGNzj3
TLSH
T121A5AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dedbed5598cd0aaea682dd3e2cea20e6cfdd79ba264d15428a2b5b905056f058
MD5 5a8c50dc124fbd5251f0012eaf92ef2c
SHA1 2f8dbfe81ff368d89a0cf8af651159d5d1ac1d09
SHA512 5a4c569a5aa35abf085390f59b5d9b087d1342a042a757a55c2b26b137f52dde6acd0ef1c959ab40c88667e0ecf1362c2c9d4c1bdc30ee3912e4dfe68d3302ec
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWj6q8wyu0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3/ezSC6vUzPv+HjyLLNiXicJFFRGNzj3
TLSH
T1B9756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0cf7f1e21d9457e1facc7867541f21365c0bf9cbfe924ee146acb04d3ed56a15
MD5 284ebd8ceb96edb9a97725a10cbed436
SHA1 8c6d343e86df8480fc98067583f04b9241e7a2b4
SHA512 ea2095e6282e4e4a6d6ab06a8fb154dc0e6bb68e4b7ec7fa899b0e86e7ea0539820a0d29cec27a40d30950e8c0d4796c7c9a33fb073c87d43c15d0ba9e864096
SSDEEP 24576:yVbqPb88hv/l+BF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yVO88hXl+3LNiXicJFFRGNzj3
TLSH
T1F9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 1ad2e2c03a5fe3d9beb0f3535212031ceff473f809c40bae25dcf13a5f9fd8e9
MD5 fd32a8763cca3410e45ed7af09d1a04b
SHA1 694cca63729a609663f475eff0b091e2b36c6ae8
SHA512 4801e668fc8b79e5caa86d50ec55bd54346e45ba97812e5c3fea81153db143ca3c85697e6fb5923454a0eb2860a6ff10acd9f046b3e4465ea67c7a439a2d8d83
SSDEEP 24576:mEO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yLNiXicJFFRGNzj3
TLSH
T11D7523D3468855B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 fcceb0032ce64f7e4f0382a94d43b29c8c0f7b3b382ffc9abbd0457e05e49852
MD5 e22390962bf7b2c5bb225e39a676a75c
SHA1 c25ca268d183d05d9f001567fa06019153cbf03a
SHA512 5b97909bf64577d6f4584737a20bcb86278954469f59655711261dc2acb754d4b2863fb23a5831d6d96a46128a2d3bbf448768903a17a553fe5e9dfc9b8ac092
SSDEEP 24576:TJIUN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TJIUNLNiXicJFFRGNzj3
TLSH
T19285CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 faaa209632dee83e940bdeaf862ed755137506d8961478184d9fe26d1284219a
MD5 474618e35a05aa1fde64109ee27b0606
SHA1 3b5a35368c6d1ce21f3066e9c7ad3c24332740bc
SHA512 70d7dcfd8edb65864d7612f544175ffe793d548dcb9e2d186cebcaeb1b56b11e51a33af14ac09acd46396c62c43918537118d94940dfa86d8394480dd8b25614
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THl:rQvGAdlCEL8c/WRNw5CE7wRGpj3
TLSH
T16F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e7210c05afcfda33e7b7affb0d0fc2a4f29a41038493df031c5d0f68c95ce2b7
MD5 d8280c76089ce521d44cd034e6348201
SHA1 8fdf01300ecd7cb5e0c71e60baaeba65c45bed9a
SHA512 ba29775b4d10d5478223226859481464117882a4e2326c9280fe7b58391763de31e075a7964ab283237aed960fb96f2540976e5540a1b1abfad0c1d7a9356983
SSDEEP 24576:sgewsAjn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ljnLNiXicJFFRGNzj3
TLSH
T14095E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 99c57261e4d60b23452e0a0d92140435d97cd96f46d4fe2d2819eb854f9dacae
MD5 d2f38916cd184886d85c1c64bc33545b
SHA1 cf91fad0bf840286a21991bb3646f3e9a66f4fbc
SHA512 d4929f566b3b6605154559007edb99de40a09ac648fbcbd49b8182f146eff9ffb10677714bd0eeaf305cdb17fce7189766836a99b6cb360ddc181a311fd8a4d2
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHDF9:vUEtQevvqc2W1cpV20I32h9
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 df2d357786e6c4af11f2433ead2c22ae91e315ff84ff43d3073973cbc669139a
MD5 ed03728371d4469a157da72156512c6b
SHA1 5cc0b73d45600c769b728632e7d8cac710d21fef
SHA512 115ad63a124dcf4b0ce665eaa2914589079230e11076ea8d6f03560d7fddcabece431cd1d63e45a38635053dda8c59b9d967192a9428273385218cca7ec8290a
SSDEEP 49152:tCbRquA/m2yL5zLfFiV+XenmE3/zHLNiXicJFFRGNzj3:Koq2Vjnm47wRGpj3
TLSH
T1BDD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8083c6372568bd0a80a87830209ae50866af9097085d95209e31ad15e703f8c3
MD5 b9e4cdd22c58266cdca6dfeeb5e41637
SHA1 a0763e7c28ea4fab50598b7690a637232bc4d1ef
SHA512 45c79c074ae0db740c752618b9ea2d7842131215794daae4e76a978874f51a276f02d76a9f17df006dc87f7d9ec79d7df7d28f79e75ce3812726d7496b283290
SSDEEP 24576:xAhGL6IFoiwtA5l7S53Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xAM5Foiq5ILNiXicJFFRGNzj3
TLSH
T18D359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 238238c4c4392379ea30e7bd25252ac9ea8e8beca071a89cc25d28d09cfdeba0
MD5 29eee7b7d6ea567a1fae486949128d28
SHA1 072e7c21af15e44a75f99bb481454d0b7acc92f4
SHA512 d0d30d4ffa678cdcaf4c00ff56a0691dfba68ddcc1d22257db61d449f284ba8704599afa8c8b9cd2d979ea4d17253d5a2416ffe6a970d3d11ddc89c675387bfa
SSDEEP 24576:/wuIOWr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/wbOcLNiXicJFFRGNzj3
TLSH
T12A85F08632940CF9E9BA41398657C036F7F2BC152A21DB5B5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 727d9b477eca1e347a5970cf4eaef10994999b3a9225c65eee1d3cbc50629a5c
MD5 f98258818642959fb0ed2a3662ea4ec4
SHA1 dae6b96c420ce5fa86ce0fa982c3ed9f924ff367
SHA512 4aa83e9756224ad9e233b065a31c290773b454e1b2b5bf4c741a1d54b010770bf9656828944c93783d0c05269439440b90879c4def0310a746f6d76794a242ce
SSDEEP 24576:6ZuK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CLNiXicJFFRGNzj3
TLSH
T1F775129622C420F5E2BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bdc307451ddafad50d7f7c8da9af5b71ed50a485589182c4a2d0dad49aeb8c19
MD5 d0cb4529ff7eab7ca545b0d3d271ef73
SHA1 b20606fbaf9fbb33f06c8ff2eb30aa0d26a5b3ea
SHA512 3fabc6d31e64b82bfae7ddabfaf1a82faa3e197e28f4c3b8d6f4e3f7aee3aadf0b654b8a56bf3bd75998123de794b2f1ed927eaa037480eceac4c54c8eca6931
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3B7wRGpj3:pQyiKanX+PNVF9
TLSH
T1C7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6a0c04dbd8ebf87e388513dbca8236248390b54d936631e03c178741f3e61568
MD5 ab352bd1fc09a37a6ee127092d76aa87
SHA1 fdfaa9a2fde9d8c4c6d5b1fecb0d8356a325f414
SHA512 96a4e00d89c16101c318355c8984b31a02ed5fbf4cc8b889b556e4f42ebb3d1b33b353765472148fa2cc0ea557c98482a70a80b89cb93e9255f92a7334a79aa2
SSDEEP 98304:zQRQyi36YOcPDLvw2gAf+PN3B7wRGpj3:iQyiKanX+PNVF9
TLSH
T136667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fdcd3baa7cc0ae654dcdc1934ada3f29a98e97b153c818d95e4bc50deb2d383a
MD5 b6118fc2abda30597fb517b97e1fe0a2
SHA1 15e7f1a5edc75b9b5a242a5dff10449e2d02970f
SHA512 23b3e4f80379314d2e0ee81bd836a7a7b32797c20a153246dfa1e5dfc12a9d46fb33b98c6be92598add65263e206caff3d5bc0a153e95082063b3e2c86f020e5
SSDEEP 49152:P68Qg55nhkeWu7PNU3/XLNiXicJFFRGNzj3:JthTRc/X7wRGpj3
TLSH
T1EFB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 643764b8522841d6d9175c69de797ef45c9f40113912f8357e96e580366ebb56
MD5 4f63608166396062ec9123ecc458a105
SHA1 dde8b9c8b7def99ebaf6b44b3e3c9a35d92d8410
SHA512 4eb31e23fcbabc91637feb8b91fe895bd8f6e5dc689f64b439fc692b54d5dfb0993a664e97912aece1aff89dda5fa187c987dd35aafae1016cd559c8a9fe5388
SSDEEP 98304:By5112gYy5azzVvU69nLKnhZO7wRGpj3:cLIHRWhMF9
TLSH
T1D3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2a373e68670bb5b14d58fac3c086e8f74d9bc1bca64dff5c84a715db2b3fbfbd
MD5 2bdaae16f8a8cb4f0f6b76f7e187a689
SHA1 963cc785414fe6f5c1e34e3cc83007f76d371a20
SHA512 71e443f5e8ef3d3d79e1fbe4d170a141f0889f7daa2d9665ea2491ef99d94333612d75e7a194d5a3c794eccc7014b4b15dafd1269a203013b9a1f29a1a290519
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJLNiXicJFFRGNzj3:Nu6JmIxd2dJ7wRGpj3
TLSH
T1BBD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f0ba2693f3a462117145d3c53b22ab71aff6d14635f0b28b6411797a5cb2688d
MD5 ada8106d79d65729f82b6f611f543adb
SHA1 5b9efbc890795729235e78d861535ac5d9040109
SHA512 8a5ab80e4fd9e3841a81d15545fe30e743856849f5f6ab4ff4c23a314b92237bd32d2b7eec7df2528744421b5fb758eac902080b5c74c68586e366bf02f2fbf3
SSDEEP 49152:L1hpsNoJpF1A67U44CwH7R4xtLNiXicJFFRGNzj3:LmifPqR47wRGpj3
TLSH
T1C1B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7beda71305a5a31fbd4c851986ff2bfbedfd05e2a9a96e7f858ca8d0d65b04b2
MD5 2d54a7600e90a8a9f2216c2392f6b10a
SHA1 26398bcf5e234e6943c56b5a95f6302135b46814
SHA512 8d229432c0334b9bd92306b71f19ed240e70b1ac4b9bbd17d95218460b2b4e2809fc587a1724e66b47d594e986f78dcc91d727ee3110b249806d602cfaee3897
SSDEEP 49152:5SuZQIY0Be2KkRVtOnks6NMHqKLNiXicJFFRGNzj3:X5dKqi61K7wRGpj3
TLSH
T1E4C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 edcfcbf03a5826f11547ad1b122c7d90990291893d57d9135a30b2bc416669bb
MD5 9bac80562e73db3044fadaddd658f367
SHA1 ba4cf84ee1e0a61b9f1125aacfd1c1cf8a429357
SHA512 96f94412c629c063ab463c33b6e9b7f60fc80d7c4108f367c9cae6aa5dc96a0b23130f00c2b55732a63df93a886d338aa41d1afc32dba6aef5e939623f6be0b8
SSDEEP 49152:XhtSn8EApI0figjgiDn0AP5wZLNiXicJFFRGNzj3:GX2iWph87wRGpj3
TLSH
T17695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 6bf21961a9828acf3b49ea9e7053a2a19231851f8f08f6db1705a33e14189f37
MD5 97fb7c65d49cd4320fce4d7ee0cf26d1
SHA1 1375cd6f4c2a04e3a2a6f42a730bf65a83ee7362
SHA512 5d498bfb628b76abc2e518465b87ecc5b1bfa253c822a464faceb3dc6520d429c01382080636ea7331eb3a0c4b37fc8237502f5937bd6baf734ec5427f86b383
SSDEEP 12288:nsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1756523D2558955B1FAFC0039C6794428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 f73b369bbab6a1a3456b09447cd761858d251c5f26d0323d89fc7ff58874e905
MD5 016e01c8548926ad0ee8c3988203bc79
SHA1 445940521208387d789671549ec73718f0e4dcbe
SHA512 a158620028d7e1f70ce0d37cf5306d81e407e8182cc21501f3001968408a3236fc415aa4f91c7c479ce22f921a3eb2bae420997ca4bca48b7b5616aa89fe4bce
SSDEEP 12288:z3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1346523D2548955B1E6FC003A86794428F5881E2DEB5658E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 56d5c9e09530ad215e1ac2216e410ba66f8540282f14d62c8473fa47559430bb
MD5 20b4d39202893f1fbb390070e770d67c
SHA1 7a862dcbe604542d26195b2cae4b813f8e186c77
SHA512 a8c81fb150e36cf2b63bcfd1d6df6adb81a6509eace8134ac161bbd61859011a815c442e000bfe108aed5856f813e520007a7dbd1a60459d96a4e833b60bf275
SSDEEP 12288:UpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE6523D2548955B1E6FC0039C67A4428F5881E2DEB5658E3E3483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 550abac2963c309ae8143132aeeff866c61788235f9b3ac99864b60bd1fbb1d3
MD5 34ed4e2961985aa657e65a224b197cdc
SHA1 8666d0a45df513a11266eb4daa9288208da3649c
SHA512 f8beaf373baf41f1db2b79b08c858ead8cd8916d725ca5e72e0b2d6884c6e9460935d2f21f6f6b2dccc6f091c375f65f7bed93c8bd00f41367c43a5112f0c728
SSDEEP 12288:pVOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T126752392168901E1E9FD803DCA764424F2A47D6CD7325AEBD3003D1E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 d7650273245139b0727c11dedc7be8b5f1467801d3baf8e288eb723823215343
MD5 4bb52cedfbee42fb4c00431dddea9d73
SHA1 67220292fd181fcfcf0aeb0fbfc7780f3234a82f
SHA512 78e9a5062e8acbf413d2de2d532ca40561812d94c61d5503526a42c53499d17fd0a5feb94fdb3271a3a02f4188525851b38ffd0ff6eeea4f962341d8b384ddf6
SSDEEP 12288:VGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FC6523D2548955B1E6FC0039C67A4428F5881E2DEB5658E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 271dd45f781b39c3430293c27906575fac118ba052ef827230055023d39e4784
MD5 5cb4dd7f562fa5e606f53dcce43d1632
SHA1 e1d6c3bc447103bd3b695a4d69b6e1c784e4212c
SHA512 b66b51ce8f6f80d894dfcba0071c5105e903d462e417e2ef94adba29bd5bcf7f993e2a051920eb0ed2e060cdbd1879e162d3f34cdf2227358ee81e17a2ab863b
SSDEEP 12288:07iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11F6523D2548955B1EAFC003986754428F5881E2DEB5658E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 8aa5a9f04b15d1890dfa99e92934040777f5bc09b1b2b88966b19aa45bded23e
MD5 c2d30e505fd51fdffa12b9d655ab054a
SHA1 10450c87c68bb00898bf6bc95c486566ca216396
SHA512 bf377b55c846d353894084666126f8d864d130e86fd29383f7e75f1beb48449b138965bbc73df6160e12472bd47b985e7f3862add68adb79520911177ed3e91e
SSDEEP 12288:YviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1176523D2548955B1EAFC003986794428F5881E2DEB5659E3E3083D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 26b831fef1d9b936438237f44285f9d9a08e35e63a8be839ee51371f559c4a00
MD5 7f36de8cf6670a23f11f5e03531e9142
SHA1 d5ea3a06161ce770d59b0f2028b55837df12b4ec
SHA512 e89440ee98c8adcccca58c622d208cdbc741edf32522a389e3e864b7fd4330dafe8b6410f5d0aecd7b68bc2a5a22ff8c2f0835a7ad9c4074e71869d74b7a4562
SSDEEP 24576:wZMkzFVSOj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wZMkzf/LNiXicJFFRGNzj3
TLSH
T1A9850295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 9e1cdfdd3ab6d024f2287fd320ef774209c0e48155b5ab1a5bfc5e4710faec59
MD5 63bf527be078ab514c7305eb36a8562e
SHA1 c310f2fa1104026f9858d69ebae2f3f34fd2f61d
SHA512 543d62f95ac315504404ea058d46ab33058d85e26d5829b19ed4571034c965e4e6bad33bc47326cad611ad86ae174013d90193a20670829e04a87271fc86bc82
SSDEEP 12288:XoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D56523D3548955B1FAFC003986794428F5881E2DEB5659E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 d17ecc538cf6aec68bf01649451466c1dbaed91d897010aa0a98559284a789f2
MD5 f798bcdc96144b6f01ed4e29e1227fcb
SHA1 6213cc8c83e02018271bcbc99da2bfc3fdb7af2f
SHA512 9e1ceeaaca6a14e0c31d222a34c4f5d6205ffffcd1623ba70c25c577f5c0e2339066ef5487f6336241b235f98ade9be06056e37fe9c0b5abad21043d97ffbb09
SSDEEP 12288:b0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:be/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10F6523D3548955B1FABC003986794428F5885E2DEB5659E3E3083D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 1cb717fb55ada2ce21a8b739e5c9dfa08a84b406cb7c45113936ba3b7a7ff31e
MD5 b99f5b194010e1282ab7d4cffe40576c
SHA1 5786a0f84c2166314f647da64550068cb5a45d0b
SHA512 429e52704004379ac44634cf155ece5daef98207935093f89c76d6ec0d5fa4213ea4bead6ee3466300d3908b6429b4d7dda27722d28926da2fd7fbe2939f29f6
SSDEEP 24576:9zy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:98LNiXicJFFRGNzj3
TLSH
T112750247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 3f4a8a4f5c7b195480ad32169bbf7b1eeaa9bbd88d72990deabaf4def0394463
MD5 025b28b4e89ba88556ed56027f4211f1
SHA1 db7117416c65e9157809955543a158c62b4cc722
SHA512 6ec3a9dbed046d6dfbfc166401325c821757a0707248028e2f5f6277c267490931bc6671b6ad1b28f5ed74f62bf39588695d68804a976d1cce117318e3ebd6af
SSDEEP 12288:QoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1056523D3548955B1FAFC003986794428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 773c1d6b554ccf2744d8e1446cd355fa6a1679ffcdc7e3ea7ecb063b90d43dbd
MD5 242b5588ace5f313a0b6f552ca545616
SHA1 94c5ef0b7daed7aadf04942491a8306cd418532f
SHA512 4a9e7d2ad01a984ed8ff4a344fa05f8c53775fe410f6335a8a09bd082935920a067a534c415c3fec498367c01a36af47aa041f154366b489eb2ff5f8a467c560
SSDEEP 12288:AoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Aa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE6523D3548955B1EAFC003D86794428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5764c33a5e0d1d69128c01f21710c2193dfea1d6d69a94f7d939e6fc8d9950c6
MD5 ab479c3a7dc777ec4de71ca04a82c723
SHA1 93e28f77c78e061ad33e8ffb0c516befe25a660d
SHA512 3e9c862622b33534f8d440823a9511bb3e6c85dadfe03a0ce29221bad483a01d86a65638f246154411c6c73be3ddcaa21e3270b238c9fa520b8593c06407b397
SSDEEP 24576:szy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s8LNiXicJFFRGNzj3
TLSH
T1F6750247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 fe78f50e0a5577cb660b8b7e10d8ecc0f139066225c9682f89f6188abe67a1db
MD5 57b1ba11153d48873f5d9e305ac3d73f
SHA1 9687e2878ea740286843d706e89a58ff45684aad
SHA512 de8fd41cc867b1bec9e28e9807384ebcee900993d7b291547bccab9a244f93e53a18fd0f1c85180f09ab70a7c67a139a6c8bd1a3828e82174e771f15116c2412
SSDEEP 24576:5TxaLl3z0zDl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5TsLlj0LNiXicJFFRGNzj3
TLSH
T18E8502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 f7d52d2f48c8b7b2167285d5333d72862bf5364e3805c154c182715adb715e2c
MD5 3a18f5d00acae7baf5f2ddb5ca52cb0c
SHA1 fc1f825e5796a753b4f1cac607e4b7cffa0c8b75
SHA512 1435837db0683db05a79fbfc11334c1642cc8cfcb57b34142661f4af7e0162e4ff3e508eb4bc3f407e75e3725101144528104bfa91a8eb3cbe6c7d28b7c7fa9d
SSDEEP 24576:x3hd9CHKy7GZh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hhd9CHKya/LNiXicJFFRGNzj3
TLSH
T11595CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 83c836959c09cdacf57578ad4d60bb0af072c5d4cc3226877c14b3e0af4642c9
MD5 a8a58df9e496765e7d2fc4dcd0435a22
SHA1 4ab7ab864d291a42d40ceaa06e847cda27cf735f
SHA512 2c2e348050c6d0c5959c2633ff2ec87fa321dd3aa90d96106843b916ee5cb9090e845177950769388805af6bd1d3b529982aa33c169b2ad4c7f0fd33a05c7d9c
SSDEEP 12288:wJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED6523D2548955B1F6FC0039C67A4428F5881E2DEB5658E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 3540a393639f6cd52a2294d86e9c6b313d4e1261d2e7e313b727d26d4569942a
MD5 921e7071c6887de346c8e2b029b8744e
SHA1 0779d7fd812ee9aa6f3f121c25f238b5afc6350e
SHA512 9e193b81cf110ccb82d59c1b046c6b48f273be8478620015bdab9c4f773ca58d81a8b7021cb32a3e116b9094ebb8ec03a8f110c97bdfb1e1aef629e59f414993
SSDEEP 12288:ijiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1806523D2558955B1F6BC0039867A4428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 83eb539072e8eee65ab253f544250f6cbc625125604619cf3c824c074f6e2dca
MD5 3b1b52d50919f5868de8451fe4894510
SHA1 6174c5351e513ade378ccf45facb1fedf05e3308
SHA512 3f90771374e53bfd6ca4f8d9a7e0de25beb7c09baecb06ec293822a82a41f8c06dd1e05566f4fb295ed41d26df6bf5742bb753e77f9fe213bffda6571ff5ad17
SSDEEP 12288:/KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C16523D3548955B1EAFC003986794428F5881E2DEB5658E3E3483D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 09270bfba6e32686fcac273db733d0e3fbe1600540028bb5ef4877a05e3f6fa1
MD5 2a651fa017211e6fe64d7676e01c14d2
SHA1 9ecee9f32520a7cd91433ea49a29239082c2db4d
SHA512 084a0f5f84a5e2fb84865650a06db8476347c40e7e3fbcc8721abf75a4d2b8e4c3fd1a333b857ba0e443c12cc7a2f91200db0b039bde40a49ad50b25f7014cb4
SSDEEP 12288:YoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ya/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1376523D3548955B1E7FC003A86754428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 0f646e8ea8554ebadf0bbe89e1bf4816b938bea06d6e602116f07461ea956cd9
MD5 eee303fa3f9f0c31667ea98a104eeb15
SHA1 a6f78e1193ee23117c4870a2bf54e7bd90c96714
SHA512 7c523a105f26eed7055e26413ffc408175d42d492ec6da3d0e45f1dcdc9ed31db046dbafca6cf6169c6123ab7dcfa6010725e05fbbb93103cf4da50a9406ebff
SSDEEP 12288:iJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D6523D2548955B1E6FC003986764428F5881E2DEB5658E3E3483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 40e2c2274bec706937e30ef5c9433bc4446dfa0d6d95574e1cdbdb3d44bd35ef
MD5 c47bf9bd1b634b1c2624711dd400654c
SHA1 5e5cd6162da5e8194b1018d55bc5c761f9b7e47e
SHA512 beac27112221ec4b86120a4b5e531b80545ef3ef523c5a591344075319a81b4fab4c9f8612f6d2baf19fa9dc4c4b2e58164513e605a150d09ee9b93c373269d9
SSDEEP 12288:iAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1776523D2548955F1EAFC003A86754428F5881E2DEB5659E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 1bdef52d4bc4048029a912e3fd6757206ace9c5d1ef9c8c5240b8bfa8c60a6b3
MD5 eb52ec4e02b0bf5213179dce6bead40e
SHA1 550255155a0c2be7a2f4d25430af528b365ec6fc
SHA512 25945688fce3fb902736206c596d8f6855c387022bd4d50c2f93050aa896dadba8caf8eb62f27959509ba8f75d17a6ab50efb5afedca6f9c64ff20ac7c60371a
SSDEEP 12288:BGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F6523D2548955B1FAFC0039C6764428F5881E2DEB5658E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 c18a88cde0381af0c536e17c7aa8dfd2dbe758007ebf735848c6d1e31559c9a9
MD5 87892c4a43f14a2b4912a30d03f048fc
SHA1 d7216380ef60886128ce14521e2e0bae9ab9b8d0
SHA512 7844a06c3ef1843216bfabfbadadc70130c75e4be7b10399a2ec6d8bedbcb534388e888c054ff48a055153b2dfc740fb606c67ed9cb768dd478c83d14b05789f
SSDEEP 24576:gfwv6k9RX6wkyAIu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6MnYIuLNiXicJFFRGNzj3
TLSH
T10595D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0a7212a38a5098d27edaa8cf6493d120567770f76cb3e7921eeb42cd13f4031d
MD5 a47e253558d29f011271e0c121ce6d6c
SHA1 2d8ebebf511f0e291c24e725f7db807dc8dd30ad
SHA512 c46c4dd538282e9b826986fd4b18acee3cc20570601eea83f867854b81767059c94256fa78a8076bd06e479ebc03bb7ab93681a8d97198ab16ac98eda70f6358
SSDEEP 49152:jYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05LNiXicJFFRGN:OySzPh7wRGpj3
TLSH
T13B066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2279c59cf458e25253890ba7f59cd078785f23ce369a469dcacc2a7c36f8f399
MD5 160236294a55d1ef68862d5d564911b2
SHA1 a39adde376e14becf15a12f79524459ddc1afe29
SHA512 2379bfb93e14e9899d613a61e174b80cf7fd3c84c96d4cc50dca9ddd2aa589cf13031aa55b97570125ced5098c6745788551e4c8c5e791f38a9d137ce88c2285
SSDEEP 24576:u47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:u47JUQjqirIhCnDHUPfF/JLNiXicJFFS
TLSH
T1E165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 90b1b8cc279b9aa87aa3cc2b7b2c74ea44de8f8005a67d865936d5b94c5d0bc3
MD5 5a9d428abe2ebb206d16037a779caee8
SHA1 736a4eb79313d2be237bd4c727be80ec613e2421
SHA512 ae14088fabefa39c33b6d044aac5f911c45ceb94371f0a8696f484ac3ebdef9e1ffd38641abb3d0aa1d11911f20d42a68ff49af8cb472a6a298b7a80987f26ab
SSDEEP 12288:FCsf4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C275F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 edfafb7ccaed14b1ee5516a03c68b5e00aad035757e66136b5ce403e4b821a73
MD5 dbefb2f73cdc1d535edb75f1de6d395c
SHA1 c17eed317933a01721f0c75ec01fea822518e7f8
SHA512 fe25b088ab2ecd8c4a25201ece24f97b7e07daa72cf202b2a42d4430de1ecd05584220c0da7a4808ad615c3eaefddbfd196ef59297cece671fe5131d3ae807a6
SSDEEP 12288:Lvqs+bU3fh2U/BA8TCE6fe72r655oaIJLdAzOF:LvdcUPhG0CE6fe72Y5oaIRKz
TLSH
T152353800766AD75FC6AD40321E36C2CCA7707D41EE45AB0772C8872FD57666CBAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 de0443abbc02d727b577ea0dbb3d65bead41c942d0890c5c91a0151b06e97746
MD5 f8250dc0a1e80bf77085b4d841b2b577
SHA1 3f9803715fa238ab6f0ed0bd67584c381d9effad
SHA512 257b5ff3c593b8645a73a676e1e64901e5d381732b46ff16c63f4004da2616efdc9fcaeff28ba5a6e81c446060aafe4f1a05e21ed07b875cde3b4e91ae4527e8
SSDEEP 12288:qs20NnHnF5E97tfoj2NqVfLcc981G7kjVJf8y6:q5mHF5E9RfafLvCEgBJf8y6
TLSH
T1C365E7416537A3CFD1FB6032072A5B4CA764AC0677496F26B3C8453ED82AB25B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 a005aa2e6f5a6010f8ab30e976348137c465091c1ca059ae4596123dbb70d087
MD5 15c5c29d87a0005e2d053156dd46c2e9
SHA1 7a4e93fcdcb3af3afbf348aff736e74ce1f2f962
SHA512 896e23ca193dacc653c2713791745416c0889487b990f9d62a084cceea22677bb0c04c93e1ae84c11391ebe6c21ac254ec5e597e88f6f00c94a145f5ac0f5e33
SSDEEP 12288:Fb7QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1077523A3568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b42a9ffd478164e782833aa9d5b6febc375ee0e9eb9c88df9848fcac8a73af25
MD5 eafba1008ba15aa27fdd042380296513
SHA1 e5c643995ab3799fafd2b4eb3b2d674b635283f1
SHA512 77852e9cf0db274b210b40cdb8e22134c9b6f63885757957aa9716e9e6498490115ad5d4e96dc962ecea208a6e500cc4aed780c8e08d9a52e64bfa838c4a3af0
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bY0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xgb4mBIBhGFzLNiXicJFFRGNzj3
TLSH
T1DA65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 0219a5c1b40c1bc6ee00bbc01f79652e390df8679c950db120915c1df8f5c521
MD5 664b5593de056075a784163996f7d422
SHA1 821cf154f0293d6bf3a3f518874d10eaff29572a
SHA512 8037878c4ffaf9656e4142d200652d96234dd8e51e48e0bc4bf9252d3cab4e58bf0a2c4391e73bdd897b78e0824fd1ed2eb27f04a0237241c1ca491a4fb4ba99
SSDEEP 24576:GG88u8FpJqH1azria7/mj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:N7ZFPqVla7/sLNiXicJFFRGNzj3
TLSH
T1AEA5F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 73b1d55d94d52557e09bb01b80053b78e8831603624f36b6117a4481998590d3
MD5 5af40acc9a7b8fb3621dc05b0d77efaf
SHA1 e1f113a42ae8ae466ab87e9e1666d94d2e3e971a
SHA512 a9a63f01b93040daecf7c98c555720973fece09baa81645ccd807df11ceedc47f2b6032894c8632b4663c0eaa73d7139d3f816171407bfb0644bebedcb30d31e
SSDEEP 24576:WPUr+NQ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WJQ/LNiXicJFFRGNzj3
TLSH
T18D85F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 832860ffacbd741691694281efeade00349f32e4b1505a0d56a98a703cce1a75
MD5 f64bc67450f9cda2fbc750d8c3566165
SHA1 c3806e893d6d4f16372ee08e51e81e5bbce1a046
SHA512 d0a4d50d0a9ce7d54a9999491776ba09588b56b98e9a104cd810bea9da4040001da9579507deb58712abe58d2c019fd8267ea24157dc6cd00bf87389356084f5
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvLNiXicJFFRGNzj3:UG05lO43bm7wRGpj3
TLSH
T17BD5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 edcabc1a0bbe7db9d1fddd071df52847e7864b1e6a8feb3e64b4a93a915c3164
MD5 ea7d96a28245d98b6aeb6e0cfcb90ed5
SHA1 c3f501653d9391f03d238fb2aca84b3a969a1ef9
SHA512 f1fdcdf94f6dc32eae24d5d3d3949df44bad4be1e267f1233896d5eb2e027f9efde37b6b0844a5076aa215d8e6626f89a28fb8f3c71838721b2e0e203ed87740
SSDEEP 24576:Nfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5/TwSfVcYG3K/cJHlnFR+IGNe8jg:9a5POZ3lJt2pasx2+mXLNiXicJFFRGNf
TLSH
T1F465BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3099648a3e54e067cfff3fdd52bbad3997c34032b45bc9a866e4857be5ee3f09
MD5 180bd3d79a234cc24da58b1de5d17498
SHA1 e578ac699a1e4d2b1fc6b92a8aea8dd0dad242da
SHA512 107b2bd5f0b5da135b51e8deda0ecaa837185b66056eba4881d0ba71f5f702b6a8a331722fca3d12f03318592bed15d2e9f0edce71b2fb0a46e2e7c1ccc06e26
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gNc/zEOVHFMLNiXicJFFRGNzj3
TLSH
T11B858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e79794a9348119b14da02dc458af54371b18bd15bf9fdf0a6557bfa005c42d6b
MD5 6c96af881afd80f0d3d4fc71d75065ed
SHA1 794a1c058ad44ea0f03aebb7e24efe62ee85021b
SHA512 d780c94a0cc68ac662b583a47d49b01617e14b30d40fcf3db55bdc1327915b364f50f88f3fe7a6400024801c4d22e74d141eccd4394d47077abd6ea4459c192f
SSDEEP 24576:PzkNvNnaFeYhJNtmZBmd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PzMwBtOmdLNiXicJFFRGNzj3
TLSH
T1B255AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 32a114e1b4dd216ff6aa3ffaec75c76662b1aefc3c686ea369d4a65879df14a2
MD5 6069767fc5ad2363e25609f798441e5c
SHA1 555199af1fde0f84001b96d7a0e582fc934db112
SHA512 0e97adcea5e274faee84a7ce2362484534fcb6294e04a6c57268ddf1b17c7308e82a2cea9d81925948ab32d076085caedcf17c4a26a7412e2a214dc1f9abccc8
SSDEEP 24576:/D3FHshBIYQgA2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/DVHeBIAA2LNiXicJFFRGNzj3
TLSH
T17C95E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/256-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/256-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/256-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/256-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1776-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1776-91-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1776-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1776-328-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1776-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1776-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2408-79-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/2408-310-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/2408-80-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/2408-85-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/2780-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2780-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2780-39-0x0000000140000000-0x00000001401BF000-memory.dmp

Download

memory/2780-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2780-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2780-53-0x0000000140000000-0x00000001401BF000-memory.dmp

Download

memory/2984-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2984-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2984-140-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2984-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2984-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4300-9-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/4300-7-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4300-0-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/4300-1-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4548-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4548-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4548-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4548-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4548-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4676-56-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/4676-63-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4676-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4676-294-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/5240-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5240-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5240-314-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5240-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5240-109-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5572-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5572-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5572-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5572-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5700-69-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5700-309-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/5700-67-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/5700-75-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6008-313-0x0000000140000000-0x0000000140228000-memory.dmp

Download

memory/6008-122-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6008-116-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6008-114-0x0000000140000000-0x0000000140228000-memory.dmp

Download