0be244d70672736dff1c23c47f22b0c3cbf0b742aff6afc854ad11f0cbf8aa9a

Analysis

max time kernel
140s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Size 1.0MB
Sample260828-24fspstgra
SHA256 0be244d70672736dff1c23c47f22b0c3cbf0b742aff6afc854ad11f0cbf8aa9a
MD5 05cb6ad7af4ba4c58ff7551a3b2b8524
SHA1 55b246e210ae580ec4c48ff827a8cf3aa004ef3b
SHA512 2abcf9b64235d80a34532e729a9a5af20f3aee97c30ff482ca4e996853b412aa5b89ebba613f1b7247958b3666e3b52f47177b382b2f825ec5f93bb24e78d5c1
SSDEEP 24576:ZSoH6ThNF4Xx7Ak6HFioJ02B32yvVBli34N8xAhLL:MoHGFEBAkkFii0wRvVi34NcAhLL
TLSH
T14B35D058AA4440F1E1B6C27889439546E6727C005B71EBDF13E8E27E2F376D19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
3564	alg.exe
3520	elevation_service.exe
4332	elevation_service.exe
2272	maintenanceservice.exe
2396	OSE.EXE
4652	GameInputSvc.exe
3288	GameInputSvc.exe
2616	msdtc.exe
5464	PerceptionSimulationService.exe
4848	perfhost.exe
4112	ReFsDedupSvc.exe
5056	locator.exe
2776	SensorDataService.exe
1712	snmptrap.exe
5364	ssh-agent.exe
3928	TieringEngineService.exe
2144	AgentService.exe
5172	vds.exe
5796	vssvc.exe
4532	wbengine.exe
1796	WmiApSrv.exe
5904	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\88990aa1238bf42.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe\""	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3288	GameInputSvc.exe
3288	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3340	2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	3564	alg.exe
Token: SeDebugPrivilege	3564	alg.exe
Token: SeTakeOwnershipPrivilege	3520	elevation_service.exe
Token: SeTcbPrivilege	4652	GameInputSvc.exe
Token: SeBackupPrivilege	4112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3928	TieringEngineService.exe
Token: SeManageVolumePrivilege	3928	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2144	AgentService.exe
Token: SeBackupPrivilege	5796	vssvc.exe
Token: SeRestorePrivilege	5796	vssvc.exe
Token: SeAuditPrivilege	5796	vssvc.exe
Token: SeBackupPrivilege	4532	wbengine.exe
Token: SeRestorePrivilege	4532	wbengine.exe
Token: SeSecurityPrivilege	4532	wbengine.exe
Token: 33	5904	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5904	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 3288	4652	GameInputSvc.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_05cb6ad7af4ba4c58ff7551a3b2b8524_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4332

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2272

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2616

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5464

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4848

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5056

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2776

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1712

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5364

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1796

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 02e2a189bdb04e04bdf09e9e9fb0a1f68f41d573defef02dd289a43e91381ee5
MD5 611dee1fd43737e7ad58ccaea1e8fd2d
SHA1 329bc28e5e9c72fa5dcba31182d63a64763962dc
SHA512 8bcdfbca32eb77eaf9692d04cbae3661198edf534941f4b4794bb100b545babdbfdca34fabcdbbef1f53e0843cf6d697b986f588f46cafaf6bddf07f5d25fa94
SSDEEP 49152:hb+632BuPkFKRrdE6oh7stBhuXjfS4LWxntkFii0wRvVi34NcAhLL:n3q6gjBw1iDxEo1
TLSH
T1ADD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 d3f58bea81ca20ece3b410ac2031fda62bc8d80bf73efac6f3de67b19dbde519
MD5 55cb7f984351602104b816a93ccd5ad0
SHA1 59c2c98cb949828ede424518a0f17afcdc833d56
SHA512 c678df10a95444163ebddf136906b701512d0c88a2c479fca4f0425bb7a54aa3d1fe098ad3fd7fc6c75eb42ce6a8c688cd48950c9bf3b4a739d1df14e9599ecb
SSDEEP 24576:zXYiotczA76HFioJ02B32yvVBli34N8xAhLL:WtckkFii0wRvVi34NcAhLL
TLSH
T1F705012867D548FDEC67827DCCA18116EA73784547A0E78F03E485A91F273889F3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 84a0243220db7309d93d0da54c261559c90c5a7ffd0d84e642bd574135286607
MD5 d1e99d29e36e6eeac085fc125e22426c
SHA1 6f6f919e5fbc43f448fcf6ba9271fefcd48f7785
SHA512 551bc5fc149db4a8a0ba66faa236c47366e1ab274eef44f6e19b0a1dc636a786a6bf0d52cdbda4c6cedba111067d28af18f5143dfae036d8a143dc3249cc4c49
SSDEEP 24576:20JeMRV0iexOrMf6HFioJ02B32yvVBli34N8xAhLL:2YRV0Zo4kFii0wRvVi34NcAhLL
TLSH
T1B845AE25F6748735D073C0B9C5D2A69EED7230865B308ACB4286C77C2E676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 036d4fb34bc0da6537cf6fe4eea7e4c10992d319f46490713f1f40087a237eee
MD5 56904f95bb019fac09e8b53fe7c668db
SHA1 d1f3916d02d781978b4808dab919ca4229d80094
SHA512 91c03928a93a12791cf527bbdbf93bab1235b44786ea80e04302aacf9bfa519ba8dccaa8e4e123cf22e860bfed798ae3b6b116488f45af836e78c800d561e9f7
SSDEEP 49152:Y/ezSC6vUzPvuHjy+kFii0wRvVi34NcAhLL:sezSC6v2XuHV1iDxEo1
TLSH
T102755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 162af8727c6d99ac8ec6d955ecadd1bd3699feb1d61e044c34d9218a35900e38
MD5 5a4e3eeb4317e3eff786ba4f8a22e797
SHA1 79435a6ed50e3958d350a456a146f2515c8d490c
SHA512 b50394649eb23bf655ec986d28dba4e3cdb72d432c8b1bd7a9c09c60d8fa96dc12f34a63f35c9646dbbf286e9c8d452e06a95a0bdb41fe13938c04d81ed25413
SSDEEP 24576:WablPC2Rrv/l+d36HFioJ02B32yvVBli34N8xAhLL:WaU2RrXl+dkFii0wRvVi34NcAhLL
TLSH
T16755AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1286D76C2E677D6C736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 219e40fd61002476637c7aac52192781a2d09e081edd001ac90bb8c9ac9ae143
MD5 66c4fe402acc3192fe52ab723bf85b8c
SHA1 e75cf0792366eb9cefdf497f93ed0ad25f0f0dad
SHA512 44f4f4b06272dc3fdcaf001809b10ada97d6f4be0829a440a4a20b16d1657b100215c3ac99adf50b0e223e4c3d0858904aa612a8169cd5a96cfdfb6b88a590c4
SSDEEP 12288:Ae66HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:Ae66HFioJ02B32yvVBli34N8xAhLL
TLSH
T1ABD423540D8A987DD94A07777D8CB0AE99FF3D0CA4EA691B1FC090CC497F104CBA59E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 17cdec4f165867b6132b3ec9a910d582594fbda26998bfae9335498fb5f11518
MD5 9edd13a6333a32b92c2097936610e299
SHA1 3da433ff9cf2e67ad4417b1940c09d728631392a
SHA512 872b95b74e2f2a6bce897b2e8364dfa58d91c5efc29e807f19278546ef1696343a4b8fdab0282ae854eb05facaf01822271cd9f9c62f65ffca8bbbb38f37d997
SSDEEP 12288:ZeBNUbTVO86Uw6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:ZJIUw6HFioJ02B32yvVBli34N8xAhLL
TLSH
T1BF15C03BAE28FCE2C27E4DB95A91C240D7B674304B62A3CBD1A4C24DDE275D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 5bfd7197ad67b8c1df1c9fede8a76e3d9808fe77f28ef5dfec999a84f5736010
MD5 dbb93f9cd3ec6e3901feb80f64318ec5
SHA1 2d202934ad0de3bce2302368111578359e2212f2
SHA512 4289fd1824c2ed54566f5414c67e73823cbcdc981ac0455ec28f311508fd6334d6c9a690d326f9bfc146f8c389e0f206415c690cac05d4ee4b27c18198f75a44
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5JENRV3THc:nQvGAdlCEL8c/yRN45Cq1iDxEo1
TLSH
T146367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 cb091fdb2ea03f4ec7f001dd1fc3f052c432987d8e09216858b3f933411c6d13
MD5 40d9c6b53389e8fa1115b1c2c7586f3b
SHA1 5a181b4e416fade175b19bac3fea22e372dd2446
SHA512 d9f79bfe7c0089f0ac7ad8f0de00b8d8b1965de0eaac4e1be5f64e0783ef268305a6c07a23b87b49d2d1ffd11ac82d0bba44c8d50b5e9372803d22becdd56eb3
SSDEEP 24576:7mewsAjU6HFioJ02B32yvVBli34N8xAhLL:CljUkFii0wRvVi34NcAhLL
TLSH
T10A15F130FE75E436C67F0DB22B25D316587D79204BA22AC3E3E8898D59342C16776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 525534ada66988c4ad797910bd204a390f54b2ae2682eade41fc10aef131304c
MD5 faa69e182890c4f05d2e804dc6a0243c
SHA1 c55f214bb575540e9d4285f236f9cb5d65f68bba
SHA512 aea06682fdf8940d9a9f406f74709fc51ad92474ccbb5adfd7b705e31751ec692ca544135a1253a85894085da0108f5909e37e315581f593d9eaa95dd4132a8f
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHQ:lUEtQevvqc2W1cpV2XF32Q
TLSH
T118474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8d603a9fcc487a277dc311bed595c2e104866faccdf17a9bb6fc14eb00189e98
MD5 eb425a370af0f1c6c4ff86aaad50b185
SHA1 d090faf8a4d5197d77b196c7f16ee4bbbfb4b618
SHA512 05d3651eee801668c22fa3f17c4c09fb01bbed95ea700e632ecd9c3367789bbf9a3a671c2783ed9cedb57f68dc049a97b35f8f4a3304745b772bca9ab070180a
SSDEEP 49152:ajbRquA/m2yL5zMfFiV+XenmE3/zMAkFii0wRvVi34NcAhLL:ooq1Vjnmq1iDxEo1
TLSH
T1C6D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8baa5da91c51ab660b030d07629590253a48463984224390c0eb0cdb4c23159a
MD5 cb903579a2f0c801048e596c95c5a706
SHA1 84ba15b3137bf430ec8ce41ec21852cd75ac924d
SHA512 5df25d07ef12d877342e9bf5eca036c876e586b77f5bf410fa5cc49c3c37150ab64e214cbb085319707afd9506115a63236517207c5232b03300b32e000f488c
SSDEEP 24576:RAhGLvRFoiwtA5l7S53C6HFioJ02B32yvVBli34N8xAhLL:RAMtFoiq5ykFii0wRvVi34NcAhLL
TLSH
T1BC45AE80EBF955D4F5B3AA7899B69171EA76BCA95E31D20F2250C14F0E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 be6efce75ab9555765b6f54c063b60fdd0a79de751738af92899fac0422bc77f
MD5 c075f973a032094042e7aa295e8809a2
SHA1 68517e8109aea81a49e9dfd342f741391057a7e6
SHA512 c49494aeb7c2b2fd4641e5442763ecc7af43dc29d4f59f7a9ec7d53583971680d3ba07d2bcbb37a9c28db7cf21b244e36045f0cc0c11585114f87445d551b5f9
SSDEEP 24576:uwuuOW06HFioJ02B32yvVBli34N8xAhLL:uwVOdkFii0wRvVi34NcAhLL
TLSH
T18605F14536D50CF9E9674239898BD136F7F7B8052A25DB1F07A0C29B5F37210AE2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 59ff5f33263cd1d40d6b13b0ea1ab2cefc974b9c05265f61ee36bd21dd4c526e
MD5 9f8439a6be91a46be9bc39c742bf041a
SHA1 682671a7cda374fc7ff536bb3512df8be5fa843d
SHA512 c21b185b39de99703ecc72f49be9d1368b134f420dbceb53f31a138f736af2582fc5e78fdf28b31db6db27aba222457691ed22f926c56b1689caceddbf8e2197
SSDEEP 12288:X941ITO6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:N4uy6HFioJ02B32yvVBli34N8xAhLL
TLSH
T111E412592AD860FDE097427A9DE8A149DBB7380A637653CF0BD081DD1F276C08F39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c0f6477a8c277ff7ed5caba1b3c7eccf204c6a7778788992cfb34d5cd4d45c7f
MD5 c33c3e1fb18228a96e06099da4490b1f
SHA1 be1fea9f136cb846968eff1115004e37ef54364d
SHA512 9fe5080cca3543767540cf179ded0fcec085031a5047ade61664068443ecf3649644df690556afe4e567ccc2c040dd3f65969a18a83a4e9aa48c076d71da6cdd
SSDEEP 98304:0QRQyi36YOcP8Lvw2gAf+PN3D1iDxEo1:bQyiKa+X+PNI
TLSH
T198667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 52d28702900b24741155d3d76693be76b2f53d5e9bac51c47b306fcae04b183c
MD5 fc28010106a46d661075435ae7fc115d
SHA1 a65b6afff67b406ffafc6dbc415e395254bd3c72
SHA512 54ce88b3fdde868539f8595bd50321e0937e45cf993cc584eb9c4f03edeb0c0aa6bd83a206a8de66ba8295cd1aacd8f15c52d664ec57617bb87f5a397a06f46e
SSDEEP 98304:0QRQyi36YOcP8Lvw2gAf+PN3G1iDxEo1:bQyiKa+X+PNX
TLSH
T1D7667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a6f64f01817eab3a9a4a78b18e6d28ef4a94ab715686185855e59ee56bc73c2e
MD5 3822a55cb988a7fe34946b8c4fde0459
SHA1 8f84145ed4c8b33e4b52e8ea34e54614aceae8d0
SHA512 be3995e96e2b4e31c16847bb4b46f99c3a54785ad7fbb604c7b021bc9866fffbe1c7a0f8980b0de846485e66b3623411289f225f7f9fe41358ac411c2a9dc7d6
SSDEEP 49152:h68Qg55nhMeWu7PNU3/9kFii0wRvVi34NcAhLL:fthbRc/91iDxEo1
TLSH
T159B55A33B2F600A9C44DD1769F4A973196D27C758FE0E3DB8541720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 01e54ebc0350d7094bb4b508b07d9c36f94ce3d62665c9956f9b7657919dea4a
MD5 26fff4d8eb1f2cff9314de9bdb2970cf
SHA1 c1f1e3aaf5d3c6e9f47e47a3cd25d173c8969f88
SHA512 3507f5f1bd0343e9add8e19883b213899d1d2525f0b38e0f96c4e91f634940ff011c56d86c18f67b21537c964b9a1ef4736df1a20e1d6285459c62d482d1ca7b
SSDEEP 98304:ly5112gYy5azzVv569nLKnhZm1iDxEo1:ILIHAWhF
TLSH
T12B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fc18ee1c4aa2d6e83763edb9126e1c7f4a88ef43f8be5e1139346bf67eab196b
MD5 ad9d658d36e65ff64f6d5f9c484de0e3
SHA1 bd590aafa6436b83b1d4acee1be1c8744270a85a
SHA512 4c041442242fa5e70dca0afa33b2d6f2af653185591e07eb9eaa0deb4982cc21d38a22eaebe30837a6c52ef2de309dc24c751e749a8eddbc6c86ccb187852fbb
SSDEEP 49152:bB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glYkFii0wRvVi34NcAhLL:Nu6JmTxd2dY1iDxEo1
TLSH
T1B2D59D13F1DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fe4beb283fa9a74bc1135a7a021fb9da5de669e739246b82405e48232cc1d777
MD5 a23b2fafcc9932fd6ed0e0b768ed039c
SHA1 bf09901cec9a076f3d7f149ea19ffda99111c5da
SHA512 49009908994843b99958f694db66e09ac514482dc5044a42ef2e398ece0a427207224541ec3d2db417900d5fdcafbe37cb397c005ab4757f50eac6cf6b704012
SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4xkkFii0wRvVi34NcAhLL:+mifPbRX1iDxEo1
TLSH
T1E6B5BE13F2D900E8D05ED178875A9232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c4ce1f8d4b6ada3c90f98cc7bb5287199850383d55db6bc9281c7fc50f7e518a
MD5 498d2aecc7a9db767a6116c019b68cbf
SHA1 b3ddd7f58f3b69abc04adc921839930110fbf044
SHA512 69fb676a87ce1a324a213c598046e671f970b81e6362971d384f8033747720247daef718a85de9b8dd5344f175e87b835b3ce7e2af66e6044da772c5c4628c99
SSDEEP 49152:KSuZQIY0Be2K6RVtOnks6NMHqEkFii0wRvVi34NcAhLL:U5dKoi61E1iDxEo1
TLSH
T1FEC5BF03F2E940E8E0BED67487659236EA72BC464B34A6DF068072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7f278888b0b4631a388f014ea90a17a7d101c7b5f478a73744d981794c2df1dc
MD5 4a4bd23c0d179e18de0ec0f01fe389a2
SHA1 13344b635f3582187983f011d4fc24a3e12b86c9
SHA512 aaf38c2ede2c1346880b006d881204fba90abd67da66c2dc55e2959d666d38dac333f02fd045ef5341a53edbeb12eea6e9735773ef1e1d55ee18c10996e569b4
SSDEEP 49152:ZOVSn8EApI0figTgiDn0AP5wVkkFii0wRvVi34NcAhLL:hX2iyphN1iDxEo1
TLSH
T14CA5BE13F2D900E8D05ED179C7468632E962BC050B39BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 2a8f418fe9fb0b09c1507b05def1194a7b937cea6db3cad7798264067ec3b78f
MD5 0601deb97a62727a892a7c0453f1259f
SHA1 f6e340a752a4fcf1e59101acbecce8cd9fb17ddb
SHA512 0df0f28351f5114014b5142cd2f2a244fbd949fb6c82f93de92a700465f36ef50cc91a62f1ecac4bc4156f649c4c0d009efeac4ebe3a8ca600830812e678285a
SSDEEP 12288:Lv66HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:Lv66HFioJ02B32yvVBli34N8xAhLL
TLSH
T140D423581C8B987DD80943B7A98CB1ED99EF390DF4AA651B2FC480CC596F104CBA5DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 9b83ed1ecb80972a9584946c6d00c2d85392372c705278c64624564a1b8bc6a4
MD5 a64ef2b63a65c77f509c5b38cd146898
SHA1 cfac06bd778c8cd5321f69d368247174e90e348b
SHA512 0b02d988f3a3546f1bcf3b00461dace77bf0cce67cf1aeaa3ff44445112313301bd02ab97d6a9fd0bf50e3f01fcb0a3a93d0fd26420a6265f5ede7c984d638ac
SSDEEP 12288:BE6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:BE6HFioJ02B32yvVBli34N8xAhLL
TLSH
T189D423541C8A98BDD40943B7AA8CB0ED99EF390DF4AA651F2FC480CC596F114CB95DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 d23ef9e7d542e060893a9db8eba8fa3943b9cd35891b8dd6438fd60732622725
MD5 d48cbed151a44056d5b56966089d13a5
SHA1 fe91fe031cbdaed1547a2ba2dfefd4a46a508f5d
SHA512 b72e099263b9e50c642940925a7e724e923130dc8ffe180132c9dbda3f23145c447a9f4b8610c9c5b66ee4e0c23a5232f1500528f8ffb9b49ba53aafe04fe779
SSDEEP 12288:T4a6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:TB6HFioJ02B32yvVBli34N8xAhLL
TLSH
T17CD423581C8A88BDD40943B7A98DB0ED99FE390DF4AA651F6FC480CC596F104CBA5DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 fa40496c55f3c4e2183cc95ce068b74c085f9c953f7c723b05689f9cf09e04a3
MD5 b32545dd91c42b3eab5204fb9d14b49d
SHA1 245b863f8de411f8534f6eeac711ddae857db5e8
SHA512 7ac9d492bd43342fba74c4cc977f055b2c99ce115df116692d844d7b0dd31685c38acb3f3988c6ff355652e5ed4d89550a02837f6767fd47518e680082fb0c2a
SSDEEP 12288:OlRo6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:L6HFioJ02B32yvVBli34N8xAhLL
TLSH
T1FBD423541E8A84FDD8568376ED99A0A9D9FF780DF4B6661F5FC040CC0E6B204CB64EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 401165bf26431fc782c14c70b8a29f15fea9f8ae1d58ad4dbec3593c5a7efbe9
MD5 5fe6ebc6cfc0dbb4552e3b0a4a05fe15
SHA1 fb3b8497d91eb0c26e160fba8a8ed10adfa3d11b
SHA512 dc68aa911b19fdb4823e01208509f10a52feb4924dda73def7aab2f4e7c7b702c9758a4bb0c15b52e224342085af143b1176aa363903b0710662d2f4712c22fa
SSDEEP 12288:CG6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:CG6HFioJ02B32yvVBli34N8xAhLL
TLSH
T1B1D423541C8A98BDD40943B7AA8CA1ED99FF390DF4AA651F2FC480CC596F104CBA5DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 e919608732e094fe17fdebae9c4d0a38100f34f3bbc11e4b17cfe30bc3b3803f
MD5 d0a695293102be692f777ff74f9a270a
SHA1 c9fba351914b0fc6ccfec192c9642c74d7fcc834
SHA512 dd61ef31fa58cb5a3332f4940dcbb5185c0644d0a1d1be3660291fd1fa9aa8238418ef8e0377de4921dd88af020121481154df3cc6957813c26b9487feadfc82
SSDEEP 12288:Bh6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:Bh6HFioJ02B32yvVBli34N8xAhLL
TLSH
T13AD423541C8A98BDD40943B7AA8CB1ED99EF390DF4AA661F2FC480CC596F104CB95DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 27f0c182d810f52cdab84da59ea84cae64394f71f2ca9e73847b44777d6da013
MD5 928465cd223812b1087a18acc6b1bf5e
SHA1 a14604eafe4b487e25c395657bfadf0cd94c1faa
SHA512 093112c9e4b5ee66b6a7a5afd2793630cdd52742734188c0222f31f181a6bb9e04bf9f11fabe61ada0842e878161f936d40beac8b23e40dacc4923473aea19a5
SSDEEP 12288:Id6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:Id6HFioJ02B32yvVBli34N8xAhLL
TLSH
T11AD423581C8A987DD40943B7AA8CB0ED99FF390DF4AA661B6FC480CC596F104CB95DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 c10e834225af57cffedae9584d1f890ee0f2b6361b0508999edea555e710203a
MD5 f9bb120264d9ca5a59513830e9872f29
SHA1 1c8bb95911c9fb2fc47525e4180fb54a307850ce
SHA512 6d8f05b5f74b5893990bc9924eb5ab773a8cc23842612bfaa668a99769d589f05a4005518696fd76fde00dd30517e44ad6676269c32b75edec3dcacaf91393b5
SSDEEP 24576:RZMBzeUSMf6HFioJ02B32yvVBli34N8xAhLL:RZMBzZtkFii0wRvVi34NcAhLL
TLSH
T165150194739018F8EC67823ECD55991AD6F27C1A56B0C61F07E432AA1F373504E2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 cb9af75d3be117069806e26ce80e34d74df7827dd1038aa6480ae21e360c63f4
MD5 3c352a84762cf627b9aaa02fd9fabf49
SHA1 7fd33e5f96a8c069ab11a4772c9833433b67cc94
SHA512 a055a7853360f475f941a320d22ae28f022553bec39b05f0b5831234d2c02dee044ae208e70685c5c332ade8b430087a667286d0cd06138dc8fb7e2df6a2e0d0
SSDEEP 12288:vY7f6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:vG6HFioJ02B32yvVBli34N8xAhLL
TLSH
T167D423581C8A88BDD40903B7AA8DB1AD9DEF390DF4AA651F6FC480CC596F104CB95DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 8c3af2105d86b8f64b128ba4026c09750c32198eacf46666b47ffc08ae34892f
MD5 c13951a30f8944d40d5130bc811bab89
SHA1 76422e71d6c99465931fd78455b7fe507acd52d0
SHA512 5d1bea5725702961ccddcb80f52de53b66977882cc1c5921292e54defa2e4dee2b86cbaecd2b3fee76cc2e5e1d67d721022045e3d01939791111970a063954c8
SSDEEP 12288:le6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:le6HFioJ02B32yvVBli34N8xAhLL
TLSH
T164D423581C8A987DD40943B76A8CB0ED9DEF390DF4A6661B5FC480CC596F104CB95DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 d12c53073760b2ed9cb694c4830ec1ec7be2eaf6fbc18727aa54d088bd5839ea
MD5 a6493814da96a864403a107db3d854ca
SHA1 7ce9a4c64488008270f2c6344741e0dbee98b447
SHA512 4029f7ee485ff770ead95b35fd1a39bc62c86a72d126edd11b8ac47f32160c44e70c91adcbbcdd27b65d4314aa43c12eb13e96eddc5acf99fe7791e33855f225
SSDEEP 12288:y5PfKL1an6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:IfWM6HFioJ02B32yvVBli34N8xAhLL
TLSH
T148F41207369630FDD0268239CC952556F7BA783657659A2F1BD042BA1F27250CF3AFB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 2d331fd05b5da552eed0c2c3dc7ed43b1971ec7c52a4777270e362c249f329e3
MD5 0d41913f1c266dac0c7fd0b079f83d59
SHA1 ce6ffc4fa9e7bba83f75bd7f3cab352b58be8f04
SHA512 e75096ff9ee702dc950f2f71490f4d2499da4819871e4cece5b94a1fc407e78d0b51f61e08c7485da18ff74637abc63bd5a3a879b8206aa605c489c391525379
SSDEEP 12288:j06HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:j06HFioJ02B32yvVBli34N8xAhLL
TLSH
T106D423581C8A987DD40903B76A8CA1ED9DEF390DF4EA651B6FC480CC596F104CB95DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 16968b3a52ad354039614b559fa6b80e5786d39ce0ba98c035b982b05bcd68b9
MD5 9485070213fb449607064bfa38476e90
SHA1 8968b86aca771b2215912776f135b134d7688902
SHA512 e803fb6754ed4063c8f3d2c69f22a044ff04d3f38f29226b5d1a34140feb57bbc8b44b54bd1a0c42a2a7b9254125e0188570055a3c7928937831e4d3851fd88b
SSDEEP 12288:rB6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:rB6HFioJ02B32yvVBli34N8xAhLL
TLSH
T124D423581C8A98BDD40943B7AA8CB1ED9CEE390DF4AA661F6FC480CC596F104CB55DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 1c0287de7dd4e1b6a257ca70eff999a7d56260c29fd6cd05a61a567bbb79f4a4
MD5 d13bc96bd3e097c961217e65665c7d43
SHA1 c4153ea6d98d2c9e235bd13b1da3bd8a057b4154
SHA512 16bad599b52cead27c085fb4c77800157e9a021a1559313eaa225f6727b3e58c06a973f4d31dd4decbd12745841603f8959479b4ab2410eeff34edffe21dc2d5
SSDEEP 12288:D5PfKL1k6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:lfWk6HFioJ02B32yvVBli34N8xAhLL
TLSH
T15EF41207369630FDD0268239CC952556F7BA783A57659A2F1BD042BA1F27250CF3AFB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 6c9d8aa3aca4f54b77faad07df10225605751e571da13c291aafd99697d55536
MD5 0894bf4abf8d50168896611944f54417
SHA1 8af82e70573d9ab325cbfed4ea070d538873a7fb
SHA512 d2f4549d20284c7466f2cc535fa594308333bb0d8311b1224b6387a6fc60cd7fe83c93b9c7b094d5165a453bab54de6132398e13ab3e409957379916e2beea8d
SSDEEP 24576:sTjaLo3z0z0C6HFioJ02B32yvVBli34N8xAhLL:sTOLojokFii0wRvVi34NcAhLL
TLSH
T1F81501A4739058F8EC67823ECD55951AD6F27C1A46B0C61F07E432AA1F373504E2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 2034cbdded58dc863a0d9c609de138566fab4e97361f1204696cd8539a42ce52
MD5 2a4046568216b41bd00a22c92743953a
SHA1 4eb7ad85252f824d5031d54f2b13ae0adb733b07
SHA512 eed6a0593ed42c1d74e099b8a6b421b964496ffdcabc4c9a2956d8f924105d1970c09eea5b603325bf1cc3f0d5104b4acca11b7e67c0ddff057409b18b81169c
SSDEEP 24576:R3VdtCH9y7nZU6HFioJ02B32yvVBli34N8xAhLL:BVdtCH9yb6kFii0wRvVi34NcAhLL
TLSH
T16835DF90B3E814F8F0B78A358D765512DAB67C5A1A71DE8F03A4255A1F337D18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 72a33b575f652b16bf1f3f6d0d95cf4dd9df0a964af8839711ba22c7df87d192
MD5 49e0cf7c755b41d4d0da22c981f27e3f
SHA1 24bcb562e00656d9ea24cde3331775367336bfef
SHA512 99291623366e7e0a41db29dbbec75aaacee2b6d7384e9793d1fd02d20332892b00a8367f6af0ff6e71b8163143de1d9ecf250f86ebffad5f8f1f7ed59158590a
SSDEEP 12288:li6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:li6HFioJ02B32yvVBli34N8xAhLL
TLSH
T1B1D423541C8A98BDD40943B7BA8DB0ED9CEF390DB4AA651B6FC480CC596F104CBA5DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 565f920fa04e9c4d06e81ee193bd10ae2ad124b42b527a90f370f4f0c767d3b8
MD5 61f74dcc49753fd1e6179a349f57ede5
SHA1 ecaa7432ba96ac1d982ce791923fc78a10c46212
SHA512 b91f86f6d9e94dc7cba0e404bf4f40df02c717090c0d63aa76fe4b91e9ede1b9b75672d44cfba8c95fd12d0b4cde28b554b25b8f9e4a8850b3e60759ffc0140c
SSDEEP 12288:zx6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:zx6HFioJ02B32yvVBli34N8xAhLL
TLSH
T184D423581C8A98BDD40942B7798DA1ED9DEE390DF4AB661B2FC480CC496F104CBA5DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 0a8b7091aba051152aafa12c27c6c2636edf92ca6cfd8304c1e7b0023249afc0
MD5 fdd29e282018715eaacb646097a3277e
SHA1 c7f0a19e43c1d76cdd9429ffa7dc41f6433d8c6e
SHA512 dd7b8c5d1bb36b83d40284a67cbe089736257716089257853258e88efd748dc341bc6392774f101316c946c2a41a0011fc0da74d2fc067fab38ed535cc1ebff6
SSDEEP 12288:mQ6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:mQ6HFioJ02B32yvVBli34N8xAhLL
TLSH
T16AD423541C8A987DD40943B7AA8CA1ED9DEF390DF4AB661B6FC480CC596F104CB65CEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 74d6a0d23e1b4d98f761953e918e856b977e4e2ba70879ab2352efdbd59006d6
MD5 8773da37843d6d44bc90de3c7eeba0c8
SHA1 66e48228d3643e3ca472e7bb8603e41c6bd78017
SHA512 032567686d0d67c9c9d7b70c53f8303564632def5417780933163632886bf9f263b981e89f2a66a0194cae82f3b9b0fcda473f0ac179cfb69f574347759b6d64
SSDEEP 12288:536HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:536HFioJ02B32yvVBli34N8xAhLL
TLSH
T18CD423541C8A987DD40903B7AA8CA1ED9DFF390DF4AA661B6FC480CC596F104CB55DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 ee6870fcce070893355900e6ea0c9a3a2e1fa7b28fb9354dae0ed6270f5909bb
MD5 13adaeabd3321474a39ba8e817d35374
SHA1 f9244261583a4d1f47047fa610f24a778f42d07c
SHA512 b58ad73cd18e428a054f5227e70f094f060ea24ee4232d3c1b32f010a44e3f3edef6f4cab80305b9f10d70b301f092c37d8e024518a8352c63ae636b66ae1d94
SSDEEP 12288:L2sfIK6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:JIK6HFioJ02B32yvVBli34N8xAhLL
TLSH
T1A7F40119D68841E8C05E527ADB495685F7773C2992E2E3CB17C0F0BD0F7A2508EE9B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 2a3d942c71e8520deed999e5318ddfd208d771cda4bccca0bd57b4ad211c0b09
MD5 729416189b4bbaa64f77e81c4be1fa66
SHA1 b061958a0ec331758b1034c5d1d6d8ebeb01bed6
SHA512 043cee32566a2d55c0526b361bbbd132209c50d3df873ed46983abdfa8a2f1ec8e14e88833543b47260e757cd8e71c52a92d51c988ce6753dc68e26ecbd6cebb
SSDEEP 12288:sd7MP6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:AMP6HFioJ02B32yvVBli34N8xAhLL
TLSH
T160D423640E8E9C7DE81903B66D8DA07959AF390CAAA5A54F6FC480CC193F144CFB5DDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fb616f2dab5778931ab3cd1b662662cd1696431ba765174c15499a60007cd6cc
MD5 d6394be1afba490c44f33c7de1eb8e7b
SHA1 032f4d21bc833e88968f1e14320ca49221ccc7b0
SHA512 a75d88f803354d1485fbd88498ebcd70eb1ef9e045ae2c8fe9e276b08484945b20fe3c52d46b604dacba4dc3b041179f46ad0cc1956caad604faec9031ab217f
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYf6HFioJ02B32yvVBli34N8xAhLL:Cgb4mBIBhGFekFii0wRvVi34NcAhLL
TLSH
T16265AE1E22EC02F5E0F9D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 9eda9fd3ce8a12b3c82cceae8778d3b3cc68123755569cbe9f2fdb8952fad6fb
MD5 03a9b54b750a4f841b69b22c4eb6b724
SHA1 4e2aa6700aba1aa816052966a86391203732bd03
SHA512 74a8fd87af33f9016caf1943e392ebe9d45401e0e994c76133dfd295b64a33489d53bac9e26753a16414d9b7e560592ed45abe830a3384b2a0db19c03755433c
SSDEEP 12288:08Gh6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:tGh6HFioJ02B32yvVBli34N8xAhLL
TLSH
T1C7E4132C18DA64BCC43A83766958A0AAB8FA3414A76565EF0FC0D0FC4F6B1D0D779DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 e09ece0d841ed38f0ffe69cf215a943c33170574acbea8e24c39c6ca1c758bef
MD5 797faae0b426cb3d8824fd7966e06412
SHA1 6e9532911e44b15482f3d1315dededf9f9451113
SHA512 5ba3567b249d66ea06a6cf6f7ac979b90c3242085e5bdea42e0cafb4750b05d728906946f9b9abab96a08ec18a7e8f1a8a2854cd0b1e0904a7217eb5a9cd2731
SSDEEP 12288:3j6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:3j6HFioJ02B32yvVBli34N8xAhLL
TLSH
T1BFD423540C8AD8BDD80603B76989B0AD99EE390CA7A666DB6FC490CC096F1C4CB75DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6946faa14d96c2c3f2d0117caa2d7446c44e1e1ae6f10304ee86ac965e89adb2
MD5 8bb997655bb1a0bc8e3a062b7b5ca3ba
SHA1 2175b95ce006f519af00d307629b8c41fe5564bd
SHA512 37c8532f86fdc9e42b2eb890096e0a88bbb994076c118be5b96789014e32d376c6d345180362bbb3636226fcfeae80b09f8ea4f1127cc785436fc15a772c17cf
SSDEEP 24576:wuQ8HbCJJqH1Mzria7/mB6HFioJ02B32yvVBli34N8xAhLL:/f7CvqVra7/gkFii0wRvVi34NcAhLL
TLSH
T1DC35016566E101F4D47BD1388A8646A7F6B2B4250364FFDF0BE88A951F236D04B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 f2e4c66236414aa0e2514d791d803a05ee42a13548b9b1b71775a7b47546d6e1
MD5 17b6e3e097fbd68c12b615fae1efb4cb
SHA1 876e70ca0b9361a219a61f8b555e2d9382fa5c20
SHA512 2dd6adb41092a153f48188a92529a90f14c0677f986aa63065cfda77696432bce6f6c409cc5dc20f090be948d0bbd40d4d5d9169587f52c8477ef4265f7cd7d4
SSDEEP 24576:3PUr+NQr6HFioJ02B32yvVBli34N8xAhLL:3JQrkFii0wRvVi34NcAhLL
TLSH
T1E405F12E26DD1CF9E67AA17D8986821DF77274561312A2CF03D0817E0F27AD8AD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 f28996c380b02018e8fad80f3fe4dc58469aee9611cd3dff830bf005ffdede57
MD5 b11833c519072b49726729fc823edc10
SHA1 c10550c99afb5c29472f83520a35fce6d0126f57
SHA512 d0ef5cbe223c7c473f668e0360a1110bfccf37d93054460a46574681849af0abd7c3030acd13acdda5935ab637a54db96674fd181c6227caf0058a8603134b28
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWkFii0wRvVi34NcAd:aG05lO43bl1iDxEo1
TLSH
T105D5CF6A62EC11F9D0BBD17CDAC6460BEBB23415033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 20aff143bf685292266e90bfb9f4d689b9608d5ea47f356b1975456d6f87f30b
MD5 40757036dfb2304fd67674e4769b6081
SHA1 a5932bc7d7c2233b767aaeec9b7d7168a5649887
SHA512 d8fbed67c2a0178f7703b6783cc29bdb1d37d5d923cff460a5f8f5dd95fef20f9cb99fc82a83805535367881f5793e5039e3e804daaefa3584e1f9fd0ba41b4c
SSDEEP 24576:kNa5POZ3dpbWVM50JicR2hG0lasx2+47eidnLb6HFioJ02B32yvVBli34N8xAhLL:ma5POZ3wJt2pasx2+m9bkFii0wRvVi3S
TLSH
T17565BF5EA6FC00D5D179D17DC583861AE5B2342553329BCF026182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8cdc770110043ff9b5e1db7fa27f4a860d8a3a16449bea50353b1feb40147232
MD5 ee34cf0a7a88f659244d7e4eb4b238b4
SHA1 cf5d680b907a6d60b081caec6ded2e9ce4d36fa2
SHA512 0011e08661015faca9370c0ef8805ffd2bce40c4a306149edd4d2789339d42af5ee539af675c3fa66875137ad395a32fa790320c974600db1f8fb39bc589fa12
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fky6HFioJ02B32yvVBli34N8xAhLL:sNc/zEOVHFbkFii0wRvVi34NcAhLL
TLSH
T174858C1623E901E4F5BBE1BE89679546FAB1786953308ACF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 661e0c4e6ea365529a22a343b75a90ab16a4f4579770dd8f56e97e88dd795728
MD5 53d3e32a907eb2af709c5de455b13dcf
SHA1 66ee363b0f9aa671fd5e4ec7629dcdf220e4cbbd
SHA512 20b992409dcc79398ab7f691585f7aa91d15f054100dd58684b01ada41f79841d79d31f9f75ea588dfbae20f146b1c2f9d4d4591afd36d7e788dc34ef55f9d3d
SSDEEP 24576:rJnJPbzB4Sh6HFioJ02B32yvVBli34N8xAhLL:rJnJv6ShkFii0wRvVi34NcAhLL
TLSH
T19B15E03CD29810E8D4B7C2B4815A169AFF71386C2F2669CB19F4D4743F12ED0AA79F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 beac78a013d83422c3bcfaa648a1fd30a8919147bbbf11077139ec2941dab6d9
MD5 d3671151c7c828f2fac3dfd3a575d6f7
SHA1 789d3134a1c6a0ba6296def1f2f28565e6540900
SHA512 825e76435d4d2cc6e497e7d64a0881b225b73abfb31e120f6e43018d0cda39c423408a20be9c37718d4fd8fd2700bbb5cdf42206cbb92b2d3279a9763779297a
SSDEEP 49152:eCLHGeeV5ijCmlDWDk5kFii0wRvVi34NcAhLL:V/1iDxEo1
TLSH
T1D0A56C05A7EB5188F8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 6b5fe7513f5d49fd9113d4f0312b941add523a30f390159bb31047b358bbeb4f
MD5 20fd96f5252e3cf690307b0ac0fd71bf
SHA1 3252d228e1c7619f8b48f1a0b0acca63b86dafd7
SHA512 1a16b243d13f0430a2cab3d0144a42f054e2249f60106705a645681e27c682aa17d577d9819d21a8b07ca3c06260cd14ddb5c8b2fe1b01fc1ecbb5d4b3c15ff1
SSDEEP 12288:X1Hck6j5ZI7x6HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:j6DIt6HFioJ02B32yvVBli34N8xAhLL
TLSH
T1F505025C276A10F9D06BD03E96824156D6F2B464D3625ADF0BD4C0BD4EA7EC8FA3CE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 0ec13bace52a76af1c4477099f36a0935c60d7da1c36268418b9eaf638950189
MD5 5a3ce62ba4e77b2d9aaf0ed7e7fb610a
SHA1 dccd46cba783f7c862f14a9a8fe541a5ecdd68a8
SHA512 2b55a4a1983292ce915be3b8dfadb04a06713011626c590514b1a740fb7941f99eb567af3f9371767b99713997795dc1d8bc7982ae512320a5164903e94aad8f
SSDEEP 12288:VG6ky76HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:sty76HFioJ02B32yvVBli34N8xAhLL
TLSH
T109F413041788A4F8E9690379AE5691A58E7A7C14AB6253DF1BC0D1AD1F3B3C0DF30F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 6d5bba2b41bd6a9b116eace16cda767359808385d902dbf46f31920a6b7ecc4f
MD5 5ca8718ea7c7c2f0de32f74ca558fa04
SHA1 d8cf20918e97e64e8d99aa3e3dfae4d9c9e42727
SHA512 72d3344d0f923376d3430cfa57e1386e94680abfeeb52333b67bcf027520b542bccbe808bb1f39cb7e56f3eb8bfbc63707d4cc0b634c047d9c26e82e77e6ce8a
SSDEEP 12288:8X66HFfKonJdxsFQxwzW3Tayv8qBlijbI1N8xe6PV902Ohdt+0l:o66HFioJ02B32yvVBli34N8xAhLL
TLSH
T1B4D423581D8AA8BDD80543B6694C61A998FF351CA7A725DF2FC0C0EC4A2F1C4CB75DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 b32b69c8cea5bd58d67a8dce62d4c72bd68dd4dd8354cb53c819a312b84ff952
MD5 b092129e227e59ca210eb144e04ed6e1
SHA1 7aedb4dca4997c9b950b974abb92b6ba01d594fd
SHA512 d9a5ac69af97802db00f9b5e9b2a810cfc192b63c0603ef20095055c4ce43db23c06c4c8ebcdec248042cb9bc4e56ee88ef9ccf9f47c596bc3b090f2a91e3b0b
SSDEEP 24576:begCLoTfaidZy6HFioJ02B32yvVBli34N8xAhLL:ighTrZykFii0wRvVi34NcAhLL
TLSH
T1DA559D1D67EA05DAE2B2D235D8721493D633B4315772D6CF2488C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 4de585f0b39f78cbc09d8135effda1b0001ce2042047900e4770a1aa7bcc8e6a
MD5 2774f66e652debe9355a0a74ff008f5c
SHA1 54219bc7b24bbf40662ec4e4831b54cefc3f3276
SHA512 a736d5bcca201ecb480032145f3ec384a6514864c1549221386dae42a1d0bb2253a19954cbe2be27ee95a6e9a85056f64579852b127ecb891e997402af0f4bc2
SSDEEP 24576:prcmRV6HFioJ02B32yvVBli34N8xAhLL:9cmRVkFii0wRvVi34NcAhLL
TLSH
T13005F15E76AE00F9E1B7827C88854156E6B37034636267DF06D0C3BD4E6B5D8BE38B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c6c95fce5425cb834b8f8cd40918c66b9dd1c80b4a5cc1ce7a9b74b336963440
MD5 cd81a5fc306d8cc9b4e3c35b8a08b8f2
SHA1 e57c9dda3b6cdb751e28ee7c4b59c5b25ff31668
SHA512 af76cf882653f1e198012c9dbf5895fe972e80d4176a2cfefd55b0fa16a83a994c57da91840682de1b3f8c666cd36e417737e4fe0d8184407d81a3328f162af3
SSDEEP 49152:cDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3XkFii0wRvVi34NcAhLL:53Upow8sBM1iDxEo1
TLSH
T10FA58D3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB01B4C178BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1712-310-0x00000264AA620000-0x00000264AA686000-memory.dmp

Download

memory/1712-311-0x00000264AA620000-0x00000264AA686000-memory.dmp

Download

memory/1712-378-0x00007FF719220000-0x00007FF7192D4000-memory.dmp

Download

memory/1712-309-0x00007FF719220000-0x00007FF7192D4000-memory.dmp

Download

memory/1796-379-0x00007FF770CC0000-0x00007FF770DEF000-memory.dmp

Download

memory/1796-381-0x00000201B1900000-0x00000201B1966000-memory.dmp

Download

memory/1796-380-0x00000201B1900000-0x00000201B1966000-memory.dmp

Download

memory/2144-346-0x00007FF7E2000000-0x00007FF7E2321000-memory.dmp

Download

memory/2144-340-0x0000020961110000-0x0000020961176000-memory.dmp

Download

memory/2144-338-0x00007FF7E2000000-0x00007FF7E2321000-memory.dmp

Download

memory/2144-339-0x0000020961110000-0x0000020961176000-memory.dmp

Download

memory/2144-344-0x0000020961110000-0x0000020961176000-memory.dmp

Download

memory/2272-50-0x000002B02A080000-0x000002B02A0E6000-memory.dmp

Download

memory/2272-44-0x000002B02A080000-0x000002B02A0E6000-memory.dmp

Download

memory/2272-43-0x00007FF681D40000-0x00007FF681EA8000-memory.dmp

Download

memory/2272-46-0x000002B02A080000-0x000002B02A0E6000-memory.dmp

Download

memory/2272-52-0x00007FF681D40000-0x00007FF681EA8000-memory.dmp

Download

memory/2396-55-0x0000028C67550000-0x0000028C675E5000-memory.dmp

Download

memory/2396-56-0x0000028C67640000-0x0000028C676A6000-memory.dmp

Download

memory/2396-57-0x0000028C67640000-0x0000028C676A6000-memory.dmp

Download

memory/2616-246-0x000002233AF20000-0x000002233AF86000-memory.dmp

Download

memory/2616-245-0x000002233AF20000-0x000002233AF86000-memory.dmp

Download

memory/2616-244-0x00007FF689270000-0x00007FF68938A000-memory.dmp

Download

memory/2616-328-0x00007FF689270000-0x00007FF68938A000-memory.dmp

Download

memory/2776-299-0x000001E78DC60000-0x000001E78DCC6000-memory.dmp

Download

memory/2776-442-0x000001E78DC60000-0x000001E78DCC6000-memory.dmp

Download

memory/2776-444-0x00007FF6362F0000-0x00007FF636707000-memory.dmp

Download

memory/2776-376-0x00007FF6362F0000-0x00007FF636707000-memory.dmp

Download

memory/2776-300-0x000001E78DC60000-0x000001E78DCC6000-memory.dmp

Download

memory/2776-301-0x00007FF6362F0000-0x00007FF636707000-memory.dmp

Download

memory/3288-241-0x00007FF629090000-0x00007FF629159000-memory.dmp

Download

memory/3288-318-0x00007FF629090000-0x00007FF629159000-memory.dmp

Download

memory/3288-250-0x000001C7FB790000-0x000001C7FB7F6000-memory.dmp

Download

memory/3288-251-0x000001C7FB790000-0x000001C7FB7F6000-memory.dmp

Download

memory/3340-3-0x0000018F492F0000-0x0000018F49356000-memory.dmp

Download

memory/3340-19-0x0000018F492F0000-0x0000018F49356000-memory.dmp

Download

memory/3340-22-0x00007FF7EA020000-0x00007FF7EA223000-memory.dmp

Download

memory/3340-0-0x00007FF7EA020000-0x00007FF7EA223000-memory.dmp

Download

memory/3340-1-0x0000018F492F0000-0x0000018F49356000-memory.dmp

Download

memory/3520-25-0x0000015ED2A60000-0x0000015ED2AF5000-memory.dmp

Download

memory/3520-28-0x0000015ED2FC0000-0x0000015ED3026000-memory.dmp

Download

memory/3520-26-0x0000015ED2FC0000-0x0000015ED3026000-memory.dmp

Download

memory/3520-27-0x0000015ED2FC0000-0x0000015ED3026000-memory.dmp

Download

memory/3564-12-0x0000026E51F90000-0x0000026E51FF6000-memory.dmp

Download

memory/3564-61-0x00007FF6A5290000-0x00007FF6A53B3000-memory.dmp

Download

memory/3564-13-0x0000026E51F90000-0x0000026E51FF6000-memory.dmp

Download

memory/3564-11-0x00007FF6A5290000-0x00007FF6A53B3000-memory.dmp

Download

memory/3564-14-0x0000026E51F90000-0x0000026E51FF6000-memory.dmp

Download

memory/3928-330-0x0000016034530000-0x0000016034596000-memory.dmp

Download

memory/3928-389-0x00007FF709310000-0x00007FF7094A5000-memory.dmp

Download

memory/3928-329-0x0000016034530000-0x0000016034596000-memory.dmp

Download

memory/3928-334-0x00007FF709310000-0x00007FF7094A5000-memory.dmp

Download

memory/4112-364-0x00007FF75DC30000-0x00007FF75E374000-memory.dmp

Download

memory/4112-282-0x00000220D1700000-0x00000220D1766000-memory.dmp

Download

memory/4112-283-0x00007FF75DC30000-0x00007FF75E374000-memory.dmp

Download

memory/4112-284-0x00000220D1700000-0x00000220D1766000-memory.dmp

Download

memory/4332-34-0x00000172E0F10000-0x00000172E0FA5000-memory.dmp

Download

memory/4332-37-0x00000172E20D0000-0x00000172E2136000-memory.dmp

Download

memory/4332-35-0x00000172E20D0000-0x00000172E2136000-memory.dmp

Download

memory/4332-36-0x00000172E20D0000-0x00000172E2136000-memory.dmp

Download

memory/4532-447-0x00007FF68EEA0000-0x00007FF68F3A7000-memory.dmp

Download

memory/4532-368-0x00007FF68EEA0000-0x00007FF68F3A7000-memory.dmp

Download

memory/4532-369-0x0000016922B00000-0x0000016922B66000-memory.dmp

Download

memory/4532-370-0x0000016922B00000-0x0000016922B66000-memory.dmp

Download

memory/4652-233-0x000001F71FF60000-0x000001F71FFC6000-memory.dmp

Download

memory/4652-234-0x000001F71FF60000-0x000001F71FFC6000-memory.dmp

Download

memory/4652-232-0x00007FF629090000-0x00007FF629159000-memory.dmp

Download

memory/4652-308-0x00007FF629090000-0x00007FF629159000-memory.dmp

Download

memory/4848-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4848-349-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4848-271-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/4848-276-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/5056-290-0x00007FF7772A0000-0x00007FF77734E000-memory.dmp

Download

memory/5056-291-0x00000266E5480000-0x00000266E54E6000-memory.dmp

Download

memory/5056-292-0x00000266E5480000-0x00000266E54E6000-memory.dmp

Download

memory/5056-367-0x00007FF7772A0000-0x00007FF77734E000-memory.dmp

Download

memory/5172-352-0x00000253B0A70000-0x00000253B0AD6000-memory.dmp

Download

memory/5172-351-0x00000253B0A70000-0x00000253B0AD6000-memory.dmp

Download

memory/5172-350-0x00007FF601AC0000-0x00007FF601D4B000-memory.dmp

Download

memory/5172-445-0x00007FF601AC0000-0x00007FF601D4B000-memory.dmp

Download

memory/5364-386-0x00007FF652A10000-0x00007FF652CB3000-memory.dmp

Download

memory/5364-322-0x000001CC54090000-0x000001CC540F6000-memory.dmp

Download

memory/5364-319-0x00007FF652A10000-0x00007FF652CB3000-memory.dmp

Download

memory/5364-321-0x000001CC54090000-0x000001CC540F6000-memory.dmp

Download

memory/5464-337-0x00007FF6E44D0000-0x00007FF6E461A000-memory.dmp

Download

memory/5464-261-0x00007FF6E44D0000-0x00007FF6E461A000-memory.dmp

Download

memory/5464-263-0x0000015215160000-0x00000152151C6000-memory.dmp

Download

memory/5464-264-0x0000015215160000-0x00000152151C6000-memory.dmp

Download

memory/5796-359-0x0000018A0E880000-0x0000018A0E8E6000-memory.dmp

Download

memory/5796-360-0x00007FF6DC130000-0x00007FF6DC601000-memory.dmp

Download

memory/5796-358-0x0000018A0E880000-0x0000018A0E8E6000-memory.dmp

Download

memory/5796-446-0x00007FF6DC130000-0x00007FF6DC601000-memory.dmp

Download

memory/5904-390-0x00007FF7E7D10000-0x00007FF7E804F000-memory.dmp

Download

memory/5904-391-0x00000162E5000000-0x00000162E5066000-memory.dmp

Download

memory/5904-392-0x00000162E5000000-0x00000162E5066000-memory.dmp

Download