c4db603544e4271be2a43db12fc482733a96f5e5d6ecc7dc536c853f5d628772

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
Size 2.3MB
Sample260831-a98bcsbr7x
SHA256 c4db603544e4271be2a43db12fc482733a96f5e5d6ecc7dc536c853f5d628772
MD5 f2e25319d085b1acb332ea42f7e5184e
SHA1 b2c00c03fdf227120ec6877046afc6cb4495187f
SHA512 ed9950f5f8d70386c0f04b7a338bfabd23a53c224540787cda8f5dff037706a65ddba5db91456db5e2b5d143c8e7805723506d70facf5cf27530a82f0e5641eb
SSDEEP 49152:hbgTJkk2m4x4sLn0LqHEzkjsVc2ot4+Ej2hqjdNKnAX1tIc5foj3:uuAzkjsVc2ot4+Ej2i/0Okc5g
TLSH
T116B5AE24F6485295C1BBC27DCA8A8B4BE7A1F40947349ADF509507DE2E737E04D3EAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4168	elevation_service.exe
2660	elevation_service.exe
1432	maintenanceservice.exe
2644	OSE.EXE
6080	PerceptionSimulationService.exe
5140	perfhost.exe
6116	ReFsDedupSvc.exe
1480	SensorDataService.exe
4540	ssh-agent.exe
3696	AgentService.exe
3244	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6d8e9c16238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e58c6782e338dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0dc6c82e338dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d09c4281e338dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052e754c5e338dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c07d38c5e338dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008572dc5e338dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080b704c5e338dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3696	AgentService.exe
Token: 33	3244	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3244	SearchIndexer.exe
Token: SeDebugPrivilege	2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2420	2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4168	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 1084	3244	SearchIndexer.exe	101
PID 3244 wrote to memory of 5864	3244	SearchIndexer.exe	102
PID 3244 wrote to memory of 3028	3244	SearchIndexer.exe	103
PID 3244 wrote to memory of 8	3244	SearchIndexer.exe	104
PID 3244 wrote to memory of 2468	3244	SearchIndexer.exe	106
PID 3244 wrote to memory of 5460	3244	SearchIndexer.exe	107
PID 3244 wrote to memory of 880	3244	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_f2e25319d085b1acb332ea42f7e5184e_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2660

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1432

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2644

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6080

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1480

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:8
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 52e7f1acfb8d2d81a2e71256c669051ff6d8a0637aca07fb28893bbe1e232f0b
MD5 3f003618d563d187fe0a1eecf8a5daf4
SHA1 cc6da247034c45691f308a48d803ad7ea49383f4
SHA512 ba0463dbab4cbc956b99ed90d21e712862a3ca126d1a56dab8cf358fbee226a75849f51d8a7c97fd4c9d23631c9290e624780d396f8c247083614e8fe8cbdede
SSDEEP 49152:Xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxncKnAX1tIc5foj3:F3q6sjB30Okc5g
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 7517c2c043f41c4b20b66b90365091a7073aa663f5986d1c24a342fc0cc4647c
MD5 66a401d660b41ddc697c3000611b5275
SHA1 b5dabf983e98176da0e05f84f44e87c355fffc7b
SHA512 3e2fe1d62b3eb9e80b4425e4541f6f761ccdd8a1de5ead608a81930f1a2a11c70579b12c8395cf952644a588f2441191516f5d89fab4c290e29fd0b6695a9597
SSDEEP 24576:GXYfDtczAz3KnAoIBlEq1tIgAWz5foj3Z:ltc2KnAX1tIc5foj3
TLSH
T16705F12477E408FDED678238C9B28406EA33B8514770E69B03B499266F377D85D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ff6d67d855553216b2cde6f6415a85680652a83bdee7ae5eca31a877e151083e
MD5 51376663bde4bfd3d32d358720ea7331
SHA1 656d2ae424a0c257ed849c5ba3d11249007a20b2
SHA512 eec90abf9d285043a88e501e6a2a58d75d1a014f7d68e9e69f87a71c294b0a8f42782a6af4e93eadf33db61779177727ca8e04411cd395a03eddfb50bbd1d180
SSDEEP 24576:y0Le5ji0hmxxrMG3KnAoIBlEq1tIgAWz5foj3Z:yPji0AjxKnAX1tIc5foj3
TLSH
T1EC359E26F6788335D073C0B9C5D2A68EED7130825B3089CB4296D77C7E67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 da9bca08962ca0114f6cacda6f3ee8bc4f210c2434d66faa57f24f0e96818210
MD5 abd972892161812b1163a57d587f5e7d
SHA1 c3d6271fd01258e83c37453e542c029a8a620093
SHA512 29604cb2f176addfc99f5d3e10356310d63e2f2a5a2a8984a873c4254564c74d8b0374f1d38e38db425dd0162d5e562fed4c7351c17387da95d625995ccd67d6
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWn6q8wyuw3KnAoIBlEq1tIgAWz5foj3Z:t/ezSC6vUzPveHjydKnAX1tIc5foj3
TLSH
T152756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 55a234fe6398fe57703e311d3c2021813deb82457b1c1932fcf230f625ec5662
MD5 5c579c90979c108012c8ad0d4e278264
SHA1 0fc14b9e5f3e9833d837671be8bcb3d7a67fc23f
SHA512 57086c1588c4f15926fd60e6aa2764695d6c4fbc697faab27270349eadccfb58ac000de52ae9719dee9b0915fb2a1f9ab890b52e0fb6bf62d7a4de2fec8a97cc
SSDEEP 24576:RVbqPb88hv/l+YX3KnAoIBlEq1tIgAWz5foj3Z:RVO88hXl++KnAX1tIc5foj3
TLSH
T147559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2bad5d67e1c0df7e2a7cea7916f9ea60d6852bcd25992b120852cc5276cac130
MD5 29182ddd5c239046671c9c565885c496
SHA1 41105cd4da43eb8576639345de5587b684879daf
SHA512 db284e3644ff1554f76e7f960f9f401089c6957ad48e1163a16d3c931775bd8f5566f6b8d8713c330e9c4ead2582807ec81b5f6776699e125f665c053351eb38
SSDEEP 12288:8LoZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:8La3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1ADC423217B5C182EE7674631A2F6688AFD75DD70453A48232036FD17B63CDA0A83F276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 4660f1bb3dca883202308c38fd3b9401f801cadf2783ca6745080f6c73e3d3c7
MD5 c87afd0efd99a853f9b815ef666b51c5
SHA1 e7e98054027b73b23b272ec15a4f47ec474f5b98
SHA512 0569b36e38c83f8a313aa46d73f3a42b3052de15e74c491c2dafa7c2b84e0b2145a5565efd68d75cb7a1134ba26f82399acea4666000320771c4d21a3b4fa62d
SSDEEP 12288:5eBNUbTVO86UFZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:5JIU/3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T18B05C037AE28FCE2C27A8D7957918640EB7278304B6293CBD175C20EDE275E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2466cfaa85757239be4302810ba1fe31d9241f2a40468645fddbfef101b17566
MD5 a6c3de10ea885ee15812f04d84b16b4e
SHA1 884d9f2e537e3e8fd394fecfe38bfcdb8b78b84d
SHA512 59e91ab83b6998349b0072d4e6c5457ebe83ec75b78d536350b521a589ba3f13f7029ba08efd9fd0027f6a986542dbd71f7c9355f115fa1a85277d8c47e0e948
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:4QvGAdlCEL8c/DRNw5CW0Okc5g
TLSH
T17D266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 701fe2e774ade82c96823c17867d8c2e18a7028bc84bc48cbb4b35a47dc176b0
MD5 932674093605aede31296019ed54617d
SHA1 6a91e8faaede19706978b4a7989da37f36907e5e
SHA512 dbebc43d00d9fa16ef211cc182641eea4733b40324b2e241e73755ab043644bf1aca5b4f0095e59076b83a2ea87a12a8a85a1ec11201792c37ddb65c38113da3
SSDEEP 12288:VAwSfxL/2Dc3RDLLmt0LDQewsAjfZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+p:20ewsAjB3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T17215E031FE74E436C27B0DB21B76C716687CB9204B6119C3E3B88D9E59346D22736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 201229132a59c97b5dfd4adff188921a62f57cdf1a4acdd0346c39ec673968e5
MD5 988d69c55a1e28e759d6bc4cde79f052
SHA1 45cf0ac6d3b0ba9d2e728d74c63f8d762c11f626
SHA512 14c631b2291f546181d028a05b0375944353b5f080b95dfd98cb9dc6933c4d2d2158bacc75ffd7d8945e16f24c68e2088d4947cdb14c0972a52b7af55b10dbf7
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHmOBg:iUEtQevvqc2W1cpV2tI32t
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 81a5aa5b8c4ca61b4eb193ac67657fd983cca1190b295935aa85fe57684a1641
MD5 92148811378f7d7ee4784574051e614a
SHA1 05aedafd32d371540dc0309f7ea12a897beeeb1f
SHA512 a98dbbcf65f0eae0bc247e27e45075c9d4165551f570958d8bc18925051f366827131771c98064016f59ab0e27d61351805145104c6b86f374cae9ff2509beac
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/zhKnAX1tIc5foj3:woquVjnmy0Okc5g
TLSH
T1AED58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 51e372b4924d50660f4a557794443af46fb4d19d55bbe6504887dc16ad749bdc
MD5 85aa77d1c422409cfc8473c6a0c749e3
SHA1 865aa4052afeee49cdb67e107b2d6283032ac6d5
SHA512 0a651dfb482998546722cd46f333362c779b826fbf83e5cb4b66572917bab5ff18852d3653bb0ac47228b61e7efb8d670a617f0e787e67d6b7800afbba9aec72
SSDEEP 24576:FAhGL3IFoiwtA5l7S53c3KnAoIBlEq1tIgAWz5foj3Z:FAMUFoiq5CKnAX1tIc5foj3
TLSH
T19435AD80EBF945D4F5B3AAB899B68171EA76BCA55E31C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2addd063094650454c679b20973109aa0709b1ad86226ffb0fff82f08778ed28
MD5 aebcda5e9ac00c8ef5308437bc32de45
SHA1 12ad4a123bf72ba416a8d33143d8f7afc97dbfee
SHA512 612a0fb9cc56ff2a518ec880c307ea84e8743a0cd6a30220dc4aa6b70eb3add4d7d6268a739e2ae88a19a2809df9a65d9c4bd5604429a0b33179f360e03a24f3
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CmZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojp:Wwu4OWt3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T11F05F14537A80CF9E9678239C6978536FBB2BC112A25CB1F1370C61B6F376616D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 27056db24f5b45c9c091d0557d383cee4f3b81468f2552fd710837cf853c5628
MD5 fd4b52c3a1c4866a752180657c062832
SHA1 aa9dd1aafb0a9be0c36ef79851e19255b774c490
SHA512 4748f2a4dd470658da07276ded5c90e2f8c4093135f0c5133dc4cf4273c0e18c82052dc202a4caf1f04794182b76ca2c00ad35dacd1d6d161cfabb07c96f0986
SSDEEP 12288:peZ1IyvZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:MZuu3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1CAE4125137E824BAE2A34238D5F5594AEB72B861133643CF213586577F3AED16C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5bba1572be40f81ee801a73b5bf94264b6e822385ec16319467bc845607b2cc7
MD5 43b977a81e9f834d16193ba223c1f1a3
SHA1 4eab6a2fa7ecaabf618d976b2678906c4ff8f2da
SHA512 0571950c3fd3122e8b971d4d7dda719b742ee076eb390c542a7f095276044a78bc8b7c0fddc833b76fcdc065188437a0292a3f51232f48e0ecd1d341642912d2
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Um:PQRQyi36YOcPbLvw2gAf+PN370Okc5g
TLSH
T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 762100ccd553270fbf81de31ad9fa6105401191a5c9beb363bad5e0c70b0f0b3
MD5 87a4fa4e924fa46f64ba0d5ead40ffd8
SHA1 c491065fb2ef19382c7b9791bef2b29a69d7128a
SHA512 13277d2b44a5f22713790626d14b2393a7bfc192660b8856ad552670648133eb0a1a68db92a4a6cdab358ccd2c7e396f25f25e6633b7b9f5e41df03fce7b8985
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Um:FQRQyi36YOcPbLvw2gAf+PN370Okc5g
TLSH
T13E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 336beb705d33a1d645ba657f090b11d750a7a2db540055058967d78f48729f1d
MD5 6c248550882384c923acbe854e63273c
SHA1 197b753a39fb0357f81e39212b114c77065a558b
SHA512 8277affa1dae812a7be0fef1082182aec4ff7499ef160763f0e06ac1f93fd137aa6d1b117655c69953858c79e70d913bb0a678e3dad1eb9518c5dee8ef694f65
SSDEEP 49152:D68Qg55nhceWu7PNU3/xKnAX1tIc5foj3:9thLRc/x0Okc5g
TLSH
T186B55A33B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ef7e754d804937ab2f0d7c7f835e5a16948501f5094d6f4a61fee5494faffe25
MD5 d0b908c16dc2dc291a265d16fc0ef899
SHA1 8e42c94dd3801bcf8b3eca079d372262d240caba
SHA512 24217b65dc0207fd64dcc82dd00d70da9906f7d1a60f2a96c3a3d9470481003757584991ecbb9d64ee2626334e745f7917713dbea49ab602adcd9affe8a8c953
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99k:ky5112gYy5azzVvt69nLKnhZo0Okc5g
TLSH
T1A4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d8f356c513dc1ba8388c3948a0a80675adb00a046957689665c1b0a0989ea400
MD5 072010f0bdb0c66a2bb0593c827e33e7
SHA1 d77f635a15824c6f73fa317db9a9ab04bcbf00b9
SHA512 c50e88e4bd5f37b1f463976c4b0ec04776246b00755c6115e4a14498cafbebba9a15e933107eeda4f42b556ee9051082a0c8b7b57014bf6f41a1fab97ceb1fb1
SSDEEP 49152:nB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gljKnAX1tIc5foj3:pu6Jmdxd2dj0Okc5g
TLSH
T1BED59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1206e32aaf9d60843482a5062b653594ac36cdaefd268816cfc5c6fcd6d9c97b
MD5 5c87d6e89ab2adc783de6cde5fa98de7
SHA1 bac66d2fd938c7c657f0e91807b08aeab50c0a00
SHA512 be2c6769fc46979dbfa53e118fa96636f29bb5b3a442cd92d1c022844d1533ee91ba74189db28acd395e7cc899bd36e11671263c3d46a2c15dc0133b808a9b42
SSDEEP 49152:31hpsNoJpF1A63U44CwH7R4xPKnAX1tIc5foj3:3mifPWRy0Okc5g
TLSH
T19CB5AE13F2D800E8D06ED17887569632EA62BC450B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ca5630455b08c599db20e4cc34b33c5d82797c5bc308c29e8100fb7452595d1b
MD5 d4172178909058bcb1a2ddcad51ba64b
SHA1 ed67503d3a16aee6fe8e54fa7e868f33d9425d2b
SHA512 f504a86a69fb2eac6b69ec5e84f9f542e5c034f3a3a5cfd225c42df866c99543bedf202a33add72b49f260f1170df788fe0e8b76c5d89dd72ab2d68aa7a314b6
SSDEEP 49152:bSuZQIY0Be2KcRVtOnks6NMHqsKnAX1tIc5foj3:J5dKii61s0Okc5g
TLSH
T1E0C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cadba13649778a0081a8905f98f8f1cb558283b35ea7142735864d1699219b39
MD5 3fe1223e885e7f98031b2cfd32b17b18
SHA1 0c9338529620b76f277362fd01f6db4d2d8fdf2e
SHA512 6514daed53be8a402f5bfa784f933718969149d236de7952f294e25516adb3041ae4fa568fe8e143dcc4b34ede93c8f7819ea4f2b83f00ae10c7fb55b97279ba
SSDEEP 49152:QhtSn8EApI0fig3giDn0AP5wzKnAX1tIc5foj3:BX2imphO0Okc5g
TLSH
T14295BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 89c2b95855c4c40de2452f2885724a2eb1e6f978979c1eb1b12df2ed1b309837
MD5 3b5c36cee1fd5c83d88862576cba7787
SHA1 4cea0c01bed2df01c008ef69aba402ebaaa71a9c
SHA512 1e0fd85b738e1d761a61e6aa04494555bccad5570d75554bb9fc5820510123e767d07906065b9b2fe1a1b5eead5b0821ab0053774bb8748d62978f9385fc88fe
SSDEEP 12288:wAZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:wi3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T132C423217BAC082EE6538671D2F6548AFD75DD74453A4427313AA813B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8a5a69efe1a9290ed3002d5612ce4cac701e08466e1c464ed952ab7d098983c4
MD5 a8af6a066129f32cf663a58138b086c9
SHA1 64a8a55cb3bcf5e9dff782eab5fabdcabc159029
SHA512 2bf0cd84cd8a329845e20ce68d5f55b310d513e17ba1ed72117a726d6416f83e2540c7273046dcbafe587e2da7f9e26fc422e53b79f23d112ffbd80e755bcb29
SSDEEP 12288:zLZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:zl3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1E2C423213BAC082EE6538671D3F6548AFD75DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a37f6d45d24d4644270758723d71903b409ea8c09de4abe907887f31a391202c
MD5 cde4f8855c02143d7b4f6b35d018a640
SHA1 14ead68e1cdd162f49b1d927f6bab99fc84ebf29
SHA512 e8e0fa0029564efc240fc4558d2612870e765547e3160ed6eedc12eebddc7d0639190fb453a0952b7f0c4a87aa4e9df6ab83d49503e6e362195489108b48657a
SSDEEP 12288:n9Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:nn3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T15AC423213BAC082EE6538671D3F6548AFD74DD74453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ed52eb00e2b5b5ce3f0eddb6746a99ee17d8624d2ff7682c7ad6b9eada5a4f60
MD5 40ad4b07aaf21f738012d7d50175b4ce
SHA1 18281a68b2cb29e454a2eba6198a9c5d87a1007b
SHA512 865b589f957426e83f34d7f240b43b309d79c8a4e68ff5fd9c089a2ae1c17362bfe466050b45bda138b70649626a6dc7b4a3213a58f33ba88e8b9ce3d9f4a291
SSDEEP 12288:WVKZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:53KnAoIBlEq1tIgAWz5foj3Z
TLSH
T176D422213BAC04AEE563C274C2F6544AFEB5FC708636446B252599077F39FE0283A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 9f4e0dd603c9dbf087a90e4701ff63886de95c3a741e7bb07a45a4119ac418c9
MD5 19d582ff877072fa672d58f517d528d5
SHA1 12e37254ffcffc8f92476baf0ab9a7baf2a0a79c
SHA512 7744e07854abe7fea90819d7ffdbba5572026e1f2cc091aea3e2fa6de4d4a37c4e7a4041d3a50a3db826aeae080ef66dd193820dee8c537b94d47b04ce043404
SSDEEP 12288:1yZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:1U3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1C6C423213BAC082EE6538671D3F6548AFD74DD75453A4427313AA813B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2bf86af60b6df08443a8d2791dffd763406205d135a81cbd1546d0679ac7b166
MD5 676ca621489511f6f13533827d28e1ab
SHA1 13f491de0527bef153fb9b4809e8e793482a5a0e
SHA512 1339f5f13303532591bcbb6eb1f30462c7d7ede996e8d9443662d5aaa74706fcf92b9f4e8e0a6f7b0d2cd77209d68585b59e73700594836305de4bf56ff73e78
SSDEEP 12288:LXZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Lp3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T18EC423217BAC082EE6538671D3F6548AFD74DD75453A4427313AE803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6826df095b9b84ebfd830437442b4aab69b71252685bb7416d4994567f404847
MD5 5784c75615e7d378da506ad05482f2b5
SHA1 841368e17da381e0b9f872ecd20645fd32604de1
SHA512 491cb701cc7d8d3fc7f8b7c6288edd18113ee6c2af0e17ac05a25ee37366f37da7b023dab953d1259b8343f798d6c4ac4f392dfad41e4fadbf4478d5faddb984
SSDEEP 12288:UzZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:U93KnAoIBlEq1tIgAWz5foj3Z
TLSH
T108C423217BAC082EE6538671D3F6548AFD75DD74453A4427353AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d6ed08f83baadf4a1d02d8d998793c0fab2dfa9b2c5683590677a73ac0ca854c
MD5 bda8e87562172cd737740d57eb8dcca2
SHA1 ba83ff2c2929a1d60f691cf016e06fc7ec8da49c
SHA512 dd6505265e2dad64dd0731bcef27775f6c7bc45579609d13471b1bd2b749dd096c9cf16f7482b5744a1fba2edb0a37f0b9b760a79ce71ca22ef8c7d720002494
SSDEEP 24576:ZZMRzFVSOF3KnAoIBlEq1tIgAWz5foj3Z:ZZMRzfZKnAX1tIc5foj3
TLSH
T1C205F161739418F9ED63813EC9658906EAB2BC650770C61F13B436276F377A01C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b5e9873e1e2dd23b2dbe9e4053df8758fd865d68d36f58928aad72b7223f643c
MD5 0045b3f3de1b3f55b487bf0172b192e3
SHA1 d9c20162bb1e3fed263f1b097455f614f976a2f2
SHA512 85e2a83eb17fd80f59631e03201ccbef5836f708561e2fc5751a9e6ca04b9f423e8e1f0e2dda69b76ce19d2e3c04002e4fb514d9b4fd01245498e5d90323343e
SSDEEP 12288:c0Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:ce3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T12AC423213BAC082EE6538671D3F6548AFD74DD75453A4467313A9813B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 07942d4542d3a17e604e10f55b47dc32bfd418050815ada9fc7f278e9ba72025
MD5 fbb10645357b622d428bb6bfc90f8151
SHA1 9fda0e3e4c7ca9019155620784df46524d8e4ebf
SHA512 16e18bc6144f5e333aa5cd7629027751126e4920d204eaf7d1285cc7c04d99a4a36267808b9e9fe340e406ef20f6afebb58a2c6243493ee9b26341a4e79e9fb9
SSDEEP 12288:h4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:hK3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T157C423213BAC082EE6538671D3F6548AFD74ED75453A4467313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b1afda7571e4f6c895af87aded586b78e41de4b8fae6d38a813fde47f7058bad
MD5 69079ac888d41a6ea99583c9e5e3545d
SHA1 bb629a5e601f2722933d2744a8ba50eb6d714e2a
SHA512 65c55d8d97c92b36c5ae06ff0e3d298b2e29d7e8d5a2a19c69bea8b29f0245a19434983652c0b4c1c12fd1fd3e0659587291b32a52d82bef06f3adf8fbee20c6
SSDEEP 12288:vyPz5L8vZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Czyx3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FAF4021377A820FDD1678234C9A21946FB71B831473589AF236446376F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0e38088adeadfb877e0826b430435860f9d63dd9f7bb2ac9cdecda20c50390e4
MD5 7779017bf49b90394e57deaa7eea6cbc
SHA1 aabb2a6d25cb5e027132f0df4eeea89c35baca8b
SHA512 42b337c1dd1fdd9c700de9b85dc3ff73dbf7b70b829327b44d12889944d091cefa00175b8fc785e7c84dd59111c284ee44aa392c2cc8af34687d61436dd26d25
SSDEEP 12288:Y0Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Ye3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1CDC423213BAC082EE6538671D3F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 15f3b39bfeec5baf2a88cd492ef49c9976c2c84c85042c46708d6a197b94b8e0
MD5 f3b083093ee02f55753b41d7c0b14a52
SHA1 11716c82900dd3ff142719ecbc7c0be11fe8e42b
SHA512 78c93be9804f306689844a210c277cae15c3af7619a123246b3fe3d5cf288e920b2e04f7d236d943ab4acd8ad5af2fe15352fa99c480115763e24568fd0fbfa5
SSDEEP 12288:q0Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:qe3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T180C423213BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 548f6de00f9838f872aaa3b65152767418ef3d29dbd9c974efd08adf1ac9352f
MD5 4b1c076c73740633212a199d75291f76
SHA1 b01079b06b21c371de2d69002fe89a362eabf3e2
SHA512 d99d19f279931c4fa0da26749a124299821c98cd978c830cd1427ab3195209c5123c52f325dc77ef7539f8d23cffc4e6ef4a116171ed2fa70d13b296ab43f40e
SSDEEP 12288:fyPz5L8vZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Szyx3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T183F4021377A820FDD1678234C5A21946FB71B831473589AF236446776F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 019a5f106414d32bc070bf95240d52af6dd975cb0d480da597195971eaa15a7a
MD5 3817a53384da253136052f6eeb328a1d
SHA1 c4a3b95b7dd0d43ac289f171a63ad0783004436b
SHA512 305eaa79ca882b6315618528a8ce7c155ebd9b8a3d966bf3e99247150823602fc0da5492210e48a69c537361b3f89fead0ca9fc23d8b343bdfb6a9700b1d0ecb
SSDEEP 24576:bTDaLl3z0zD33KnAoIBlEq1tIgAWz5foj3Z:bTuLljGKnAX1tIc5foj3
TLSH
T1BF05F160739418F9ED67813EC9658906D6B2BC650770C61F13B836276F377A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 816545823c44b8e786f836ae4cd39cf09cfd675c50bccbd080699b29810cfba6
MD5 6e2009e92bc5d7036bbb2267d4be2cee
SHA1 2354aa54732f957adb4ad4b27ab8199d6dbbae72
SHA512 3023fb42bed0f1b4f6f6ebf44d9619bff79c6a1485bf2367bcfef12f41503a394d39c58040d2975d63b4efa8e636f24d97b20ec297935bd58c5ad8613abad143
SSDEEP 24576:F3vd9CHKy7GZb3KnAoIBlEq1tIgAWz5foj3Z:lvd9CHKyaZKnAX1tIc5foj3
TLSH
T1F125CF90F3E814E8F1B78A35C9765511DAB67C691B31CA8F03A8651A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f589357a5d8a9dedefff96b46290f3ff0dc1d61d2457192c9e0a3a951ce1f2d8
MD5 2d0cc2884f48bf9b453cd5cad16fb3f5
SHA1 a18fe889faf6a2a9c2f95378efb3a9964fa22a81
SHA512 faa5122516f80cb9ca116ea06a2ecce558e3e45e31264b36c8add1a7803dac372f93bf2455b6e55dc780a46c6869d9b0d94c60bcdfa88bfc63b41e7bd9a4617d
SSDEEP 12288:4dZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:4H3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T121C423217BAC082EE6538671D3F6548AFD75DD75453A4427313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 5bf50b8e6649bb9d2dc03119f708000f44e97c408ae7f610a9bb5ef18dc1fe9c
MD5 21b53605141ddf8b6c4f27d4d2ed8e47
SHA1 f7cbdd3bfc3129797240d558148f030fbc7e57cd
SHA512 f2bd892265ae03b7dac36a3b3d2c265e26ea891c01c83715f3f6031ddf19383bfb5a1c88dbfa4ed3ef064fd18021925f97be8d409d5ebb3bd4c95e63cae5a432
SSDEEP 12288:KPZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:KR3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T186C423213BAC082FE6578671D2F6548AFD74ED74453A4467313A9813B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 2ab30b316da1c404e5617969a86121f358da0ec91cd38597c6b6e7ddef4b05c7
MD5 1b2f7532435ca0d2255b5a943cac1db3
SHA1 304d1b5992844604fc2133aa9d98388fd700eb9c
SHA512 d72b8f6d2d72c22bfa9b8c781413399e1f40c1f59db79cc00af3c977b972618cb6f064856d40da41ad234455db4a9407463a0829c476c0ec8ceca18eaf3bd46e
SSDEEP 12288:zuZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:zo3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T142C423213BAC082EE6538671D3F6548AFD74ED75453A4467313A9903B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 a51f55e1274f3d838bf902ea41917c3075c9ffc8b808b60e9970e8f573e60954
MD5 0c2889f843a3a49de68cbdb3a980471d
SHA1 ced89b5005a5453a26051db63cec2d42d0920055
SHA512 02590205b28daf19a56c5cea696bfd0952b992eaef2fe447257ecc4ae7e38ee3947e061b74776854883d1e96bad37069d41b470197bfde24a0a40ea5268e4fad
SSDEEP 12288:C0Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Ce3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A7C423213BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d9f024166cb8e0fd6abbec4d047471f2b3c3321394f11cd44c395a8059093496
MD5 9ab0da67db8189060496434d52b4b71a
SHA1 e3dcf2e53e67b6a7c668efc2d6a00e6c87df5ee8
SHA512 419f98994f148495f823d196e84562ae391611f41565d9f1dac1b04fa2813a9d39f9cecf22e91f239735e5cb319bbec78965e0ad17d74472f91ba9e5cd9f78b4
SSDEEP 12288:VdZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:VH3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T168C423217BAC082EE6538671D2F6548AFD75DD75453A4427313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 f2764e890868e44fe4fc8cb064488440e125d78f2492a372ea73b98f4ff267e7
MD5 3af0ccbb79dfcd8c063a4276756cb9f3
SHA1 a2a924ad36c54bbfbf81f8d1bf2cb8c0b7ec0ab5
SHA512 0d2a9108d017cbf31fd397375df3d52837374d7b106d286508fa03cfd22ecbe249f1797a2f5f5783e7808b5e0c0cc7941ecf3a799e42a8b17cb1e8bf147dbd14
SSDEEP 12288:X8Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:XW3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T11BC423213BAC082EE6538671D3F6548AFD74DD74453B4467353AA903B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 cad7eb9d2dbbbacb5762bde3a1b7ceb646a7e69a421aaadea7620002a75fbb1a
MD5 cfc46e1e7c3a4387e3ba4c79cb6d7ebd
SHA1 9b229d2f948ed728e6a00be611ae879be34019a7
SHA512 34d791369f7cb86f10e72185fa7d091e37bc1e38715804f2a0409683ecf760911140728fc0e413b2b0cacb5d406a60d288457be9096593594cc4ee505e4f8f0a
SSDEEP 12288:4yZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:4U3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T106C423217BAC082EE6538671D3F6548AFD75DD75453A4427313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 05d26568252acca00f84e6a5750d2661d2b5b33b35a3204dccbdce2487d9b664
MD5 9176bd869fa349c891f5a65b7fddb0a8
SHA1 549a7e3f4789d8758529bef9c217940e62e12bca
SHA512 7910ce793ca09cd2bef033a73a71764e19a050aca529be5d538323831d447e61c0d22df76e13feea5c8264386916b8ea34e63ff06ca389e20a3fb7a0d5af5605
SSDEEP 24576:LfwvUk9RX6wkyAI63KnAoIBlEq1tIgAWz5foj3Z:BMnYIIKnAX1tIc5foj3
TLSH
T1D435D029EBDC04E5E177923C89B7460AF6B178680B31C6CF125A536E1E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b80d4d3380fcdd8e1fe9d3188487f692591b699d89924834b570fed54e5a9893
MD5 610d61e22686fd2ae3c35c5d218fa0b7
SHA1 ce639d68c1a5321f3a1627f3324970e85f6507e7
SHA512 9ce66ef087772fd254347a674413d1541c9228ac84cde58910bd000d649fef43930321943bf5c3df010e5d754f2dec782ef42667dc6ffbc6300f6d8d1d93c907
SSDEEP 49152:KYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TKnAX1tIc5fob:xySzPb0Okc5g
TLSH
T17C066C56A16801D9C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 350f17ac69007c39665bbbf0b56d9fa5aecc26544c94187e479ea53da76198b6
MD5 4296d1eb8f99df609ccd6b745f1f72e9
SHA1 0f52cf66e6160a5323d8e60179bb4bd2f2e456af
SHA512 8ca242465c2d26fa6c3f762b0c048fb178c32c118fb7e4bf87816fd533243e73fa8952fb4e272c9bc622132ac22163466ba22b3c5a88b69b7e08f10d7f4865a5
SSDEEP 24576:847Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY13KnAoIBlEq1tIgAWz5foj3Z:847JUQjTirIhCnDHUPfF/jKnAX1tIc5g
TLSH
T19B65AE1DA3EC01E5E1BA827885554A5AEA71782D1F31CACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 85744e91ec00d2faf75950ac3092456a2f1a6ed940309bfcb647182ba6297aff
MD5 a6d5c0c6a6ee58bf6d40d8de801e9483
SHA1 3cd9978baae122086e86284c60139e949e73bff4
SHA512 0b1a4df6a90e352b3a5d9ee0ad0b2b102be8833d168110a939242690ba0f61ea41e4f9a90a065580d5c951e90d62df9b675e225abfd6d59284ca7dd2a90a6ef1
SSDEEP 12288:rbsfkZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:eu3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T138E4F115E29801E9D16E5275C7A64A45FB337C2583F1C2CB22E0F53E2F3AA905CEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 fcab1182cc91ab40614dd0fa7f39d3c7b7a25bd2421a938a236bb346b76a06d0
MD5 aa222e706c4601f7940d7946199b02d2
SHA1 1700f8767501b58a5b1dc4144494ef5edb982d65
SHA512 f94c6bb31885e477baaa1478f2ac99861c9e06aa47e21657d1236a28193f6729662b4c7d840532f62da929b22777e5ad73df0f270cba1d57af79de10e7bcbdb8
SSDEEP 12288:sjK1wy5ZQJ0PWwbEW2V9zWkw6XoscvMe4EjYdM1Cz/Z3:siwEQaOwQpSgcZdjYUCz1
TLSH
T1B6452950B62BD75FC6AD40326E32D6CCAB707C41EE455B0772C8873FC576568BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2e980b66ec7c01b370a98a3860530a9fb648df59b21188b6b1c9ba772399fee1
MD5 cf9f4e3cf3844064c20d00302e8ebc65
SHA1 5b6496262b1cbc07c87edfd392bebcc4f0c8bd2b
SHA512 d59350bbf79919714a3a131197cf1c3da2ebc777a261b915c235c8db67351805ec1691b3159f4cc0984051a302dac7440cd787509f5d5a83cec9bc82912a7143
SSDEEP 12288:/Rl4fkzEWrEvSEBWqzyoH21AoB7hOfEt7J8R:cBB8qzjWttt8R
TLSH
T16C65E8419537E38FD1FB6032032AAB4DAB64EC0677056F2677C8053AD86A765B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0e77a36fcea48368f2b7958a0eec62c509dd1b046b984df522eaa5a4526c13da
MD5 b9a62f135d4cf1deda3d64f8f52aee3a
SHA1 a0142f9e43f01031c0e7ced813981b7abf2fc099
SHA512 bab19394d07000d06ec06486c79c7a2576a9a02d3b63789b26b68d14e237556ede26797b3889775f763f671d508a7c0908df3a772541099545303d8f0a8c50c2
SSDEEP 12288:g07sZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Nm3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T124D42221779C082EF577467092FA9419FD39F9344B2584E73029A907B63DEE06C3A27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e1bd0e5fc1c78924f9c9662b39104544fad7e20db40aadcc18f697e5361c63c1
MD5 53884819edb645f6ee139837246bdea6
SHA1 f0448d24918020b68ba4dabdc32ceee0edf6a6b1
SHA512 026d12c4159bf8eb520552652586f2cd9824fdadf664fdea036a982c36bea50f5e34886735b7450e661f43cba7715578863e0ebd31fd3af1073e7db249237024
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYw3KnAoIBlEq1tIgAWz5foj3Z:egb4mBIBhGFFKnAX1tIc5foj3
TLSH
T1B8659E1E22EC02F5E1F6D2B8DDAA4417D6B278160732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 014cf2bd2e4f4dd015c76bfc43093fc85252a97fb4d7c1c2ab1a14b620bfd01e
MD5 780d410f1625697fa9e435b480c6f986
SHA1 cbe09ea348c3935dbe44a3ab6794431015d30984
SHA512 7357315c7b958335e2038a605bf4dbcc0beed8d433eec6d5b0ee9a36d77cdeb3ccfd8cfde3323f849830c7c22eb6cc6274314a71e7d292f8e739c0c9f82cfa88
SSDEEP 24576:QG88u8FpJqH1bzria7/mF3KnAoIBlEq1tIgAWz5foj3Z:D7ZFPqVea7/+KnAX1tIc5foj3
TLSH
T1C135F16177E401F5D477D1388A964667FAB1B4250374EBDF06AC8A522F23AE40B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 db9728a1a964574cc16d9dd8d023f6f58db3aa9239bde9d834860c51ffcb64ad
MD5 648e5f8224de1004d65181f134507ca4
SHA1 3c5a7930e0bd7197110e5b8513d1bb7d51cec107
SHA512 fb429a7bd423d410fdbbacad2b5245deb3360fb886476d5f994016ce4ca1353d2289397d4099df44cf705e49b2e2bed2ec2b3cd3d3c6cd08137714f628dd0b91
SSDEEP 12288:0HvUrBFrEjwaQnZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:0PUr+NQZ3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1C805E12B36AC1CE9E676E17D85924609F771B462031291DF02A1817F5F67EE87C3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f9e01a4f5c95c5a36eed49eec00cf87f150cf996f355527b00b2881290f754c
MD5 9a6e948b38feec3d64e8fd8e48587cb8
SHA1 d55f7cbc65ca388b8ea5c078f7b807dc2b57e537
SHA512 75337a3c772a51ac4be4ca6a8d6914ecc393fd4bd80b50427a085fa881b2b03e6be0139b560c174789ee1bbc7aaf9e5e2b41799a969d2ea5ba5af805006dc2c2
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJKnAX1tIc5foj3:bG05lO43bg0Okc5g
TLSH
T167D5C06A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 259223cec87320b078598c53ffb4413f394db0c485cfeec85d5fa7f657867ffe
MD5 ea96d0a14bfd728704f130bf4d0766ec
SHA1 c54424ddba84c6fbe1fbaba8b86730ee08fea3c8
SHA512 359b6f8c6c8c9a6aa9307fde6b4638f1c39d0e7e27843f2146f04365d6624e51c9662bf06a3a3c878f94111b6e7cb2a8105a2daeaf728470e3ad40d97d0c1c5b
SSDEEP 24576:Dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnT3KnAoIBlEq1tIgAWz5foj3Z:7a5POZ3BJt2pasx2+mxKnAX1tIc5foj3
TLSH
T18B65BF5EA7FC00D5E5B9D17DC583861AF5B1342153329ACB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b9c48b0f1ccce0498c50043933413ddb30244fdd3d9a51a0ae8ceb32e5111d6b
MD5 af9a07a70a42e16208667158784fc3cf
SHA1 5dc43e167e8fc4ab6cdaf2a866f96a66e3114c75
SHA512 9ee4b9edacadaef2cdc968817f9b29690033f0a781c4bde452394b9814a45008978bb89b0e45755b0fa0b8d1cc03895dd198d819f7c219078b1583aa6c44c25f
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkN3KnAoIBlEq1tIgAWz5foj3Z:sNc/zEOVHFeKnAX1tIc5foj3
TLSH
T14B858C2623E901E4F1BBE1BE89779546FA71786513348ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 09c12bd5cf0a9b9c80873a450ab14732d5ba6396ecbf31339ef9694ed76a756c
MD5 4381462015dfc889a3ac52991088c6c9
SHA1 77a169ab10814b2e2706bedf1f6aef021ae49577
SHA512 3ea51690be44df2acfdb323b3980a16fd76a9c61017c0148bbfdab41a48ea2eb11de48aea3eac24f586e916930a423b52472d78fceadfddf415b2975fdaac5bf
SSDEEP 24576:QTkNvNnaFeYhJNtmZBmv3KnAoIBlEq1tIgAWz5foj3Z:QTMwBtOm/KnAX1tIc5foj3
TLSH
T14B55AF2EBBB805E4D1FAC6B5CD238512FA727461073292CB5290C13F5E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 d9756b19453faa9d3c25d0778091fd5af3f56f4e63600e8304f08415dd152d12
MD5 c9b3c1ab48b9c0f5a40fb432c23fca6e
SHA1 6ae9966f82535966e35cc1a1b40c3663aeca6785
SHA512 06ece681a12269fb449cc70f6673ce9c8f7d4cd5c00036724716983f6dcc3ad3c2d29d57ca27de5cfa30274ed1b72921c364b5f3ae4ab62df24b608c438c6723
SSDEEP 24576:6D3FHshBIYQgAC3KnAoIBlEq1tIgAWz5foj3Z:6DVHeBIAAwKnAX1tIc5foj3
TLSH
T15625E13DEB9C04E4E57BC1BCD6A38906E67178A8033255DB1194C1B66F6BEE43D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1432-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1432-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1432-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1432-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1432-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1480-102-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1480-309-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1480-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1480-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1480-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1480-96-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2420-0-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/2420-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2420-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2420-67-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/2644-302-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2644-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2644-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2644-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2660-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2660-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2660-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2660-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2660-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3244-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3244-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3244-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3244-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3696-122-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3696-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3696-128-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3696-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3696-130-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4168-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4168-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4168-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4168-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4168-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4540-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4540-116-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4540-307-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4540-108-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5140-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5140-304-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6080-303-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6080-68-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6080-75-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/6080-69-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/6116-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6116-322-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6116-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6116-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6116-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download