f26c81550bf80252c2de9ee2214111dceb39aeab589e7fb3967ea57de70b8bc8

Analysis

max time kernel
149s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
Size 2.3MB
Sample260908-rseq6ascna
SHA256 f26c81550bf80252c2de9ee2214111dceb39aeab589e7fb3967ea57de70b8bc8
MD5 93ed1cb05bb963c7857fedf491763cc1
SHA1 6f35f36351bb70dafe5a211fa85b7e9a4057b0ac
SHA512 991eb0765e93333fd2b80ca94b0184d73aa62b4770404f92d2ef86cb1ec18046e3cdbb6781073a2ae1ea9570079efe9957ba4ca484931e3ff773e4ccc31c694e
SSDEEP 49152:c8krRUDwl/rpC3qi1kjsVc2ot4+Ej2EsjKQKnAX1tIc5foj3:t66kjsVc2ot4+Ej2EBQ0Okc5g
TLSH
T1C2B5AE24FA488295C17AC27DCA9A4B4BE7B1F40847349ADF509506DE2E737E44D3FAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3056	elevation_service.exe
1900	elevation_service.exe
4196	maintenanceservice.exe
2764	OSE.EXE
4468	PerceptionSimulationService.exe
5600	perfhost.exe
2784	ReFsDedupSvc.exe
1476	SensorDataService.exe
4348	ssh-agent.exe
3300	AgentService.exe
3476	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\67dc7b18238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf5a222a9e3fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006decf46c9e3fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009f75282a9e3fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea67cf2b9e3fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005730e02a9e3fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004840cf299e3fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
3056	elevation_service.exe
3056	elevation_service.exe
3056	elevation_service.exe
3056	elevation_service.exe
3056	elevation_service.exe
3056	elevation_service.exe
3056	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3300	AgentService.exe
Token: 33	3476	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3476	SearchIndexer.exe
Token: SeDebugPrivilege	2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2260	2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	3056	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 5484	3476	SearchIndexer.exe	101
PID 3476 wrote to memory of 2136	3476	SearchIndexer.exe	102
PID 3476 wrote to memory of 5208	3476	SearchIndexer.exe	103
PID 3476 wrote to memory of 4628	3476	SearchIndexer.exe	104
PID 3476 wrote to memory of 4004	3476	SearchIndexer.exe	106
PID 3476 wrote to memory of 840	3476	SearchIndexer.exe	107
PID 3476 wrote to memory of 1940	3476	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_93ed1cb05bb963c7857fedf491763cc1_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4196

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5600

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1476

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4348

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2704 2808 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2704 2808 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d80279ecf12192eb7e2498a251e57a1dd1cff01bd6e985b338d0d005d1c37aba
MD5 5e39247bbd8fe013af232372d92e8a36
SHA1 336318ce53862f075144de0d93e70c68e9aa7bcd
SHA512 b6b1ebe0c6f9cd6db0fd090c153cf9237915ac5cb50f48c1f1a9dca2b70b1eac14b770ce5c7ab13a225f97bcef87cebd968021ee71e295aac28745aeea47d714
SSDEEP 49152:Ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnYKnAX1tIc5foj3:q3q6sjBr0Okc5g
TLSH
T1FBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c014bd98a58320310f87c069629521fb47de8203255329aa45af7fe842904e8b
MD5 6f2771754ed5797c5e89ba053da99ccb
SHA1 20228a5c92e145b00a378c11578f6ff1cc8ca48a
SHA512 eae7b0474a5c5735f6231b0c18dda062c70149dfb9813dbcaaf83840c6cfdec5ee2002a8446bb033d859d7a4eabfc5a3caaa75caafa41d135488265814a50d33
SSDEEP 24576:kXYfDtczAf3KnAoIBlEq1tIgAWz5foj3Z:Dtc2KnAX1tIc5foj3
TLSH
T10505012477E408FDED678238C9B28406EA33B8514370E69B03B499266F377D85D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ff5b541205d97fdae9b8939e1c783ccc1eafd1aa24e32b4336dff0170c65cb1a
MD5 ea68fe44f1437aa7eef94803b24407f3
SHA1 b6b3b724bc582603f1d53b6205626950b94dcc72
SHA512 67e63010dd9137a729aef2829194c3bf0548603da6270783e76209c4c515f1dbf2571a8c0c81ceab7f59c1078f5ecc98c3d5e71a37cf3139f02b264cf59d1b2d
SSDEEP 24576:J0Le5ji0hmxxrMS3KnAoIBlEq1tIgAWz5foj3Z:JPji0AjRKnAX1tIc5foj3
TLSH
T193359E26F6788335D073C0B9C5D2A68EED7130825B3089CB4296D77C7E67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 986066a0d3c0a4cc326e26246c7e5751272edd61833bbc4479aed16a8d020cf0
MD5 16e10ceca02cb8f09179077442ae0f2b
SHA1 05afeaeb1d1e77598b709dabad639271c688714a
SHA512 d2219b54db886387b8d0fa808ef89bdb53867f0d605205144848bac45ef8fbafbf469c43e80092d3b20c147276f463e522e4b7b25e7ca3d465f8f5a6b099a355
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWn6q8wyuQ3KnAoIBlEq1tIgAWz5foj3Z:Z/ezSC6vUzPveHjy1KnAX1tIc5foj3
TLSH
T1BF756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a570901aaa26b85ff0db65358d01182e6e9263a6f2618a9f409c3a0f01a4b86b
MD5 74e8f52669da3808687341b3519dc867
SHA1 da96bb3d2eedc8c19f9fa25eece17762ced7709c
SHA512 36190ad2bd8a382c957f8ffbeb6711b0e9367c47cfa4e2e8b2e4318fe22b4d2fd7516de258262da22b01d89c8d193eba5eda5e882a8fe87ceb977d0d2566cfa0
SSDEEP 24576:eVbqPb88hv/l+Yb3KnAoIBlEq1tIgAWz5foj3Z:eVO88hXl+eKnAX1tIc5foj3
TLSH
T1E0559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1ff75e89a27826519e2dc0b1ca13887594a8c2ea7560f1dc5a80696668e62173
MD5 71dbd29912c0708da16f971fefe6f2d7
SHA1 2297508b8911e5fd923adb36201b4c675f552687
SHA512 a6af879cdd3a6cf19b50d2680e6fa88cd0bd9299a35f96754bc89bd4ef8e7472502f9498748081fa1406b6525aa41b0c7eeae86c7c57c5ed84d2046241a1a9ed
SSDEEP 12288:zLkZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:zLu3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T144C423217B5C182EE7674631A2F6688AFD75DD70453A48232036FD07B63DDA0A83B276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e809a3b07b9a3f51b653f6b6e24626da0022397c300deda8867ae9584f53cc76
MD5 594026f45ab60630a0a79c1cc13e44a4
SHA1 1237ccca8b7f9cf8851de1d4d32467e62c7fac6e
SHA512 ba51450519cbe0c176ed6f2b97d6dfe0badff98fec6e3ed3bf5457f4e236a200b2ee1ad2f9d53d291c80e7b7af1389cca5261d4b01c58efaa166384eb129d9de
SSDEEP 12288:4eBNUbTVO86UxZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:4JIUj3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T18A05C037AE28FCE2C27A8D7957918640EB7278304B6293CBD175C20EDE275E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 76737c77e8f00c6472d532d3e290f92b1077640ff04eea9ab8448f4fe7b4a28b
MD5 1061688a2c4ad27ceb2f7ef335333405
SHA1 33d7c0c89856180ad7aaab2040e78b25a95913d8
SHA512 0bde7461e1036ad1f7dbbc73adc0c423f4eb6eaaf029f79382e7c6344236b01319505699060ddd8a42d8a6b9adf87b3526df38787077232ab113e811ca956172
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THe:yQvGAdlCEL8c/DRNw5CW0Okc5g
TLSH
T1E5266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 56f2153c20418d499a21924853a585d39427bac4e6ba6f74dcc94bebaf4a0fd7
MD5 a6b0c83b5dcc854f08d75b3925d72489
SHA1 2bbe9adba83750b803a19bf0c22cfddba087bc75
SHA512 3771aee57435c8797d1e55b9df9d6575f5ce8fdae3f16238f97d7c0216b07e1fc95e445e092072b5a1b9f4c6f62faf8af662e176120e92817e61212deff22404
SSDEEP 12288:iAwSfxL/2Dc3RDLLmt0LDQewsAjfZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+p:n0ewsAjB3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1F315E031FE74E436C27B0DB21B76C716687CB9204B6119C3E3B88D9E59346D22736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 51d7f277720981a4f606164766f498668438ad4e7a4a90deabf47f805b9e8756
MD5 cfd4d7e8901685a6ced15768e2bfaf2f
SHA1 8e682ab7bc83887b444bf76879ff22975dc9f27a
SHA512 762a80b4ad1a359ea545a03447aaaf508096a8b05b949353359d86bb7c91a0c5de5bf6733d7d301bd945ac6584e382de6be584d65673b298b6a81059f4d277fd
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHmOBg:aUEtQevvqc2W1cpV2tI32t
TLSH
T1BC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 22bd5b92267ece4f0baf5695c716461c8ab8a90ca0b42be770f69f0b15c43168
MD5 711cef6fc1c7e5a7781667deaaec40bc
SHA1 4539981d29e4c3d8ace6eba92e3760d298cc28af
SHA512 7c25308589e10502bbdcbc49a26799e86d746298d54dade3ccf39edc313017da735e902624e634ebf839988e05a15f339bc4faddcfd4e1a3161eff24ee01821f
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zhKnAX1tIc5foj3:goquVjnma0Okc5g
TLSH
T19BD58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cd0be900630a3809e592318cf35fdd50e30a397845f900f54b95418131c38b9e
MD5 9be50caa28f257fdab940491560ce4c5
SHA1 cb143c83163fa2a1eb0acc85a1d7c92ab2a01448
SHA512 754e11dd2fc5fb9f5efab4ed52b4b14fa319e8d58582e76cb00fe2961954914c9b065d4ad3cdd1f17e6f17a481e28aa8b95cf4f7dc332b6041c1cfffdf14393a
SSDEEP 24576:6AhGL3IFoiwtA5l7S53E3KnAoIBlEq1tIgAWz5foj3Z:6AMUFoiq5KKnAX1tIc5foj3
TLSH
T1F335AD80EBF955D4F5B3AAB899B68171EA76BCA55E31C20F2160D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ccf7f7d8f5587f2cc0e4de1b63105b2320432e63521aa6141ae21fee982bb537
MD5 63d985c08284e43e422b4edf0a5f34a2
SHA1 bd983dcf9f4c7f222811d9c1a7fb0058292ffbc5
SHA512 ce719313395fb3f4ee281551416afcd57c9c978d7e58785f7ed864e69f0de86707618a2553b0b8e50e77755ab0550fa71986025c377c3b4d3491b53e44f2f035
SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+CGZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojp:jwu4OWl3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FF05F14537A80CF9E9678239C6978536FBB2B8112A35CB1F1370C61B6F376616D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 5afd78dc35653c8e28a04b42e425f1aea7f5226e1a8b5341d528e024685d5761
MD5 7032840403f0220bb2f1c1ecfd2bfe61
SHA1 684df325a3c347bf4dd99c9172f56c70b1dba3cf
SHA512 ad3ecfaf2fbab345476e9405ad784c80b5dc844988efdb13698d796fe4a916837c4e1acbf53b5dd21bb315e29eeb55e9b8916277e30625e48477fd22b9b6bbfa
SSDEEP 12288:ZeZ1IyPZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:cZu63KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1C8E4125137E824BAE2A34238D5F5594AEB72B861133643CF213586577F3AED16C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a4af9a50935549be72bb12100f07a7d607c50a2a0e30dbbf8b7b30dd4bc8c2d0
MD5 5b5298f0d63b3b13119fc2bc658a7fa8
SHA1 377b82b46fac846b50e0ceb5d3f812317da6523d
SHA512 7c81af81bfcdc5498985885b6dd9d1c823b3121d5fe898470eb45e62d1978172e4d924d0e514cca24910dfb69e05ec3e8b3448e151704db2e48a01e28fc2202b
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:dQRQyi36YOcPbLvw2gAf+PN3X0Okc5g
TLSH
T1CF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4abf7f425c82afcd73e24504b64c3866491872247150518a1aa9e71948fc1fa2
MD5 d0f3cf8e77f29294c8da2f7705ecc001
SHA1 580d1beba5b161557e29425cd4a796ffe0bb88f6
SHA512 aa266032f4a9bff79e7f7723335083da0c8f69915711de718fbecc5baaf59a880aa995538c9316a431f1489a53ec9fbeb4f2a55923eb9e22b2bead4fef6d1392
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:LQRQyi36YOcPbLvw2gAf+PN3X0Okc5g
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f4260273944611e08a75c72771bc5cc96067f7ab69b138e082e47a53eb2d8da1
MD5 bfe9be5f61d5b76151d72fc55f6ca521
SHA1 598b1545adee56137e271a1edd17234801351ba4
SHA512 e3f613251134da94af0c6f81ec83a676bc2a31820bbd7e2060448576866ac273bb21268b714f9bfd67dd40e2180069eb8951da2d597ceffdea701e69b4996978
SSDEEP 49152:268Qg55nhceWu7PNU3/RKnAX1tIc5foj3:UthLRc/R0Okc5g
TLSH
T187B55A33B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d4f1ab84015d6b1380d4152776c33f28fb4d59dbcb7358583a01a049eba171c0
MD5 3768f66c3a3a20c5817229a23bc9d385
SHA1 7e9e59ebf24b8efdd38408cdeb6cd27e2f5f264f
SHA512 15912e45029af0e208505ff1fc27d5b3dc05847374dffab640f410cd5ce75bea7aece641628d3566c9aad29065e0bbf7cb89a39f21c793088ce67b55b5f620ca
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99E:Ty5112gYy5azzVvt69nLKnhZs0Okc5g
TLSH
T140167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4f73bf06ab593d2f77664a408ac8deccf782ba07b167ba05359289775b661bf0
MD5 cb6d38050d809e7affdbca87cc248d35
SHA1 0a3d6435db3ba30fda8412fefbdac38f2216108a
SHA512 1ee65eeb914af12236af6a4754f2ea4c27f2b4178af370cd179c1b5a9a9a99445004bc507eac7700c68f5278559a3a51f9becf80819378b1fbd90512400ca483
SSDEEP 49152:bB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glfKnAX1tIc5foj3:Nu6Jmdxd2df0Okc5g
TLSH
T148D59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 429aa4d2e826e5bb307a840be4841feabd84c9edf64bedd8b914707a6572c84e
MD5 8e294dac35829a7dcae1d6bb62f4950e
SHA1 31fc05f0cd2bfd4f9bf14e7b3a9581aa0ee2fb01
SHA512 1fa2300c006ed1216aad0f93c24fef64a3b344c4a3d4d7aa3584f30a107e68920bbc40feafdea5884bb3efcd4d5e714180bbdca947066ee7c295be101677566a
SSDEEP 49152:81hpsNoJpF1A63U44CwH7R4xjKnAX1tIc5foj3:8mifPWRa0Okc5g
TLSH
T195B5AE13F2D800E8D05ED17887569632EA62BC450B35B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f9afb0165f2539128d06177f2b4a5ba6fbab0327f913214d6e6513c288caee1f
MD5 8e62e1effc97609c5f062d91a68d5f36
SHA1 779b225682efe16d49b5d3e53ea59d11b59df43d
SHA512 bc14133f2963f2f3bc0127ccaf03816084ec2c95eaf9c537bfacbcd05d30f452af5b0d3235521fbd483a6952c67be404b701382438e69d5cab62ec17e673ad0f
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqIKnAX1tIc5foj3:B5dKii61I0Okc5g
TLSH
T198C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b9df9e67a6f0a63acfcb9e15cf61953db74d152f0f113d20d4c577b456c545bc
MD5 3d70cc83f83010890753bc6fefc73c11
SHA1 237b20e06cbc9d724aaae2863473108b75c5c05e
SHA512 c21e14dea6b8f9fffc614c93473fd226d35c4eb3ae4a62bffc4215279493b4d3987de265ff87f72b6ec799283a31cb4a00f3bd46a4291e8f7b88d1c2008580fc
SSDEEP 49152:UhtSn8EApI0fig3giDn0AP5wPKnAX1tIc5foj3:1X2imphO0Okc5g
TLSH
T15895BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ef9913db4952d4e1aadee27d40bcfbe154f823122a13f2d0abb83b70fc0719f7
MD5 364ee0ee302f5af6876e5bc12846f69a
SHA1 267c96825f2c6e0e54468b1ab77e02f0b893f450
SHA512 67c1097f68ed634fdf58387cd6bc494f378c6c8621c5537140b5f2c82240655beba12ff0ae20976db8fd499b0cff7eceac5253539da27241fbb79d7508153fa0
SSDEEP 12288:QcZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Q23KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A3C423217BAC082FE6538671D2F6548AFD75DD74453A4427313AA813B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2fc555dd0386f63ad56bd2329d35a75446245c91975bf2d889081653251ccd5a
MD5 f7d97a3bb2eab6d56153d7e17eca5699
SHA1 edece6a773826db793094d793071887615e01130
SHA512 88ef32b80aaa56825b0c0585e900fea3e9da8b17760f8ff3f3ff7f66c9a83df06f6a7840a1220664b7a074bf20153dd492330ab8874c9b26f07cc4be720dcc01
SSDEEP 12288:SzZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:S93KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1C0C423217BAC082EE6538671D2F6548AFD74ED75453A4427313AD803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 55fe3c8b298423d2b8a129c5d498af01d8710bef544b464ac1a97cc363b57b0e
MD5 6435cf35d6ac8242280d83f961eadc0e
SHA1 77f443e963d8afb9282674f1ae94d18c3d263822
SHA512 304313d4acc0bb5ce5fe479903ce78a9d10d7d504fcd874c7bfc1d633396bf12adcb25747ce94c485fc1ac6d5d982fceea2db19c07a194bb547da51b9efd4f8c
SSDEEP 12288:gpZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:gL3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T170C423217BAC082EE6538671D3F6548AFD74DD75453A4427353AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 46912fdc3e8635d4005350ced335869f763600b50884358487ead9e8bf29c5ca
MD5 33e008b63175d20b7d67094afb6f9146
SHA1 beb58b1b4f8d5d149081224ee5117d02152b56a8
SHA512 bb48008dd7da9a74901dfcbbded72d841b730cdc9d0aca4c6ed5a3f3d4a47d7ddd39bc6eaca1a8adce2d2ee23828e4a0283b350cf3f829918df2470f8dc5a1c4
SSDEEP 12288:vViZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:+3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1EDD422213BAC04AEE563C274C2F6544AFEB5FC708636446B252599077F39FE0283A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8b2a01d05b8f447da965a1c916b959e600ecbc84bacd03ee77cc3855c58e9fd8
MD5 7538bd1b53197e5f8c9c914cc6800751
SHA1 345d2cefff37bf6722a3e4722536fd9c048b6dfc
SHA512 43e1176d8dd730566d3672430ed10bd78a4f8e70dac4c8953bfa3bf25f7fb510459d3ab34e7bbaccfecae921c02249b992ec705008da6ffb01e7d006b9c2f1d6
SSDEEP 12288:WqZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Wc3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T118C423217BAC082EE6538671D3F6548AFD75DD75453A4427313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 45d704eaf387b4c7b4e2ba52c190aa46052903bd886fd77456d9fc42ecf39e51
MD5 0311f133a61720f7518a3bcb1c76724c
SHA1 d0ec3cd57de0366b9418207538fc4e77797933ce
SHA512 d6a95db8cd5b8d5a99e9411316fcb06f912ef9356ba1cfdf77d6ea4482e475c9a73520a6e5ac72d2fc15fa914e9a658174eff0817cc5cf4d3560efcaeaeba251
SSDEEP 12288:03Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:0J3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T174C423217BAC082EE6538671D3F6548AFD74ED75453A4427313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 36b0dac719dd92ad4561c8d8d31c411b6cf70acbc6874164629217a557c1450f
MD5 858e6a4ca79f26ac2fb38dfdeb920843
SHA1 9f227b20a840f4e31f892fb30277a2e3b2417114
SHA512 0fd5e8d2956ef3eb8849ede9e459ae6cfa5d3ad78a014ea9bf1c57e1bed0ca09ca9ae480305338882fc8f6e2eb6fa0e5b30c13f429d7860cd9897ef7b76e9d89
SSDEEP 12288:cbZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:cV3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T18DC423217BAC082EE6538671D3F6588AFD75DD75453A4427313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b07f98f6ace0abeac777497c66614765fadb71b2b67bbf077891a9d60e0c7f12
MD5 cf218849222f4218efdd2fea4cade432
SHA1 ddd7cf01463652c7b676edce47607451b3a35276
SHA512 e7f698b0ed7e22a63561a60a5d0ae499974065ebea463cdbec48e4c1eedf4b9aa976c02e441f67f2e61ed1599e9e96fe3bab46c89390f383d98a64f4b44dbceb
SSDEEP 24576:bZMRzFVSOd3KnAoIBlEq1tIgAWz5foj3Z:bZMRzfZKnAX1tIc5foj3
TLSH
T1AD05F161739418F9ED63813EC9658906EAB2BC650770C61F13B436276F377A01C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 232de388a76167d8236b2988eb0a169d365877464e1c4651a00478f26b695d92
MD5 410b3a40317dea0612a5e2e8ac301fc9
SHA1 41d66bc9e6771d867a30ce7a9834c43c24b40319
SHA512 01d8b6502a8d55fc9f77412485ae3b1ff70bdee18ae4d28a312b188cd01163cfd1fae86fd7a68a7ded0e6c11755b3212f585ae1816173b407ff0796402d60f6c
SSDEEP 12288:q4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:qK3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T180C423217BAC082EE6534671D3F6588AFD74DD75453A4467313A9803BB3DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 69f2afc5b630c1ccecde117b13c155cf81be43e5d8b9cbeba216e361d42c62c1
MD5 aecfeb0d968ebbd335a60d6cfd8d6ab2
SHA1 2fab5408e0ad68b37f50d51983f1eb86b99eb196
SHA512 2905c37fb7606c7116bcf1307689669a637b9be80fb9a96ba2e2487cbfe68cb1d43ca2739c7b40b8a2ac5c4ce3abc5a164412ef2925ea5f2d57775c33d0dc305
SSDEEP 12288:LUZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:L+3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T181C423217BAC082EE6538671D3F6588AFD74DD75453A4467313AD803B73DEA0282F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a3dc7d970a64d9a36a611dbeb20dfb4bcc24a5508a7d08ab70f8f34996c65890
MD5 d7130ecea41133b0b0c835c4eff70595
SHA1 21f8e29121c5ad8a45432a353bae6c0ed229057d
SHA512 c894b7749c72b74b6bf3a269f805fa69bba0be828d99e5c071f75f56ad1b69e90634e087007d3d4055360da6e7a1b3f9fcdc3c8ecf32ec866771781f52ca0710
SSDEEP 12288:ryPz5L8PZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:GzyR3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B9F4021377A820FDD1678235C9A21946FB71B831473589AF236446376F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0744b5dcbe051d10a701171bc2e1bc4216173accf75934c4d71dffb92e0bb09a
MD5 49d1352c02251da3253ee1f88966c935
SHA1 b5372b8c3cb0d019512dedfb22a1361f7fa7dcaa
SHA512 ce85fef55e1880e97815de7c05281149e8806ac6543641bb76d78279200da9214023c7eb111f0dcdcbcce99e8042750a17b50cc0f109fa70eb6baf28eed56c63
SSDEEP 12288:s4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:sK3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T17FC423217BAC082EE6534671D3F6588AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 dfcfae4d4e172f5eba571a622ef47a854c10bee0f6f2e64be436021c28619ac8
MD5 80738c8a69a332c7d88f5a33f9320a80
SHA1 0275584e379e409ce679f28512b1c13f3f89fc2b
SHA512 85787faa9c5ae7514e77fb1e751ad2a25da300723b443affc48a6d3a907fa70bdd35006a4731043cf2d8fb6df7e50cc50b451fd9d9cac6c28556f320da3ade93
SSDEEP 12288:Q4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:QK3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T18AC423217BAC082EE6534671D3F6588AFD74DD75453A4467313A9803BB3DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4409c7dc6bedf3de5888850bbe6c4825280085d6c126baff1790291b64c6966e
MD5 4d8129fa9cd8d2f1fb6b7067cb5b0433
SHA1 978c3f3bfeb41714730f3ba359dc7fc3aa4f7971
SHA512 b6815bda97f6fbc1e1339fd6885da24e83f962eab12aae9fe53e99a9a409f3aceba867b3642cd7dbfad0d6c1340656ecdad573107e0cdb8205cc8203ff1d44df
SSDEEP 12288:jyPz5L8PZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:OzyR3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T162F4021377A820FDD1678235C9A21946FB71B831473589AF236446376F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 93025edab9fbb3fa253d08a6d6ea6093961cd3016b616acbbcd0ccd3fcc7a1b9
MD5 b1be6d90bec1ce9a62d74928227783f2
SHA1 bf94c672c0ca773b93f5181f8add94a20829b997
SHA512 5124bab5f00342123d74a02e0c8fa944d7e0c3c3f077103b7a4ca72a09910e0c5d31e63df54c5c559af81d18d68e7cd44b4da1f22fda02dc94d5eeceb7c4cdb3
SSDEEP 24576:/TDaLl3z0zD73KnAoIBlEq1tIgAWz5foj3Z:/TuLljmKnAX1tIc5foj3
TLSH
T16405F160735418F9ED67813EC9658906D6B2BC690770C61F13B836276F377A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 58f54845b8d0bab7bfa40ea21300bbf1f31962d1584f8fe34e4ba592ca91c060
MD5 96242b3936f795e685c27c804557a76c
SHA1 943b7ce365d032afc59fd8a62fceee599abfbf78
SHA512 4a1b035e2e36cbe0ae4a41c7b00e3ecc7cb3f80f6fc4643cb9f0fbee19318e514e341b871d5922a39654925fe60891d1211850c379071f99cb7251b9652e331c
SSDEEP 24576:c3vd9CHKy7GZn3KnAoIBlEq1tIgAWz5foj3Z:Gvd9CHKyaZKnAX1tIc5foj3
TLSH
T11625CF90F3E814E8F1B78A35C9765511DAB67C691B31CA8F03A8651A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 7f517d55e9f681b6205363806d76e3a5c49d232eb6a5bba7f85110ba77149846
MD5 8f2d8015a21f79f657f0759fcf7b068d
SHA1 7093e9872ea4d50a70940025ba15ab01b7460ad5
SHA512 e541decd60c5682c8699e7140820712607e52d07e14f19e87417fd20ea7947a5d081b0906d2fd81c50f5b27e8ff91327f89c0b03127c0fdffb1d7af9ee12bf03
SSDEEP 12288:bJZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:br3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T14EC423217BAC082FE6538671D2F6548AFD75DD75453A4427313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 51981458c236b51c0f33d2d18f84a592cc6b51af753b3d43542eb409c8168440
MD5 d307f9acfdbfa02f9dfff1ab21d87183
SHA1 dbfe73fbbf104364ab5ccb2de4905e302f8b559a
SHA512 0473896b59395af6e9bd87a3507b4d72871b0b17a1b9c4d9b750af9a2546623df221794e965080468d0f41b87ed8e77811eaedd9a600088061dd467e2ba107c1
SSDEEP 12288:9vZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:9x3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T139C423217BAC082FE6578671D2F6598AFD74DD74453A4427313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 001645a6c77ddb4a064e071272572b76b69aa991266274e584ab6a6fda2f4db0
MD5 a4a9688661605b1a5468e497fa8ac53d
SHA1 e88be6c3519e0a5cc65579f883aea1b40176cac8
SHA512 b355c2e276bd858f0a5ce618cab704fb86cd49417b6ab16e6ed0b34106cc29d76514555a3c59f98056e59a5b88fb6ca6a8a64761e65231ce6ed493990442047d
SSDEEP 12288:3OZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:3I3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T160C423217B6C082EE6538671D3F6588AFD74DD75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 af88cfc4cf43cad31d0d5950a880e395f174217082037f641fd3baca4162e4c9
MD5 413c7a4cd0187a9f4e77ce7fbc13cc49
SHA1 ff99d8036c423e988885be82e44727d533053ef9
SHA512 437601828adeaab19d4408c7bd2cd1bb011c913115539ed6443765d0666cc2f263a83ad21d998588b0fb54911cefa81956a7534837ae86f993b6b923e7436b52
SSDEEP 12288:H4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:HK3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T123C423217BAC082EE6534671D3F6588AFD74DD75453A4467313A9803BB3DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 7f7cecc6fa25cc0a7204b6d6daeab32b0af0fbe757a6593876eba55a1d75f6b4
MD5 d7dda01188361e3cd07842fec565a4b7
SHA1 45c56ce7793538d91a1b8072ba2755519e7e2099
SHA512 fb913944fbc8451dbf114b04e1141f499fbc295a6156e9418f05a60959b9178f6e3656af188864f9e64620afc689976cf1243fe93dcf33d3ccdf4d58b44a0c20
SSDEEP 12288:bJZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:br3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FDC423217B6C082EE6538671D3F6548AFD74DD75453A4467313AA803BB3DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 af6007603eea7935eb648f010ef729f0a2aed6a1e8f4be19bdb094ea2182f52a
MD5 cc431a6951da737de44f1405f2b5ecb3
SHA1 f57307fd039dfad0999254345aab146e0bb98d46
SHA512 32d17562ac62f690bcc989dfee5077b7c547d4f283578381a6aaa37593a2cf473b8436da02ca1b1cbb9ea8b089b0de778d72c509dbc74e963255bb377a00e6bf
SSDEEP 12288:QgZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:QC3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T115C423217BAC082EE6538671D3F6588AFD74DD74453B4467313A9903B73DEA0282F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 ef393a052c917001233e1e39e20062e7d18ece2386e5bb1eac1428a62b49b09a
MD5 cb3e229ece210bfdeda2d5d7e90706bb
SHA1 079bc595de32d52224bd140c38a7191f383a2e5e
SHA512 f917c8e876b558ed769eeb657d3d11241f83b1061d768094dea87dcff91a8c22e3a7fbdb269bc6d988a55ac2286b3e1013dcd40ea262ac9bc066fe3eac847999
SSDEEP 12288:kqZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:kc3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T160C423217BAC082EE6538671D3F6548AFD75DD75453A4427313A9803BB3DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 9bbac178806943eec326ac2ef3e1d768903f4708dd76f7a4714aeea6ac2dff02
MD5 c442203cdfdcc74cbe9b7e64e42c8d57
SHA1 b6f675512bbf72944f485c4a9e6484063f1394b6
SHA512 fbfd1e59b53ef6d6babb9782ae255842c48d57f43a94039599700523d615094f898b4d215ce26747d5ba102bf3076e5e2a393da82fd689d6404a427d6a9f5b62
SSDEEP 24576:RfwvUk9RX6wkyAIO3KnAoIBlEq1tIgAWz5foj3Z:LMnYIMKnAX1tIc5foj3
TLSH
T1A835D029EBDC04E5E177923C89B7460AF6B178680B31C6CF125A536E1E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 67defbc4763122eac1ce27701f2181b05322f2f46d7ff3dbd07d674dc2192f0e
MD5 650667ca98a642249bb5ccb02c582ffc
SHA1 6e5ad248b64f1988f9d51771f6d7cb3deccdd34c
SHA512 7facbcd7236705157fe63642cc9e1ab3263c66fbb428badc0f20c587de8137b615cf45d88d0a1055e4b0f81aa19815935e0c8604c122906b1a15b0064159af59
SSDEEP 49152:zYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vKnAX1tIc5fob:GySzP30Okc5g
TLSH
T169066C56A16801D9C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3b049e59c7f286a0bda6050e33cd3b81676f5be2e4c26da4cfcc3f7742c24e77
MD5 1855a1203941386d974a2f92ece404d6
SHA1 68a3d6e67fbc0d3bb7c947b63bb95affd5df9457
SHA512 6f380bd83a02739804b322815eec27638742c50aa33113524ae19a3160beac615de179620a0df3a0d12653a90614d9fab097cbe563bfe826a9e2f1be810dad6b
SSDEEP 24576:Y47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYt3KnAoIBlEq1tIgAWz5foj3Z:Y47JUQjTirIhCnDHUPfF/fKnAX1tIc5g
TLSH
T13465AE1DA3EC01E5E1BA827885554A5AEA71782D1F31CACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 1cbdc8736c387d0de98f874f52222ed1bdd2ba7124a5036266585a2d07a37553
MD5 2a8a9df27402303075484c34d7b446ca
SHA1 e13160a7d262fc76db6bfe3de09cfd4152ab1005
SHA512 a65ae040e486f00ccb1a53779a1c5f4f58ab9272bc2fb4542d617030e248f82fbdbeb2cb625ef842288300d042f7537bb8c76e6c3ff927ee325d29ab1b9d8695
SSDEEP 12288:WbsfIZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:963KnAoIBlEq1tIgAWz5foj3Z
TLSH
T12EE4F115E29801E9D16E5275C7A64A45FB337C2583F1C2CB22E0F53E2F3AA905CEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 16004e35f8f01b2905caedfab9e42cba2e8bb88b8cba0ff47b8175993e925215
MD5 4308d6057bb8dd7ad7e97160a8a51604
SHA1 270a0075bfdf5ea4fc14b1339292e582d0d561e0
SHA512 51fb825c43b5c6e7f457402aff092bd6113d5450d52521f7c56b0c7509a7dc591f3769b72bccc995671e8bb89d6394e3f7d20bffe124ee82b94cd7e0a7c53514
SSDEEP 12288:njTe7y5neLW672vTTS+AvEm2zrQh23cYk4KaRMEOV7s8n3:n+76eP72vTTS9ArQh2TvKaRMEgV
TLSH
T1B9452811762BD75FC6A940326E33D1CCAB707D01EE456B0372C8872FC576668BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 69dc7afbc50fc6510f57fabcb30e35e654d07632fb750f417bb4b1233564de13
MD5 6de1868a773ab20fdbd040980440a0a1
SHA1 deda771b8cdc79b85c4e82dc7f9680bcf9fba6b9
SHA512 1ebab7a3d03fca81c6decdc910574105a8234429afe841267c093eec44e7c6a81938be437d8c728c20c50c591f35675ad72457b249627909cf5c4f92210dcd5e
SSDEEP 24576:JF5xo3EszGkbIKbNPhTuJHA9V3eqOYLfUf/e:fn/
TLSH
T15D55D7419537A3CFD1F76072072A9F4CAB64EC4277096F26A388053AD86F725A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 eae861bd1c9cd2035fa9f067308b90b5830e8341df63183c3a8afce517efba27
MD5 7e99c2eedf5cfc1ee59cd36f86211266
SHA1 e7a14602f83992d2929578e79446d95ec0935489
SHA512 4dcb40f76b9b3c444f2655bc0fd466d3dfbad7672e299239c51f7063c381acc69a097459657372919467dd466a6580a094c3eba8df200aeb8866ae49a924d756
SSDEEP 12288:T07wZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Yy3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T10ED42221779C182EF567467092FA9419FD39F9704B3584E33029A907B63DEE06C3A27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fe01ed7e41c67738c23e5bae464aa9ef3807c9cfff78d76b518e6c85507d710d
MD5 4307e4e5ac02365c17031b9300a7161e
SHA1 bb26a92ec8cf5f48d46e56a76768135bcff95ee4
SHA512 c8e93f0a554a4833219d38a8438ccb2911f6cd2740093106fcee5a92ddeb0fd19797aa85b216b26639896ca9c81ac5f7ce1dd7cf2d4783e8299a748906eef4e2
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYQ3KnAoIBlEq1tIgAWz5foj3Z:kgb4mBIBhGF9KnAX1tIc5foj3
TLSH
T112659E1E22EC02F5E1F6D2B8DDAA4417D6B278160732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b84def34be55087adf17351e54a95579d009c6d2a2b4ce846398eb2f5dc87440
MD5 c5dd346ec24632dfc4790950f047ecc5
SHA1 ebc09c2bfe2c6e68eae12db02a7717d715c6a381
SHA512 4c274788562488168d44f6149ba27bc8da65a40ac8d1d3ae53b0768d7ef1dcab50af34d543e3a54720e7be3b321de6e534c5b6968e1a4258d81d4996898bdf6f
SSDEEP 24576:jG88u8FpJqH1bzria7/md3KnAoIBlEq1tIgAWz5foj3Z:S7ZFPqVea7/eKnAX1tIc5foj3
TLSH
T12935F16177E401F5D477D1388A964667FAB1B4250374EFDF06A88A522F23AE40B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 f8aabd017821f84233bf8f6f43aa373d29b0f46e20edf47ca90bcc44b1d9e312
MD5 77bc34d6132ec21eef644f0cf4cc84e9
SHA1 a14e593815ff94530a3296f5f527ebb999fa6ef2
SHA512 c4a7de22c1bb98a1db91499f7d333013580524f800dcf1b9a43afd5a603e89144fc84ce54369d60dc16593c3c423dd30971fab39b877a2be8082b781b37c4d5c
SSDEEP 12288:HHvUrBFrEjwaQnZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:HPUr+NQZ3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T10705E12B36AC1CE9E676E17D85924609F771B462071291DF02A1817F5F27EE87C3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a4e3b65225c082e7c2455d3539cb4fadc313706b3449fbc9ba46a2b61e9e6a50
MD5 a3ac4ce4dff0b7724d2a593b8bb44d5a
SHA1 ab397ad37bf0072ded8d660f47162c94c5f6ed5f
SHA512 2c8116aabcc43636f7e0462b99dd02176db90b55ee0647341d55c024f2fd017714b195c9bd97dd6404b9886e39d6c47ffea51786ff3d672712bafa03075eef44
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpKnAX1tIc5foj3:ZG05lO43bE0Okc5g
TLSH
T1D3D5C06A62EC11F9D1BBC17CDAC64A0BEBB23425033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f462a9b95290fc240aaa6ddd8f20f7df06b93465ed4c615fbb9ca0c4480808ed
MD5 390fa78e466d346683df86183eb5d444
SHA1 94a7f5c0f0a3169f6f7602d276aab034195f17a7
SHA512 8cd4c2411d2db3f37d91849aff1c9a39e69226051e36c454129aa70886071da44755e6d84d4a2b177cb68f6597bd9e90bb40731f1b7da1ee3d844050d53b1ecb
SSDEEP 24576:dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn/3KnAoIBlEq1tIgAWz5foj3Z:ta5POZ3BJt2pasx2+mRKnAX1tIc5foj3
TLSH
T18465BF5EA7FC00D5E5B9D17DC583861AF5B1342153329ACB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1d6f15d050935ca00a23c00323c8aefa661251f6810918b5845ac61992be36e5
MD5 32a2886cec0a4cd35f37104241549f4e
SHA1 6eb5d4e4c58b00b5f3e577b1947ef923bf7bffcd
SHA512 8fb8092b994da90385dc79401723ac5b288b7a16cb4cb24e7c8671d0ee0b213fe900c559aa2dd9888a398ac3087f8a25e0d72ed48c9e6647b50b9f0e3955adca
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkF3KnAoIBlEq1tIgAWz5foj3Z:VNc/zEOVHF+KnAX1tIc5foj3
TLSH
T13F858C2623E901E4F1BBE1BE89779546FA71786513348ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3e5d101ad33e6630674a10994f432862248295705b4d66fc94987764cf76288f
MD5 e252a491adec2fd731641d5c5d2f6f60
SHA1 958c63ef3d01c60342e8113ef1a0eee9d63f0d00
SHA512 78cb2040e0a3631b5ad65aaf02919aeaf68155f08a20322752a6cc8990584f4b8e69e20e6c25debbdc310cc8207adff1ac0941753884ccf0b819bfe1e871c65c
SSDEEP 24576:vTkNvNnaFeYhJNtmZBmz3KnAoIBlEq1tIgAWz5foj3Z:vTMwBtOmzKnAX1tIc5foj3
TLSH
T1FF55AF2EBBB805E4D1FAC6B5CD238512FA727461073292CB5290C13F5E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1ccbad5875338d33a5ded3f7a1cd3936678b855249dd24c57d8204a208587242
MD5 68ab10898aea5049704839fa0139d88f
SHA1 4c5d9d5d5dffab9e40b754394c31517f974e8fa8
SHA512 4251400a5952961aa29e3d132861ab00ba45179d843eb12b8b99405d79cd1144df8cdca0d9ef6dbfe6756b5f705d09dee334094df446e674879b537dbbf7ae2d
SSDEEP 24576:oD3FHshBIYQgAW3KnAoIBlEq1tIgAWz5foj3Z:oDVHeBIAA0KnAX1tIc5foj3
TLSH
T11025E13DEB9C04E4E57BC1BCD6A38906E67178A9033255DB1194C1B66F2BEE43D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1476-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1476-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1476-308-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1476-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1476-96-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1476-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1900-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1900-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2260-78-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2260-7-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2260-0-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2260-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2260-8-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/2764-288-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2764-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2764-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2764-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2784-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-324-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2784-83-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2784-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2784-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3056-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3056-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3056-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3056-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3056-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3300-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3300-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3300-122-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3300-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3300-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3476-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3476-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3476-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3476-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4196-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4196-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4196-40-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4196-48-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4196-46-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4196-51-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4348-116-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4348-108-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4348-307-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4348-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4468-74-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4468-68-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4468-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4468-303-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4628-392-0x0000018C6C720000-0x0000018C6C762000-memory.dmp

Download

memory/4628-322-0x0000018C6C720000-0x0000018C6C762000-memory.dmp

Download

memory/5600-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5600-304-0x0000000000400000-0x0000000000497000-memory.dmp

Download