1743c67fe6053c601068d432dc2e040b66674d0de6adc277a7268c64cf452842

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
Size 1.4MB
Sample261110-lrnd1sed47
SHA256 1743c67fe6053c601068d432dc2e040b66674d0de6adc277a7268c64cf452842
MD5 1097a4614e8906fb470f4dc36af324b9
SHA1 a20d7c403a5721212c61f29019466fc91f27ee3d
SHA512 6d4859ea822b1969a6bcd60c40b785561d3e6ab12757169b2b258c931243e1eb20f7647ab9c36ebe4227aaff5acf284fa3f4661b80a94ed11036ad4cdcd8d60a
SSDEEP 24576:izxcwNmAjFQIqrC2YVMR9uHYw1bMmBOjlxP5knaFgX5s4MJxq7s8GSd6nm1ww:izxcwNmAjFQIq22YVMR9uHYw1bMmBOR8
TLSH
T19565D016696618FDCD535A3B8410A2D3F431BC224519DA5B33BCCE742FB7A42BD38E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1568	elevation_service.exe
1692	elevation_service.exe
3260	maintenanceservice.exe
2392	OSE.EXE
5832	PerceptionSimulationService.exe
4320	perfhost.exe
892	ReFsDedupSvc.exe
5416	SensorDataService.exe
708	ssh-agent.exe
1300	AgentService.exe
3584	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\81d5aed227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d1195560f870dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffb2585ef870dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002244d25ef870dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e68ade5ef870dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ab40a61f870dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a56ca62f870dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	892	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1300	AgentService.exe
Token: 33	3584	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3584	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3584	SearchIndexer.exe
Token: SeDebugPrivilege	5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	5204	2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	1568	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3176	3584	SearchIndexer.exe	101
PID 3584 wrote to memory of 1272	3584	SearchIndexer.exe	102
PID 3584 wrote to memory of 5348	3584	SearchIndexer.exe	103
PID 3584 wrote to memory of 2836	3584	SearchIndexer.exe	104
PID 3584 wrote to memory of 5276	3584	SearchIndexer.exe	106
PID 3584 wrote to memory of 4768	3584	SearchIndexer.exe	107
PID 3584 wrote to memory of 5400	3584	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_1097a4614e8906fb470f4dc36af324b9_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1692

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4320

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:708

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d3ee0d52bde5799ec8976a4c6c88353b247d34b14c31f3c1d1bce36dcde36e97
MD5 41beb73649130403ad8208d11cb6d4e0
SHA1 c468e7b10e83524f04ee98dc19cfe03be28feef6
SHA512 ac2b5e47281954aa467108d9f42543ad6fa2637767554f8c4937913f64fcd585fba20077ac9d2f2ca7f30b8fe676690e0b1bc4dc3403c0a16e72c09335f5fa1b
SSDEEP 49152:kb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnfAaFMsNKQhSUnFw:e3q6tjBGAaZEQhZe
TLSH
T1E6D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 033161d7875bf7af020fd224f059dfde6fd6320263c6a92efff036b3da09654c
MD5 5befc32e13cbb2ac3f9033510b48fb3a
SHA1 d19a1c51447ab5963b3b9854db284b1c901e5d06
SHA512 a4ddad8a4e1b5002aa8865a0760e25a458ae012b93cdd941b2c4e67cfdc5b81d741e846b26ba815364558582648fc3a4ac2686577a9641130c9e793503741bc4
SSDEEP 24576:YXYfDtczASknaFgX5s4MJxq7s8GSd6nm1ww:PtcBAaFMsNKQhSUnFw
TLSH
T15E65012967E509F9ED678278C8B2C501EA3278954764FB8B03F499291F337C81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d674a616afc97942d13aa5be83c105fab269150fcc150bf492b04661222af1ff
MD5 df68df35879b5b8bf1390f217195db15
SHA1 a833c27611c98445d10c68397848c1627a048c5d
SHA512 e3fd9513b214a0706b8f7cc989a42ea804250332e0a4ee9ae35445e6390361ad5dce5204435a00c3ca00a7b159463372b005f5bda25661ceebf0ed08aa2d3e19
SSDEEP 24576:B0Le5ji0hmxwrMXknaFgX5s4MJxq7s8GSd6nm1ww:BPji0AyQAaFMsNKQhSUnFw
TLSH
T19585AE16F6748331D073C0B9C5D2A68AED7130865B308ACB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9d5c353d8895a7a2eecb8cde60a715f34e69508f065604d428d470730e8e8caa
MD5 e826ac44e1a0bd17c68148193fda1048
SHA1 31389750650cd38e038e04ddc64963f2314dc9f6
SHA512 f363dc5e7e7dc71f03ebb2efd7c09c78e9505a4d19cf98d782d689b947a048b9334eb845dcc402b01540fc55f411c32126f9651922f494a7d26f72b78462ca2e
SSDEEP 24576:za7/ezSC6vUyDZaqgrvWx6q8wyuRknaFgX5s4MJxq7s8GSd6nm1ww:e/ezSC6vURPvMHjysAaFMsNKQhSUnFw
TLSH
T139756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 99c636d5895026d36be9f267845878a5c391ffe8cb0669cdcc3185b032c70c4a
MD5 1b7d9b3c9a04d8bd98ccd88bac345570
SHA1 6240a5d7031384185b40203eb166737f1bd4704d
SHA512 266415627b1e9692ac9b35754d4405144d06bbd157425e02861c6aae28adbb3ae0ca6980677a98c9c7260e53155f0d95674882212be75f7a27b5bef82aef40db
SSDEEP 24576:yVbqPb88hv/lV7WknaFgX5s4MJxq7s8GSd6nm1ww:yVO88hXlVaAaFMsNKQhSUnFw
TLSH
T182559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f59c6808365f1c3974fde10f672ab409ec3d6e20a755660e7fb1dfba43255a7e
MD5 93218f2256e2431da6a10283d3b4d1f7
SHA1 2c549f3120c99d0122c2dd36abc890cf981a6a27
SHA512 a930a9e0b6be361d49489f3bea5ffe0e9b3346f878356948e79d05849e68d0f1c8e13d8869e7f33629e3ae9cc2bbe386dbd583c5fa5aaeecabb8781acc8c5191
SSDEEP 12288:hILkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:hILknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1A64523C24AAAC607FBE6597198FDDD40E83C5DC9485CBC0A81B07E2C50FC6C26A7E561
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4fb1b862c58d93a431893db3dba8a2af078897253111f98ab2df62eb5da3eca5
MD5 24550e90ba86cee40a0010367329954a
SHA1 40e64d8f3e710cd07810996d3a4cb1c2b666e2d1
SHA512 9bc5f68f26edca4c5456bf4642b35b9bb885088afb71dfcce5c17f80deb682f94ea00229809984b504d20e922839c7d4495f3802303b774084473e679392c828
SSDEEP 12288:XeBNUbTVO86Uukna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:XJIUuknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T18F65CF7BAE28ECD2C27A8DB95A91C600E77278704F61A3CBD174830DDE275D11E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 15cb4a797097bac18ce87fe1d4ac2698a0acbcc2ea068d78e2005a4bfa4e83ee
MD5 e4958bca44262931e0404066c45ad40b
SHA1 0a43e976b7d93c29526ae8f93c026edc50bb4ea4
SHA512 e1d360afa732a79549e8b4f5b634dd02e15aadd8858ffd58e1c69be1945df8c1e3fa2a714a1ad55d49e9b879f560486848fefb31aa4762eda70cdc7799841850
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THb:eQvGAdlCEL8c/pRNw5ChAaZEQhZe
TLSH
T165267C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 23bba93e33bb7dcc25ca87616cd7c77485a55d7cdf060bfae8c9083794aec821
MD5 cc17e4ce04f9e4fde99c3931ccc1d085
SHA1 1275b8f68167d762d439641a7791033615abe1cb
SHA512 1eb138fbbcbcd4a7b648ac64f9a3624bc152e4a6542a84d8e18b41b57388cea5eab7e4484ff06135df330b1e189a50df6b90bb8e06f43067111b62f013b3d546
SSDEEP 24576:IiewsAjgknaFgX5s4MJxq7s8GSd6nm1ww:TljgAaFMsNKQhSUnFw
TLSH
T19775EF31FA75D036C3BB0DB21B76C716583C7A604B6129C3E3B88E9D59742C2277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8166ad973a25b3458ead9857f91f399ded9713ba797da7569398e5bfdf4333f9
MD5 04c644b9f2fcd26c3b0c347067cb2823
SHA1 1ca9448a82605596bbe0c74c5c774a243d680bda
SHA512 3c1d72f8cd4307c24e03ba5616f1c8904bc3c5215bd7ed2c0d01f8cc15ae0bf65c209fbe43e97dde29139ef82902f30ba93eb948801b3216cb40166ad13eb634
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHoBEQhZ:YUEtQevvqc2W1cpV29I32othZ
TLSH
T1D2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 61500cb4b85d81649a37a194dd3d0f9a23db860c896fb7d6b65d006cd204d799
MD5 e129e4325586f24d6ab5187dcc26d246
SHA1 9bb034b1957168eb5f90c7ff9ce2ab856e79fbfa
SHA512 6c39d41b5cee909ff2904ac41476cb8c6aab3a77255800927a8f037ede4cf1f5bd8c344a94617f0ad59ff8213b79541c23d6d2c9b683a7fe8fc0dfce5e903a5f
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/zAAaFMsNKQhSUnFw:9oquVjnm9AaZEQhZe
TLSH
T1FCD58D0976B8C2E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e9afa0d37dc5567a6c0e8e7d79d6ae9ead0195b89d0ddc7764571f71ee65c461
MD5 9b1d58a4c4cc46ce3c409cf222dcae0e
SHA1 86dc43ba7a908a18064fd27388898344f2282ec9
SHA512 af8fe75d5abaa445eb16f935b4a75483bba4ec2bb799e328e229ed20ec292a92cdfb12eb363fc2da090d6dd424e5f3debfbd7e52c7213720512dc29e60479b8b
SSDEEP 24576:HAhGLmIFoiwtA5l7S53dknaFgX5s4MJxq7s8GSd6nm1ww:HAM1Foiq5NAaFMsNKQhSUnFw
TLSH
T138359D81E7F945D4F5B3AAB899B69570EA76BCAA5E30D20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 28d751cda0f8b21e6dd3f3b9ef5686c1cd9421e11ef53a085525e6da33105c85
MD5 6d6d866f57c244df0b152ead62c7b7a6
SHA1 ae3d55450ebf6b631faaf06098862b8ef9e98925
SHA512 b6f8bdf433dce4329351ff5c13fe6c7f9799bf5a90bb212919ade2c683bb4f081b7e4d1fd630c1d224e4f42100903c3adccbbab611badbf365ec3ef6bacb2f44
SSDEEP 24576:twupOWMknaFgX5s4MJxq7s8GSd6nm1ww:twuOpAaFMsNKQhSUnFw
TLSH
T18D65F14636E50CF9EAA792398597C536F7B2B8022A25DB1F0370C61A5F373516E3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5fbbaf388a53c8a350d3b409c8eb3f4b3d479eb9bd6b691293df2dec02df5d0e
MD5 594a2ec2f1df2f56ed836198a640e8c8
SHA1 38a6e7b1eed027f5ad6fde5fd5b3eda1050d626f
SHA512 346596e89b6697d92990400252d170840acd6c70ba38eb260152e3c4b69d91655457e2c4394b89e0b2897fc181fc34287ab9f3c9d67c71d6924169860f592f57
SSDEEP 12288:zBZ1Iywkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:FZuvknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T10455128623E951FAE3A35278C8F58A04E7347896677957CF02704A681F76BC22E3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b7c79be936db2f52efe71d821651788ae5c798efca9f076bdccd946357b9ddb4
MD5 b27e8d41690a90be851cdc607ab25732
SHA1 6ff6234ba914d3e88678b5b3d727a887990475a0
SHA512 47a152d29a4a656019da11bb11eb986450254628e2eecbe020d5fc5abf77e93f39907118748371f333e33ddf505a733e552c3df6ad30941a4ab57d522304d53d
SSDEEP 98304:FQRQyi36YOcPuLvw2gAf+PN3KAaZEQhZe:8QyiKakX+PN6BEQhZ
TLSH
T101667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 82bf820db0429ecd9641c578a47d7b88a95656e6770c38ad7519cfb3753f9598
MD5 7804b7969835492d6f7901484407ed9d
SHA1 c0cc402a7ff20c0964e85c5cb54ff017dd1feb38
SHA512 99cab6025251766a396f82dd29aa6ccd8cdfd6a222eadac50d5bd5ee1c40c211406770629711723f73f63775e597321a60728a39fd7978dd1e04f3355803ed77
SSDEEP 98304:tQRQyi36YOcPuLvw2gAf+PN3KAaZEQhZe:EQyiKakX+PN6BEQhZ
TLSH
T111667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ad0dfe486ec6db71d2d930e89abf9eba53e73f985962817c25b1db3e78a66b0a
MD5 0875e6274511e753fcad7d8c89455e86
SHA1 9fe737375da98cee57d7cfc5b5265a458692e73e
SHA512 87fd54533f858b1a9566443bcd355df321b8ead29dce1369a98877c03a83c67e9e8832932710a9ddaf3be3250c8f8a25068477f21692830bcf630cf022720759
SSDEEP 49152:G68Qg55nhxeWu7PNU3/QAaFMsNKQhSUnFw:kthGRc/QAaZEQhZe
TLSH
T153B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 52e0bf872f7e66cfcf250a683c99a000b951adece1db0664fa7c8146e5cb32e9
MD5 90b0bcbf2c6ec694c9422cd291acdb12
SHA1 a043eb52c8385b2c8b5cbf7e5d581afc7013370a
SHA512 b8326a9820715b4a4b96cb0bb95db37e429f953dac4bd6777862b9c9022a778123edf03f8e2ed9473c81b0a20d67c5891ea3f5bd0a400a62938ee24e8d44b6a5
SSDEEP 98304:By5112gYy5azzVvD69nLKnhZLAaZEQhZe:cLIH+WhlBEQhZ
TLSH
T16E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0e3bc82ab459fe9a8cbeb6324c064de5065a63d1aafab0f224f5a8abcbeedf3e
MD5 e9ce34d4ccf3979cfb6db87beb02069a
SHA1 2f2141c8ea67931499dd7c3115d1d0f2a348b0e5
SHA512 bdd67ec983676f0cc7fcc1e4e5a13e21288000615cb3b5ff5d8816255be3926f334de35b80fecc7d7a45fa0be3659bf12d526d919043862ff5f1a8f7c526107b
SSDEEP 49152:eB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glCAaFMsNKQhSUnFw:Mu6JmQxd2dCAaZEQhZe
TLSH
T1C0D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 45d32d0fc50bbeffbfeed9f50f1484cacc498618eb6eb794f33f272eb626fe6a
MD5 8a884c858098a40368b3cfbbd97414e5
SHA1 4580dff1d561d09349d9d77379205508e6891d45
SHA512 3590418bb232270c82723af3ecb9e89db741550ef01a4d3c783bea66ba754496d79287131ac990cda859759a24a31f11e5184f441b7af537781411ce9cb19f87
SSDEEP 49152:H1hpsNoJpF1A6yU44CwH7R4xOAaFMsNKQhSUnFw:HmifPVR9AaZEQhZe
TLSH
T1D7B5BE13F2D901E8D06ED17887569232EA61BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3803ae352be50b55164a9f3dd7ab43809ff0adde3d85e6a6da94ea3cf5a37676
MD5 f985d857e6c164f7077a0b6ede295ff6
SHA1 d1546208fd4c9548f4f9f69ab72a60377b6a416c
SHA512 4c3e3a25569994adee2fac3c2054ea065bc0e24a52bbf73aba4db069ab805a25790598bdde2d43f92944c1acc986563c80bb44ac4ae26fd163ed434040937428
SSDEEP 49152:DSuZQIY0Be2KIRVtOnks6NMHqvAaFMsNKQhSUnFw:h5dKOi61vAaZEQhZe
TLSH
T158C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c48ab7afdf6a76c72ed498d9318708b703b8208bce927213632437d212681d9d
MD5 3a85c1d69e6483f37153a1acfc9fa51d
SHA1 4a570c764d79e7c37b543345f7150e8e9f804317
SHA512 3abb23991e46827930acef0f0f1463264d5a491f7980c7126f5e0bec1cb5461966c54e7ec22050b7c7b24ac2e27ff5f23fc5c88c1977019ece08afc644001dd9
SSDEEP 49152:uhtSn8EApI0figGgiDn0AP5wSAaFMsNKQhSUnFw:vX2i/phJAaZEQhZe
TLSH
T11895BE13F2D901E8D05ED174C7568632E962BC160B38BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9057a28bb1cc6ec103ce8c54d0d29bbef1a97d7f05b4c6ba784eb68307027d97
MD5 a41ee557bffb5c032fd8761b68389a91
SHA1 4b731077d2ad1875b7b9a08eba081f152cee80c6
SHA512 2ce8021f116a5bc5dd72bfd9201492ff6d94ee4359c53d5346e1c90a15b86278842375780b66be5ecb0351ef94db3d5252a5663e5c406037721801c0117904d7
SSDEEP 12288:zjkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:zjknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1774523C259EBCB07F79559B184FDD940E83C2DCFA95C784A81B06D2851FCAC23A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6ea55e6eb634c024ba69242fae9f25317e13ea4207221068a20fb0ca76c5820d
MD5 52cf57fea188d7308766254554b798bd
SHA1 b962f15efe9605a14fd7cf1c825cddd59cace757
SHA512 1873b063774c30d9588bd43f81761bf2f90a36228705822c87a97c70ee58242e45f7ec923dce0d54d9b34153e09b0c535538d5e09a47f89b38e78aa86b39d52d
SSDEEP 12288:B0kna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:B0knaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1F04523C219EBCB07F79559B184FDD940E83C2D8FA95C784B41B06D2851FCAC23A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 abcb38eb9e8e91a5849388a627e18d4e135e761201058022028136139b2ea491
MD5 bc17872c5f715b24696c79d5054a6ae0
SHA1 9e9750bbb2d3175f47f105a57afebf6b22653700
SHA512 18747d8268a35853e559f7e55e7fc14cb2fda4736b2d0805ace635f54daaa5dc42068764afa6742a1549702099fb6dab786d223bd95c2105131c07f33e9e11d9
SSDEEP 12288:OGkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:OGknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1BB4523C219FBCB07E79559B184FDD940E83C2DCFA95C784B85B06D2851FCAC22A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b5998b5c6e2fb3b686e7cbfccbe6805b90cfa36d91f2679d1ccf2b080c420da4
MD5 490bad1c7eeac5000ec7d4927e485c32
SHA1 c4412661d0c5ab0996d713df102451cddd5a30d2
SHA512 6a0e38d2847673ee8e7723019b1cc5c1c4732c1610006a14ea726d5cb5e7a2527828a632d372133608f9321f5d231b101440955c5743d0434ff0ae82da6a7f4a
SSDEEP 12288:oV9kna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:GknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1974523821BFB8687EAA5D571C8F9D900E53C7DCA9728698F86701D1809F87C13E7DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b32afa230411953e3ea7e2aeeaf9fac9c44af5d5833182850d1c325aa3422745
MD5 11d3889c356e04f36682b28c76066397
SHA1 9f11e761a710b1c54522fa9302b0f61b09f9dd83
SHA512 748873d0ffbd57670319e80a89c82334c4b0f506f90d5f5b19460b81dfed4e45dd211592014d598a4d59bbe27ec016cafd7b9bb7153002485528f6ac6a67302a
SSDEEP 12288:XFkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:XFknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T10F4523C259EBCB07E79559B184FDD940E83C2DCFA95C784B81B06D2851FCAC23A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e52dd0b9b6f73dddc29892bf5a7873d61bf0c608d50be86e41ff1d8a9db231ac
MD5 e5c11d32e1e8c6b509401d9bb9ac9a19
SHA1 cb0b93edd2108badf6296fd9e09c350ca19b6e8e
SHA512 fd2a767b506d8774725289f674ac46e6a19680d7d01371d69f3b825b40c95467d84ff546375bf2aa976b2a452e5322d1b980da10f791f2577e21e4ae96eef7be
SSDEEP 12288:v4kna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:v4knaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1F54523C259EBCB07E79559B184FDD940E83C2ECFA95C784B41B06D2851FCAC23A7D5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 45e525131edf6f0c4fe9d4091cce129a1e2081c1833dbd204a8d368b41e1c9b7
MD5 32d79a5e18c8f8260d1d317e795c668e
SHA1 2bb519677dbdfc8761874e73d32ea8e5eb3abe6d
SHA512 d2bbaab07d39b903187bae12e39aea28b26c57a65ecf623feb5d4fa0e1bdf8128e66411c5e12dd8da632fd2258a90966e163463c0eb51e5399e89c1c52d371d8
SSDEEP 12288:t8kna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:t8knaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1954523C259EBCB07E79559B184FCD940D83C2ECFA95C784B86706D2852FCA823A7D5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a4fc84b6ce52dbcedf5d3d49170106ba13a8127c9105d1c0b8a6b0f6ab75bf30
MD5 750df54bed73241f968b4d0b0a88ac70
SHA1 1fd0b3e1020a092fca34ecf2cc672b6dab289ca7
SHA512 829842320a9ff8e327e971edb36acbd717a9599faf9e094f253be8afa9919f0f5244343c641c6663c557628bcfc73f6d46d1888d6cc9a40e7bfb85da5c28133c
SSDEEP 24576:BZMfzFVSOUknaFgX5s4MJxq7s8GSd6nm1ww:BZMfzfIAaFMsNKQhSUnFw
TLSH
T175650195B3A108F9EDA7813ACC658905D6B17C5A0B70CA0F03F43A2A5F773911D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b90558cf2d276f5edc73729e4f6b3b6a29469a0b39f8869f6195976cebdf34dd
MD5 ee8af5cac97ab24a42c2fe9217997296
SHA1 d30df6ac626694479d3bb24293d36918f4c446c1
SHA512 bc33e44ceb049aeb012b8547f9dcb3fad928f052e882395960d560fd95e626cdc9c8009eb5d410b7b1c177ad9a732e4f3c21f790fc729f3be459459242a1665a
SSDEEP 12288:K/kna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:K/knaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1724523C219EBCB07F79559B184FDD940D83C2ECFA95C784B85B06D2851FCAC22A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0a142a6496751ce662680b122e8c7fba02f30bd91dc5e7fe0378e6177ac2ba4e
MD5 d990139b6bae9e178c33b25f72a8010b
SHA1 336949be3df7a9db1e7df18521defea64e27240a
SHA512 5329e423961d5ca0c60025f91d5ab9c107d459ed78a8b7e08322be97ade1088ac47a8ad519d9aef04e44a1e74c52a00e91d17a5fde88f96155d61b6187c82b3b
SSDEEP 12288:Gbkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:GbknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1B54523C219EBCB07E79559B184FCD944D83C2ECFA95C784B85B06D2852FCAC23A7D5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b14a51c658840da649fdc66a82d3473303eb08c8518b2b3f7fad74368d521442
MD5 698f6b330e9fc06aa2a87e2773e44172
SHA1 0d242ab517282674dd4b51e18898dabcc92bc658
SHA512 6119fb04a3c8473ecd9c95d1a09df513c7f153719197e17079602b379bacc8c5cdee0762b127333e7219d1b10d979584d782af835351736c7ae0f5530fee4981
SSDEEP 12288:hyPz5L8wkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:wzywknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T14955024377A621FAD2769234C8A65A01F735787647249E9F03B00B392F776C16E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ab4c739d945c1a321b97f769169e3d7e5b3c8fb10ce3b338dde217bf6a635ca6
MD5 fcae027ea61b80592eff490610fdbe0d
SHA1 d88cea2ddea58a002bb20dfdd191cb943a952e89
SHA512 9eb101633d8721e23d63471e103d92460923c10714082beb05e322e40e64004e6e08f47a09bc497ce067a8a2cb39efc791e4b34bcebeedf7571452f3c6f28ff3
SSDEEP 12288:H/kna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:H/knaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T19E4523C219EBCB07F79559B184FDD940D83C2DCFA95C784B85B06D2891FCAC22A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f9a4dc3220d449d5b1a576ec98808f861d53b3a8da4daa082beece211ce39620
MD5 564ce2ff98eca241005fa552b8eb808e
SHA1 f54e717e29e4f2100630fc309d9b2d2eeea6984a
SHA512 ea88e3802a68077e146159beae366dae8acf9539fe04e089ab30b96fb4ad05e0c308feb07a77c0ab4e750059b913ae0b0fc7eb7587c17e17586a87ec315bcbca
SSDEEP 12288:x/kna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:x/knaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1CA4523C219EBCB07F79559B184FDD940D83C2ECFA95C784A85B06D2851FCAC22A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e12690d5b6fd7316739649cfe02777bbb1c5fcee72410e17af8e04bf0a9b4ee9
MD5 36e1b6fb5c4eb9c610938b6d1c2926e2
SHA1 f4854dedda0d625bafe0d6b6f94de939eb267890
SHA512 95098f05b22e59dd439efc6b122a68d07b718d2aa0d1b1436e4795e0933594ddf730bd58bdbeb6510b22233ff4f9323eafec7e93892ead95d23ff52ebb78bac3
SSDEEP 12288:syPz5L8wkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:1zywknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T18E55024377A621FAD2769234C8A65A01F735787647249E9F03B00B392F776C16E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 680976a2b69b98014fd8855faa949c0a619b05826f2f0f8ac983447d5b3e1ece
MD5 55507d1bd0aead766c64eb131b14702d
SHA1 e9f5f6546d1bb7c7026df57e24389b7382e79491
SHA512 a539bd1c86c27166e74c90b6d8eca4e0d3e17bd8879678b2d2feaf6fe125686d492bef677e9d360fc75b3dcf1358efa5115ab5dd9567dcef234153e96ee752eb
SSDEEP 24576:CTkaLl3z0zD2knaFgX5s4MJxq7s8GSd6nm1ww:CTTLljRAaFMsNKQhSUnFw
TLSH
T110650195B3A048F9ED67813ACC658906D6B17C5A0B70CA0F03F43A2A5F773911D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6bd6a9f00733d45aedc4b78558c0f9831657a652fa1e60afe29057de69b8ccdb
MD5 ebf11931cccbced1bfa44c4b3e3f69b6
SHA1 73a18c887b297c91da475c1bf61e0125b1785a4b
SHA512 cc05f403e33c821d087a56fcb87758842ae65edfde28e4f23c7d7f428a6f03599213a4218ccae962c9b107c37122cadd1f101806f381253d5205bac2b0b331f6
SSDEEP 24576:43jd9CHKy7GZqknaFgX5s4MJxq7s8GSd6nm1ww:Cjd9CHKyaIAaFMsNKQhSUnFw
TLSH
T18675CF90F3E414E9F1B79A3588768511DA767C9A1B31DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e54db3c4a13effef61b54b6e0121d91ed2c80665b1b083d635792d59b6e9b274
MD5 be40e21b0a4bbf6170564d0fbb5a4561
SHA1 ebfbb32b6dfd64b4b220cd1e58ead98c9c55b535
SHA512 9078a2c0c33411a51d9b2c29eb7abda2a3d0072d73268e0b52b3b3311405eb4fec2e6e1ac1f99d64c08df9237b44fe79c1e6b621134db4c81b8044350276b039
SSDEEP 12288:Wmkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:WmknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1AC4523C259EBCB07F79559B184FDD940E83C2DCFA95C784A81B06D2851FCAC22A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e9abcd554b73d360a60561100fc6f081042b6b6bda39d8e7c7fe92bbe858197a
MD5 67eac4663dfc7b4442e80d99d940f6ac
SHA1 e427b299459829d9a4a4b8d56c1e8e4b7a25837e
SHA512 cad348f1f06bfdda8110af9a9eeb60aa9eefaee0ba9ad18ec95de76feccb40e62396f2e3e33f85cbbfcbd953f0780aa35cff12cde3dd800f28b7dfc464373b00
SSDEEP 12288:rQkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:rQknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T18D4523C219FBCB47F79555B184FDD940E83C2ECFA95C784A82B06D2852FCAC22A7D560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 20d4457287be0cfe3625c83d9197c025a771857b2fa6f5a7e0eb531fc73a228c
MD5 5ee4fe872dca386b2bd5b46b5adce480
SHA1 b70d414ce11ccccd9d48a43acfb86f42dff60be6
SHA512 ad3145124270ee9b7b840d6fed426193584a997aa078a4c0335bdd03196310137ce4597f6df0632b82b6f3e2699e49582e812bd02c7139b17acf64ad3610601b
SSDEEP 12288:ZZkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:ZZknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T18E4523C219EBCB07E79559B184FDD940D83C2DCFA95C784B85B06D2851FCAC23A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cf95a599074f4e660d5935e67b5e3947f6d777ea374ba6c34bbc0e805f55ea22
MD5 7c0d78c37347a249b651676a0de54e62
SHA1 73b121b5722b90e009155684860abd7fc58d18a6
SHA512 ecfa6458bcb5761ea842b1cc1444f888f4eb49506c99a7036f7d8d9d7d44097c85e0dc411826c0ec6ed3127dcfb8fed3fc40477436e478051234c56f3f22660b
SSDEEP 12288:l/kna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:l/knaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1044523C219EBCB07F79559B184FDD940D83C2ECFA95C784B85B06D2851FCAC22A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 eac5fefce423da74dcf1d8cb98976d55a8356a1519d9c14fc215cc0cb249b9f2
MD5 85c7e1ad5891eb1cdba429b76dfe7d36
SHA1 e16ebe440789effdfbdc98d70e32188d6c543395
SHA512 5c3bc9fce879e59660a01af83c7ecb9db8ada124ad81b08b005bd57c3ed45b0f38142d870ddf7cf6e4ef3b7c5a5e45e92e2bf1133ad6fcbe4edece2f8503f0cb
SSDEEP 12288:umkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:umknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1DB4523C259EBCB07E79559B184FDD940E83C2DCFA95C784B81B06D2851FCAC23A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3f6ed74327d756bab3e9b5ced88d59fcb23ebbd0736b8072c4ea21b2d5ac43f7
MD5 a2870e5b9d440acfeec3cf70ab3ed336
SHA1 0c444cc2a58225eca9bd31b6892e46594157cbb2
SHA512 a72e3597db1f36d1cb241b157b1a6287e6d8bd869741b6028a72f35ba3d8faaf097a949cf422ff13a8677bde08342bf23d9bafd47abeff080add92f669d70c0b
SSDEEP 12288:RHkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:RHknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1DD4523C219FBCB07E79559B184FDD940D83C2ECFA95C784B85706E2852FCAC22A7D560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 41fb2765f97b8af3d11975094a326ab42835fb691c227fe5cf4b0009f0b30370
MD5 e46eb0f579a940a9c60a5d5d2e921df8
SHA1 306881922f44bd4e206e1bc1857868b5f03ac88a
SHA512 8a4d454f713545f68f6b4baf8ac2951e3e4c74c841b956909d8f5ffaf64221f1114da9910c0c4d119bf485ed435bf0c2bedee43cdcf2692085e24b6821c49e59
SSDEEP 12288:QFkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:QFknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T19D4523C259EBCB07E79559B184FDD940E83C2DCFA95C784B81B06D2851FCAC23A7E5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 0d746848c03517a1760de69538fee947913d4c6e80a917de0ac1b7543a5acfe3
MD5 e0ea523beb27e5579d7069313f7e8b8a
SHA1 70a3c9a7538e0e7900fab99f5d4b26d94c975ffa
SHA512 b56769a9ddfb939dd9a722aca215765869c51bf6c89eba2f94fafb0aea38de5b08b0984247be72326476181d4ea8945632aaef837b54ebd8b641b48de65a57d2
SSDEEP 24576:XfwvIk9RX6wkyAIrknaFgX5s4MJxq7s8GSd6nm1ww:VMnYIrAaFMsNKQhSUnFw
TLSH
T13385DF29EBDC44E5E1B7913C88B7460AF6B178591B31C6CF02AA536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4d44bebf46af2e1adbef8f6e018ee8453e14f744940fce1cb91c115046d56275
MD5 9976ce4aee7f80b77abeda0fca1d61f3
SHA1 f7cce3d7e41242bd253cb425a387f94426c11bce
SHA512 7884f9bd79c22483e66c24d5738bc41c9d02072710bee64fdc563e4d5eb045616d5d0fed11d549494950519654cadb268c72b15751a28dfbed8d1fa50a87756c
SSDEEP 49152:uYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yAaFMsNKQhSUe:mySzPqAaZEQhZe
TLSH
T121067C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 74140f5badbbe5887e5d3e7ca03be2bc9e6ba870efb12e984f3f2f2adf2ab811
MD5 88e8ed4a6ab1ac60f7ff43d2cb0f445f
SHA1 37b79279fd082827f25ed5473564cb5dd2138c36
SHA512 c20c826ea2fb44c826edf221b1daec000b2b843e41b39c14e7f47ba97219083f94d163ad0d445816c023fe2b16e695174103a4099ecbee6dfc99caf9dee88f9a
SSDEEP 24576:a47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYkknaFgX5s4MJxq7s8GSd6nm1ww:a47JUQjairIhCnDHUPfF/CAaFMsNKQhg
TLSH
T11765AE1EA3EC01E5E1BA927885558A1AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c1b10e577485410c4b2b4cbb68fd7d421a96b063308f3b2d9169d96c09771214
MD5 0ca08ee4b909e1cbc787d3cba1c0ff13
SHA1 287876d4b0796f2d5d53ce01734088791e38920b
SHA512 76961297609b957fd6b09103c566ee80553734c4fdfafa11a075662dd1194323df6e8815dd210ed07101ad136bb28d6a9b088d6053d8db8652198f63eab4c14f
SSDEEP 12288:xmsfvkna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:HvknaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T18255F14AD2A842D9D16E6175C7958A40F3373C6587E1E3CB42E0F93D1F796806EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 0dd8f64c48308c53322f15a8f9f892622af21580ab651da30ccdbd8e4a6ad4da
MD5 7fb0c3eb016193a2e2947b27e39f8dfd
SHA1 309345f6fffc0e6d05999137c1caecba0c01337c
SHA512 b6c1dc426520d33600e94f21a959d72388075236f84c03f397b7758bef0ee087644b865225ae949fdbcca4a7b8d1b3ef44b75bd88751aca777cf24f1212fd0fa
SSDEEP 24576:Nk7AxUP3vfDjir+z9oeIyoJlbgyBjXriJ:LxUvXDjx9oepoJddBjXri
TLSH
T1A45517007626DB8FC6A940325E36D6CCA7707D01EE046F1373C99B7F9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 81fef8f255a6aaa45b141e220608f45a50897ca242bc397030b0319a4508e381
MD5 0049166c73f00274f8e4296de2a28ac5
SHA1 1d8e003a30b2b6e59610364e1d513118926c3719
SHA512 822a03c1d1d68917a791494303b7c37002c2add59d8249873b575053460c1ab504e5cd746730462858fe3bdb92ff2208fd1eed8a4dcef2de3b4fc1e8c643bb28
SSDEEP 3:OlH/lay03oIglHcKEp6CERRl3y8jK63mCllltGlslslslslslsl6:KIy03IH7EqVKcmCtEEEEEEE
TLSH
T1F48192186B810B14EE56B43C88A9476E172AD287B8C083BB190650D1CC502844C31A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 efc32c18dd6c3288839cb6796cf1fda9d0573d3707e882a1f77ff4bedf91f99b
MD5 96c45746d465158b3c5fda41b6cfa9b5
SHA1 a5053ecd49e1a604602405b5fadf6c5591a999f2
SHA512 486b57e1da1044d277954d69bb1c07f4742d46c3a51aa64557bc8a6c58e182efa7bfb1cbf23bb765387c0cccce9cdbd051c66af13dbbf381b66e0ccc9d5616fe
SSDEEP 12288:QyJCBrMBzI0nYAXjoRkZo85FSgrR6cmd+Ak/W4O6WYDINXt+lYg/UkfqB:Q2C6d5FSgrRdcV8njcNds/Py
TLSH
T1A645060065B7EB4FC9BA90371232968D6B786C02F7452F0573458C7C986BA6FB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 239f6bc2ef06c8b5ed6a58f6cc4f9169fdbfae833e69d5bd7a71a048e5e0a225
MD5 fc824389d33d3e54ef53006c4e531d73
SHA1 067402fc72d9b76ec5535deeb9ed732edbef3e77
SHA512 12151dce9a32356491bc3c09b0c955c2503aae306f5bcec0947c7a64f24790f7e069b277b05fa2c67d1fdc40ce0b4b4324009fb15db1f58babc645a1e3bd1231
SSDEEP 12288:/i73kna9f0XQK5sn4AM6fyOx7C1Mu7sezGdRWiOZ96F9hVu1wwG:O3knaFgX5s4MJxq7s8GSd6nm1ww
TLSH
T1D645238247EFCA07FBB569B044FDD910E43C79995F48A8CBC1706E2851BCAC22E7D651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8ec618f0aaf20784906cdd6228375a433c5cae50ae78c94b65fd1ec769a74d55
MD5 381dfb7a63f34eccac5908283c7ff7f1
SHA1 11a79070a33f36e632cb1d17285a56808a41713b
SHA512 32486148239e30e1e6abe5ecb90acf46194ee701bcfea3f90c999f90c2a2be6dba0e942acb1d19608db9e2dc9eb53f3b7ba12b8f52ef2428aafb4310777a857e
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYRknaFgX5s4MJxq7s8GSd6nm1ww:kgb4mBIBhGFkAaFMsNKQhSUnFw
TLSH
T168659E1E22EC02F5E1F9E2B8DDAA4417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 41e8d40ef25263c8cf0a2c40ecf8853dad3276607cfcbeb168ead078609fc012
MD5 264c4469368b38aabfd2cb1434c4a891
SHA1 bb2398999f07cdd628297509645b2d5074a71f79
SHA512 01eedf75b42b1a52b0f8ce5158799f96835934ce870c7f8124a28796c02812c3cb0fb6388e9372ea32c09c965fde9d3cd3d0044a13b8e093022f864f7e366f4e
SSDEEP 24576:8G88u8FpJqH19zria7/mUknaFgX5s4MJxq7s8GSd6nm1ww:/7ZFPqVka7/5AaFMsNKQhSUnFw
TLSH
T13285F16167E102F1D47BD13889868A63F6B1B8250364EFDF07A88B551F33AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 785cbd1927ffddb86a6528f9c2978b3ee95e94613e2c3ebcea534d249274bd02
MD5 2abfc353b9662e6de5679a5b0ddb7310
SHA1 7bd051d9f47fb76f136237bfc38a8d616253e86e
SHA512 51a7585f71abe493d856b797b8dcfe60d8d14f1ee1dbc3a7f0db8c39618bfc7794d08b399abd60179adb826107f328a1326a38328c495e513abf2adadb18077a
SSDEEP 24576:kPUr+NQIknaFgX5s4MJxq7s8GSd6nm1ww:kJQIAaFMsNKQhSUnFw
TLSH
T17765E15F22ED18E5E676A17D89868609F77178620711A6CF02E0813E4F77ED87D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9de3ee9e7a22a00d1fc8c4739b47d33493e822289e6f05028667f1e19c55329a
MD5 e908da7502aef759f919b495209b8d24
SHA1 d7918f6072ce8e598d8a676529f3437d6f6e6c9d
SHA512 be1cca380ae98de3548c907558c95c600d9402bc564ba29bed0b10273f95c17424841e5ce953b20d7eb7b8674d5478b691d1d759f805c1c2cec5737d82e90430
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4AaFMsNKQhSUnFw:YG05lO43bzAaZEQhZe
TLSH
T1CCD5C06A62EC01F9D1BBD17CD9C68A0BEBB23415033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 92f68a9109685c8f8151d1aed9b3083b485eb1edce2e41bc39e7cfa20269de66
MD5 1488e7016143a3de559cbe2087b4b3e5
SHA1 4ca578574d05437424a9fdc40b7cf6f90fee5699
SHA512 aeddeb995636d4aea4a46237d8c667fa395a2e795bfdf424d81eddec308107baf2f5977bea8dd18f9c2b70b955b024e9c88bef237037318fcab80bbf567b3f4c
SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnyknaFgX5s4MJxq7s8GSd6nm1ww:ia5POZ3hJt2pasx2+mQAaFMsNKQhSUne
TLSH
T1E865BF5EA6FC01D5D1B9D17DC583861AF5B1342653319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4081f1baf5a1440946deae4fd0b9f488022f87f31764a462bdb89e5f2e8f3a62
MD5 e0c90d28bb2397e3c4209932f62bd1e8
SHA1 5507cd03ffa7e1212114151fa239e5c26b7bcae2
SHA512 94aebb824eb556054dbcff25c72fab739f649bd59e827d21881dbd9b96bb163a59638818a471930c25ffcbb89475c64a961541dc52dc4d10876b732def2370d7
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FksknaFgX5s4MJxq7s8GSd6nm1ww:nNc/zEOVHFZAaFMsNKQhSUnFw
TLSH
T1E5858B1623E901E4F1BBE1BE89779546FA71786913348ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1aa2bbbcaebedc7998b0cd581bacfc3f440c1a8c794ed024d0e738273604882f
MD5 511ee2fc7c38e21c1f497dcf298a8f57
SHA1 d7a9fcc3b5fe2b8ddbbe0fee7754751825c5f9de
SHA512 bd90b76f71e3c9295ac8663fed05993f20965a89231e62aea9a8125a1b51d5a97ac190f86546a7c853187c8335bb372698652f831adcd33d50d23a0833045640
SSDEEP 24576:23kNvNnaFeYhJNtmZBm+knaFgX5s4MJxq7s8GSd6nm1ww:23MwBtOm+AaFMsNKQhSUnFw
TLSH
T18455AF6EBAF846E4D1FEC6B5CD238512E6727461073293CB4290C13E0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6e05a0fac0b0ce0415661d722352cfed938fd5dcdc98d9401f7eb99bd8b62d43
MD5 c62906245ac10219a6f16688ab5a712f
SHA1 4743c3891fc6448afaae35fd1eeea9ccb0983956
SHA512 e9fb80d4524a9adbd8e01b27ac1f4c6a87fd6141586d103a7fa64f1dfa5d5ecd089b3f68c781340a3c08b1c0362de9a5dba5c5fedb2863064753d3fe83b8ae97
SSDEEP 24576:kD3FHshBIYQgADknaFgX5s4MJxq7s8GSd6nm1ww:kDVHeBIAADAaFMsNKQhSUnFw
TLSH
T1C475E17EE69D04E5E57AD1BCCAA38A06E67138AD032165CB02D081B95F6BED43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-115-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/708-109-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/708-107-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/708-306-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/892-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/892-323-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/892-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/892-82-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/892-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/892-88-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1300-126-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1300-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1300-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1300-120-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1300-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1568-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1568-23-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/1568-15-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/1568-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1692-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1692-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1692-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1692-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1692-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2392-246-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2392-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2392-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2392-54-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/3260-50-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3260-40-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3260-39-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3260-46-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3260-52-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3584-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3584-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3584-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3584-310-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/3584-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4320-78-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/4320-293-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/5204-1-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/5204-7-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/5204-9-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/5204-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5204-0-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5416-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5416-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5416-101-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5416-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5416-307-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5416-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5832-279-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/5832-67-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/5832-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5832-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download