9877c38f90e50f7e05baf6b4668f7db8d9180627ec9b5d3e3e08b339c42a68c5

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
Size 1.4MB
Sample260702-grpvmact6t
SHA256 9877c38f90e50f7e05baf6b4668f7db8d9180627ec9b5d3e3e08b339c42a68c5
MD5 a4c6e2c11476fc191ac6f5687f4ca4dd
SHA1 afa457ac7b2f96f1100b9ecc793d31376a212a82
SHA512 e753b1f544d2af9a01f5b9c93168fcf8a78e784fc733cdb4ef2b1b901305aa6bb00ba7c8ff10eecf7f50e2ca633f1b2995d43f0542ab44196b6f37b495a7d631
SSDEEP 12288:wItcb6Cu708Es1dzvRswFUGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:wIg6Cuw8EsDyrFNyBo4kx929bL3Hnx
TLSH
T1C465D01DB29852F4E17BD334BA824516EAB17C4577619ACB03A07BAB1F376E04F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2720	elevation_service.exe
5140	elevation_service.exe
5992	maintenanceservice.exe
4648	OSE.EXE
2456	PerceptionSimulationService.exe
5312	perfhost.exe
796	ReFsDedupSvc.exe
1852	SensorDataService.exe
1768	ssh-agent.exe
4092	AgentService.exe
984	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9251d9a543a2495a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\javaws.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035297d6ee809dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5a6f76ee809dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000772f9f6fe809dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000000217ace809dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052b72bace809dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b648a46ee809dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e529c6ee809dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5336	2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4092	AgentService.exe
Token: 33	984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeDebugPrivilege	2720	elevation_service.exe
Token: SeDebugPrivilege	5140	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 5848	984	SearchIndexer.exe	99
PID 984 wrote to memory of 5764	984	SearchIndexer.exe	100
PID 984 wrote to memory of 1368	984	SearchIndexer.exe	101
PID 984 wrote to memory of 5040	984	SearchIndexer.exe	102
PID 984 wrote to memory of 1384	984	SearchIndexer.exe	106
PID 984 wrote to memory of 2436	984	SearchIndexer.exe	107
PID 984 wrote to memory of 4536	984	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_a4c6e2c11476fc191ac6f5687f4ca4dd_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5140

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5992

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2456

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5312

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2852 2856 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2620 2880 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2852 2856 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2620 2880 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ecfbea90b6a53395f0c2f654543920e5370c8be899b62d827edbd951f2276d5a
MD5 45120951490cd2bd4e7fd5baafe186dd
SHA1 84e1f99f0adf5cc2faa881eead569e60fca2e583
SHA512 943005fa09de5a6ae8438a4b6b7ca7e423f92fe8a7b0c8d00b835c0996325cebdf092a496ea38c256d0078c8f35c777c2859bc6a638f4742edffb857cd189bcd
SSDEEP 49152:db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnOB+kn3Hnx:j3q6sjBx+k
TLSH
T1FBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d6972dbcb3c5035efbfd7888b31d1079f6e77cfcfac7659c9e2602d0dab7eaf2
MD5 78832f5974c6d21aabdc0c95532e2c2e
SHA1 a8fa3303b2f803ea70b53eb207df333f31540f6f
SHA512 5a98f4dba98fb90c5e7e784bcf0cc0bf7c93483a99c3f3686f7b51e54231aa6a4ab8bb6283093ad9827877deda83451e359cc6da2fe1af073a405c92fb6a8eaf
SSDEEP 12288:R1XLsswWkxy2lRq2czAbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:fXYfDtczA4NyBo4kx929bL3Hnx
TLSH
T1BC65012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4391e80034de2d83be1bfb08d2dde5470f4d9032b1ac0e50d22ed742cdeb75b0
MD5 1b932b168364a3fc993a5ea7816d42f3
SHA1 cfa34793a5cf1c4d24d3e56211d925b3625ad9b9
SHA512 20c2a5ea9b8e46353b8e7b7206e61ce0ce74df3ee9e01aa7d1c9c3fe99d8401933bca14628e8647a95bd169ccd24ac52f47f8912f5b7d1c0abdb58d24a34738d
SSDEEP 12288:zXZNYVLeyUji0h90ZD0wxpGZIVuArHs6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:l0Le5ji0hmxfrMRNyBo4kx929bL3Hnx
TLSH
T14F859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d041733882451876dbc983cd2bb06862771841244d7243a8004727a23c440cd6
MD5 8a70cd4f534f32df26d4b4f4423248b8
SHA1 b875745d8e4e4bdac9355bfbc8c7b3638be71fbd
SHA512 cd3591e0f868e1a9d8e438403409086809ef19b98d722ebd5d8ffff8a6dc8977803e1d6198f318b67233221f00f9acd09e9fabfc452824028e0d0f0241b00a14
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWn6q8wyuXNyBo4kx929bL3Hnx:B/ezSC6vUzPveHjyNB+kn3Hnx
TLSH
T166755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 47a31f12a4986ac7a550fa78de4e52387425b54b68ac4f54c170396ddc863d45
MD5 505455a3db67c2deb3131ae86cf3f682
SHA1 ec1954e22150c1304e72ebd856b22ae2e6ae437e
SHA512 7ce42046bbb0843518bf51a92043334fa7b11376e86f4e1db4610e63e4e857d376fcd57b3c468512d3cf2f1c8214b592c3b67b43d1dd6efb16a69f432fc1a63b
SSDEEP 12288:OVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98nLDAptNyvUgXZ32dT4ePc7N29CD:OVbqPb88hv/l+YcNyBo4kx929bL3Hnx
TLSH
T1BA559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4e9c29c7a599b87eef7ca5316e483f4e714667a042c0ce89f6ad10436073ebea
MD5 5730a1147ebd557f0c144b3ed3b6f065
SHA1 357322e35705ac3a708905934b3988a9bc2d71e8
SHA512 c8a8a9781ba90f4fe6fbe4ccb259b64a3523f955e8989f4fb1b92f1a8ac568a7d37a818d755043dcfe9bf054e59351fd5a71ef9932d025f0119f542f9e25aeee
SSDEEP 12288:jmWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jm1NyBo4kx929bL3Hnx
TLSH
T12E452312470C627AFBBD3E70749E8454CC35BC8D0D95DB98DE63ACBB58BC9A2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c2734adffdf469781c9417c50da83172686895ac44aa9be06ea4ccb74b3dcb4a
MD5 2d02396200e0434a2dda3a41075d0622
SHA1 172ea9dab504348574ff170db7ea3dab7f341ace
SHA512 8d4c0a3dbdecc970a9580da8bf679a60b5889413354dd05f3179074d8366f721898096a252fa58f4f89148bc338f21207059f9f0fbc4142787a1092c5b5698b8
SSDEEP 12288:beBNUbTVO86U/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:bJIUENyBo4kx929bL3Hnx
TLSH
T11B65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e469b7ed10b76d56bfcaccbea8fb03b63e88dd580c9fb0a67a07ceedffcdea4b
MD5 82660628459dd0d5771f0c4b6f7bf63a
SHA1 7400db964f41a30d3d8b52900f8b57edf13b58c7
SHA512 b7eece3c92e3ea6141e76fa8fc874b4b756a9ee9a15d27dd4e868be85d1a515bcc6a8a402a7102e7487dce653465a571dd6026c2c55958ea207bdde1b7cadd9d
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THV:sQvGAdlCEL8c/DRNw5C0+k
TLSH
T178266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2ad7b532552b589c4e1c8aad28e78d4b4aecdb7300ad1f0f157df1262bf12f93
MD5 f2517c12bc6740eaab0a8a274c7f1dcb
SHA1 1f99e5a693fea83e8e6d62e843bffc3b4d167543
SHA512 dd4102a662dc243ca65a52dc42fff05ca01bed67c498a659de474cbc065dbb4db911c37a2c930fb33a0799cd5680ac10b84efae102342b69d7db9b37b929cb85
SSDEEP 12288:vAwSfxL/2Dc3XDLLmt0LDQewsAjlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:4OewsAj6NyBo4kx929bL3Hnx
TLSH
T1ED75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 16eb58ecc1e9a6d7fcca259edfb3200bd5b7f3536862ca5b5f54143d81640eef
MD5 ab91dc44d845f31a0a9bb0879cec42a2
SHA1 151d711ed2f7e5ec386fb79f696401e92245020b
SHA512 7b94fd9502c35ed8ea8b31ab68dbc3c129ce27ce860222a4019094b797c31e694507df3560bd1f007e98ee04b32dbf595f214674f55a0d8dfe7d330606e16de7
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHX+k:PUEtQevvqc2W1cpV2tI32X
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bd6e2d19aa3aa10015f2979bf8b2d6f53c0982ea6ea3f535aa9f57466e6b0100
MD5 b1ac3ea8f4a2f038425f86e376135f82
SHA1 3a96d1c3c8ef664ddd898573fdf89bbffacb9807
SHA512 9f865f0b28909c1042f903dec5dabeef0cc32589c164ff6baae69be0e6a63c176f966e9bbc86971c9a865488bea850cfbcb6de3bb4802235da9dc06ad2faac90
SSDEEP 49152:iCbRquA/m2yL5zTfFiV+XenmE3/zJB+kn3Hnx:noquVjnmg+k
TLSH
T124D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d853e3d8ce7e187f640184a164538368eb76691258dc6c3fe8d37ac8dbedc0f9
MD5 6efda7e9c6b83792b3ed9bfa07610cef
SHA1 e5b99a8f0b1529ae546ab2bc07b6194971f54ded
SHA512 d801045e9b9aeb6859fb3c0edc5284fad08116a5715077998c006e2f7b0ebcdf05f33dc33b16494d5b1a95d449256a08576c3ca23aa853453862b6328a9f413d
SSDEEP 24576:iAhGL3IFoiwtA5l7S53zNyBo4kx929bL3Hnx:iAMUFoiq5MB+kn3Hnx
TLSH
T17E359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dd9cf85e57183ea3be36f599efb78550ffef0b8d5736edbc2725a84a5737ffd1
MD5 25f96576fcbb2393d7a16b6933229769
SHA1 7c264dc20f3e58f2924451b63754ee0e5e9fc28a
SHA512 681616f46e27c18f653af466f09d5099453de203555bb0843de0dccb6617aac75cb14274cf13b708aed00d4d4e03fe3e9e738f8dd61a17ab400a27d76150d4dd
SSDEEP 12288:Vmw5HEjsChNzBFgl0WDm+CoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Qwu6OWGNyBo4kx929bL3Hnx
TLSH
T16565010677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 076cd4e8aa857ff201f45e949c6cbd39c9a2f8c1c0c972fb2bb776ea7fc7b801
MD5 a1752e27eabf5561ff4c262f79ea04bb
SHA1 185e40bc82eba16404b13a0341ab301c3e7137f7
SHA512 63a423d3fb7111ebdcf9f5bcc82683893553cde9eca2c752934c7b234648416c009f75ad7f0842fe43eb3b91b12fa27f8e250c7a8aa27c27b3808e77dfc3740b
SSDEEP 12288:OgZ1Iy1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:FZuZNyBo4kx929bL3Hnx
TLSH
T1A8551216239831FAF2AB2678D8E58505CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 00b941a7bb5c91b14012e9189a293c4d69e2880a4cb1a56a41c5a50f7ab51de1
MD5 491a4114bc49d9a98268980d2ac8907b
SHA1 a00a70b6ff0a484b71c3b73cdf23a0db06b730eb
SHA512 a5d5c0a1f21b8e097f881aa0dbb9badcb83f475a1159ea1b595afb0eb77289923c0758d849bee6416e8ce672ce80a0dafa5d8d99bc9d95ef8d7f1ea679c1f42b
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:2QRQyi36YOcPbLvw2gAf+PN3V+k
TLSH
T178666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cee0d2486df1b7df2becfa4de2de4df80ecf60be18013ef07d9fca4bfc92e78a
MD5 478e5aeda9123b3b7f5dfc723cf95ad0
SHA1 f6247ec2ccb38a08fe88f111517949722b782f39
SHA512 d6b2f5aaeb7c20387f65ebfc7b2f9e0d97fa2560c8347c0b3f4a620c524f14988c1daff804d1c46acb415e0e5ed164ce330434c9aa4e94ea280d079997f9c0ad
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:BQRQyi36YOcPbLvw2gAf+PN3V+k
TLSH
T17E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ed6dd200d4f7e1d5530dd45bce1fb7f7c469151f3ee43b6a7c554ed5d0199238
MD5 e0f73ff2145c15984f7858baef1f48de
SHA1 85ee822794323d8b0f2f704d0ef31aebe29dc51e
SHA512 497b6c54e62ac677502a5b49cde86695473b451cb6de6912dde95f4e0d12612ea851cd4d29d7c4cee55332154c1ba868dc7b56e9ca1f90cd10447e7dd65547e1
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0pNyBo4kx929bL3R:H68Qg55nhceWu7PNU3/ZB+kn3Hnx
TLSH
T1DCB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f78d9a0a678091ca1885fa0c6c383bd9ea477841657f00211d0b5b72eeb12df6
MD5 84eb2ec25d9bb3074dfc3859eaa105b9
SHA1 34210c1088c8a9c66b89ff903b7505235776f7c4
SHA512 53db355e89530cd1918ae88aa24625a27d6c3504cb957e02d669f5c9919151b3bab6c7cedf443a6a572f9cd60f6da1e480470e31c3390ba6fcb0f3cfd62c48d0
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99H:7y5112gYy5azzVvt69nLKnhZq+k
TLSH
T1B2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7bccbc42dcf32595f3de89e05f3b881b15645fd7f958f27a002eac9befa740c9
MD5 21c46bfc3a8840f41ed2f987ddecafd4
SHA1 8009029585ade9f3d7672d3a12e4b025585492d9
SHA512 dff469222675391c95ff5cfcf4aa630f1e7df452b0aacc4bd33506af5fdd75d8ab1b8dae5be6f17931f7c5d43841dac77ce048919f6d032454126f5580201414
SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glrB+kn3Hnx:Du6Jmdxd2dd+k
TLSH
T19BD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2fe3d88ffa39e9154648e5960d647171b49eb58ddf516947ac12223c409f87c7
MD5 60d92cc56454d841d907884d6fdad993
SHA1 3893bcc4a132e336818c6a3874cd0790198b67d8
SHA512 4ae3ab0b1db41e536084361ca304684f7cdc8736c7951c72004f77a9b7ebcbb72a5bc4138d36c681f85816ff9e5138c8beb3a329c5bba9d60b441fbfe6f29b33
SSDEEP 49152:N1hpsNoJpF1A63U44CwH7R4xfB+kn3Hnx:NmifPWRg+k
TLSH
T117B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 75ac3855b1f5a24e24a92d6761488518e222df8135491032d5e5c978ead1c15c
MD5 75ad08bd060a520534014653bceb3856
SHA1 f529a2490bd83e3bfeeed8c395a19ed3566eb8f7
SHA512 ed7f8f6b04ec987315d6ef9ae618450d1af29fa03bdbbe83b0350a374b773ea62741d5a3b3e97c27b4550d39be6761f85b0a535f10c8ec189e4856fcc693e704
SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHqeB+kn3Hnx:M5dKii61++k
TLSH
T174C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 21dce5b6620e916ccddb51f6d0f78829ccac9630931abf50feae7dc5279a08b8
MD5 07acf127955aa6d5dcd42038dc6c4e29
SHA1 a35e7524449ac47e71f52a296da7d7e1ba140ad8
SHA512 1d0ab9cc37b185f78cf20ebbd37f7f2a87ebf78ec86eb5d44d886b37d5dfbbe64b71b4ea4a68c4c48cc64d2118b8eca5239e65b09d43677269c18da291514dd4
SSDEEP 49152:0htSn8EApI0fig3giDn0AP5w7B+kn3Hnx:VX2imphs+k
TLSH
T1D995BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9721f827ba49523b0e58dfef682d6d56f722af607ea39d6ade620840245738d8
MD5 f344eca3c3b15ef39a3705a5f0e6efca
SHA1 f2517cd6ffc5187648c931f1bb501e4f9acf7639
SHA512 d1f4b00edafb5a2c7b0df9ffa10483c6b3172f3771e26e12139275bc40ab67751a48b2ebf08e5eaece1752667b6dd052a14367170037686bb923106481e95fae
SSDEEP 12288:NuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:NdNyBo4kx929bL3Hnx
TLSH
T1764523125A0C637AF76D3FB0A44A8458CC34BC8F1E9593D8EF27987759FCEA24A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 46ce4b9a53bac556c7dd9a7c9e5397fc529c2310a413b4e835d9356f74835cac
MD5 bfa128a62e741b6fa180f4c37c6b8f1d
SHA1 aa0f0e6e7b77b80973211b5d1f3a3a5b2fdb83fc
SHA512 3d1bb417f8540d3aef05f08a0b275ea3a95d7830952b746c5a3be5ac48c108146693be538e9f981bff65a50a50a6260ceb5a1ceb6f9f89d7f48f164805757988
SSDEEP 12288:9BLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9+NyBo4kx929bL3Hnx
TLSH
T1DE4523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25E21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 125ad1b06f097db9da0534cf4398ebcc5d2618f806d8243fdc9ff481d5fdd31a
MD5 eb44ee354f38ba4f412da6c43e55957b
SHA1 da491aad9799831b26fd47acdcaa5c6306509b78
SHA512 d752873164cb877d8c11fe606b054aedb4a8ab8fa34a8b4ce53fc5e3ca77e5b95475f158b2398fd0358c2cb3669e9e91711827622e19616a41fee8d957ebac49
SSDEEP 12288:eXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:esNyBo4kx929bL3Hnx
TLSH
T1694523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA24B21147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 737dbb2942d080abb15f5503415292b7600ddf2dcc864365d1486bc37ea9d55f
MD5 3b1c142d65a50e0db128fb99faa7b81f
SHA1 679b65405da786bffcf65ae0d61d7c39884f9919
SHA512 3f9c81afe4a02c79244af5a0c618fcbdf69a7b9024cbfdd45594b14d39d5a7b8f1754a5bfd5f6a78e87a426c3f6dd7d1125d611dc0a1aa0db830d44c67f90871
SSDEEP 12288:5VMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vNyBo4kx929bL3Hnx
TLSH
T1AE4523125B5C12FAFA7E7BB0985A8054C835BC8A5B7197DFDF12487B0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dc02a40a6a342ff2d50ba8a283eca22ed41f59ea91dc6863618765dda804d1a7
MD5 7a92d7a8a834cf72179c46bd7bf14333
SHA1 84ebec526f9d4770b2a6f26fb90731fff12b68a3
SHA512 2f8e715e5ec8dddf0df39530a19b200a552d047d7442458ba7c5bc45ef5d89ee0d30f4c183fc5fd83329bf5951ea3f40282dd52748b0d0618163e602f51217da
SSDEEP 12288:o0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:orNyBo4kx929bL3Hnx
TLSH
T1C04523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4e6a2881e89b9eecf287fb79dac9da5146717e1d2d37e44817c7d3f208a2c936
MD5 1c122777f999044159d13f5702f702be
SHA1 4fa5876ca089212c09cbe48f930860229511339c
SHA512 98c67028783902e1de51f259d64029129b9e24cedc0f665829326a4e88192ed202a9e5ec7f5415bb3373415f534d399b9e4e61e4fb4614786a58dd8844d0de4f
SSDEEP 12288:49LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4iNyBo4kx929bL3Hnx
TLSH
T1C24523125A0C627AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ea4cd99f1dc3a65c240c8aab1180518e6a8277506e26e436b73dd78c2d8e3e84
MD5 7a38b7bcb55157aee6d2d3b8d9d014c0
SHA1 9c3ee836df45be9de31df0e9e73c6dd4bff1b600
SHA512 7bc7ac4c2b5d0ff0f0a50aef467fb0a645bc51c83d41af6f7f984afb8bb93fd774248fe59106bdfc176c19ea92f676d749a9613494ff6af54b3fd8f5c11854f0
SSDEEP 12288:3JLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:3WNyBo4kx929bL3Hnx
TLSH
T15E4523129A0C237AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8dbd9aa4fcee7286682e8070137908eb85e05eb4200c473c8fd3e266d428816d
MD5 2b7bf54e491554002ce1acbb42380e13
SHA1 1cea1272970c628de6a7f8ffb76e3e6475f4d477
SHA512 3c0648468e46407719ea1ea4a6f362b824aa9c6c24d8d5d41140fbd6aeb5a00ee311aecdad1b4022e7a43ff60453015bf7b3c0b5c219637f05c79b63cdd51830
SSDEEP 12288:riZwbjzzFEoS2cPvyhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:WZMXzFVSOeNyBo4kx929bL3Hnx
TLSH
T13B650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a196dc2c175ab6ad484bc1b7a93f456f97dbed83a7838a6468ba8cfbb36c6e36
MD5 018e2cc05e8cf52cd0b7571930099172
SHA1 dfaa41b5d1e31381ef43d1c89eb63a6828c01b88
SHA512 795b41488f8eb2927e27ebf8b442bab7104f3f2872cd84473ef449afeb7e1920fac5be84ac3222f02b663ba1997e6c997df075265060e037aab6bc70e86cceb5
SSDEEP 12288:aCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:aJNyBo4kx929bL3Hnx
TLSH
T1E54523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759BCEA24F21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d0eb6c1edaf737bed6c5ad0fb53ce5d3b60ba6afd23f1e6b69570278780d40e4
MD5 73a4d1cbd75f682fe0fd521f368d8634
SHA1 1a248dd3db3bf0680a02503366a105a6260c17ba
SHA512 7fe41eb80c0c44b827cc0b46b9fb5014fbd18304ff357faa651dd9b2ae39dea71d21cfc7b608a246921460f26d0ac5c7c71cabfcd9000555a762b3fab8356373
SSDEEP 12288:GmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:GlNyBo4kx929bL3Hnx
TLSH
T13F4523125A0C627AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759FCEA25E20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c4e09ea3140354076a4c3ade7a22bc1846191bddd71407745d0de0e2d4ecd3c7
MD5 30bdbfcf54be8da9dbb3ec77d700ed31
SHA1 dbaed5f91452e0af2060f91def1775993c50dfc7
SHA512 fcd37348b691928ef61664093316dc59a84a557bfcfb163ae744c209af9e523ca5c211d6eaa368d1daea675d3cf36ba7444e683b011797145a6c8d8c99590eff
SSDEEP 12288:dyPz5L81LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UzyqNyBo4kx929bL3Hnx
TLSH
T17955120773A831F9E17A6234C8960905E771BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c73e03dd612c2ba542a4983d675d3105576d5b1ee02718a575eb16e4ce09f2d7
MD5 b910e303c1087ae5b2b105c8717416cd
SHA1 8bb7b21e15e802a0d6e3d3ed492a0a3f9a290bc4
SHA512 0c0cfa76e99abd2ad40ac18946572ee519ed03d5b308fd56e8b491dff93cf4a8ccf68b4990518c59942164583b0777331c029a85bec53f17f704ef23f353bb92
SSDEEP 12288:ECLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EJNyBo4kx929bL3Hnx
TLSH
T1414523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8b5e5e3c38e51bf350ab03db63e4e9e61f3c0e2d56bc13d8c193684e8992746d
MD5 bc6b76be408e52d538fcf126653e822a
SHA1 b98a611fdf8eee751397c195dfc29643a86f8b86
SHA512 5c813c3e0a23b5025f8863b345e684edb78eb8503a87534f3b39ca3bbe6169135a170ce3a002ccc230c7e095b071b246cd5be4af912a00a1a8fc710c0d2067f2
SSDEEP 12288:MCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MJNyBo4kx929bL3Hnx
TLSH
T10D4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d02ae07127862b66550f9b1e594e31d0d7a6844b85a79010c45c79e95b32d813
MD5 f0564deb3f0fb76b4a7087d2dcbecf27
SHA1 2e8d5d19f23295de2059f8307c2d34cab812c12d
SHA512 87c2268cb514e1ec2b92d14fc9d06a5a48c1d5ff4847a65c501be2e8df5ff221b15c2b96a979fa36805f8eb36a634c5ffa67ea12b40bde4efefe2f4e79ef4df7
SSDEEP 12288:xyPz5L81LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gzyqNyBo4kx929bL3Hnx
TLSH
T1CD55120773A831F9E17A6234C8960A05E771BC360B608BEF576046772F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 84a358a30e13eb14b593533af620c73f64efe00349bf7f9899c4139dceb36e42
MD5 079111ee90b531676644c92525c6c838
SHA1 b1e3a8da992f2bfa4af399b433811660773e7c64
SHA512 276b925c98d136a60f65d273413919c84a0d174f522988922a73c914f8d063506ff16e890d4c2abf89d6765b5ee9ccb464a330a4ce4cff461dca7832184a879a
SSDEEP 12288:PCd98WYoaLHF3z0z04PDvhHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:aTtaLl3z0zD8NyBo4kx929bL3Hnx
TLSH
T1B16501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 80bb5a94641f6837c806c2a2d914182fd77dceb4699da6a05402efd288d47f00
MD5 f57ea25ca949a90ed18a43bb433434f7
SHA1 9f1e85981134155d358f89bebc13aaeebcef8342
SHA512 dafb25ab2e9bd2086eaf1efd98dc71759d809d7c777440786d8306a3c9a54a7857f7d92e761e39b875fe1687ec52d1d12defbb5c214b6581e11cb91289dcbe13
SSDEEP 12288:2i4e7ARdTfgwCHKy7GLbbdIvQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:23ld9CHKy7GZANyBo4kx929bL3Hnx
TLSH
T1E775CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6b568a3b5a137a54a460c3c0fb52539ab8be740e921641aff196dd9643b83ad6
MD5 8d87eca51917e45d8643ab1af2f38410
SHA1 e3c960107999622a805f0fea57b61049d8106484
SHA512 1410dc64a90f07bf83384356c3fbe3a0680087bcdc754e7339fc81a4520faf918b32c604bbbb83a33125a9b442f97c1f4e97bcff0dc4bfdde5c1c5d6c08b4426
SSDEEP 12288:h3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hMNyBo4kx929bL3Hnx
TLSH
T1B74523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d4a49173bb933b6622497704ab69c976b6eefd48d2c50b048219c4bff3baedce
MD5 a9147955ca289f7b9e2a078f7d8823f7
SHA1 0c3c23c32613fb2fdc1557bf4f1fea012b4182c1
SHA512 9947bdb0b0078b8f648d8351c40cf709aff746a7c1494ed20366426c0c6612b5b9b6ada601a305557d47502401dbb35b467bc04de597a26c3a3a2cbaa30adb1c
SSDEEP 12288:sVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:sKNyBo4kx929bL3Hnx
TLSH
T1D84523125A0C227AF76D3FB0644A8558CC34BC8F1EA597D8EF67987759FCEA24E20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 55cfc2a646f1db4398172d6bf41efa8721f03a6ff13d4aeb6afe0d032abb0fad
MD5 0ae2d96da35c77392cba02ce91c07ed8
SHA1 9ecea8ce7dc5607cda317b8e3533ea5d43f7ebac
SHA512 cdfbf3dd310fd166b2105f2520721c64377d1b21da6bd9e1976741b104328be77103421ce54cd812d8bdb6ddad8013ecd16bde9309b9784f9e4b36fa70b0e9a8
SSDEEP 12288:AQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AvNyBo4kx929bL3Hnx
TLSH
T17F4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 94041b04e6fc7c5b46535697659a8d2578d95fca1cb3fa2655cf5b395e4ac188
MD5 8764553553f1a67c17dc661491407359
SHA1 a3b671a4bc15f49f88ca1d387eff1b0182eb077c
SHA512 80000e88a5de76a59cdc6aff661fd941dbae518ae03041a29df192b2aba04afff0d2ecdfb5a46ba1d85f3e9cf4d71fd14a95c00d089d1dc355556b1376603a65
SSDEEP 12288:mCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mJNyBo4kx929bL3Hnx
TLSH
T1184523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 be3239b8376c4c91c75f47fe0cd3a4b021bbbf00e92f6fb843a8f0e128813b6c
MD5 25a22208c6fa5841e5a62cd9b3aa2e67
SHA1 eaf872ae70db66ffa425134f398ef85bc9fad5e4
SHA512 e66bf653b7cd4db7e307e1a26873396ab50bed9a2041dbdea0af7e5cdc961b825c4e668b331fa8c03e34e1ae84c70fba0204ec47b88215f4dba902232468edd3
SSDEEP 12288:X3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XMNyBo4kx929bL3Hnx
TLSH
T1984523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5a86ec065d60fee64751486e173756955b3e21d5e81834c25e739c2c09eea7b7
MD5 53a9fd0bca0b9dbf252d24a450cbe3c7
SHA1 8dfe25e38c0dafbd18220c62e40bc625f32811f5
SHA512 60bf70ebe1599f33acd5f3cf42c5648b948d10b4207b09440fee323e87494d61ee94749a00a0ce45db1261ee21abbd49819b5fa2540e09149bb9a155156e2630
SSDEEP 12288:xqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xhNyBo4kx929bL3Hnx
TLSH
T1F74523125A0C227AF76D3FB0654A8554CC38BC8F1E9697D8EF27987759FCEA34A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 44ecde71e4284ed686be33d38ac8d035c843fcac1e2873d81a5e9cb82dbab8a6
MD5 55a4e61ec473d9dbb280fc281f9cbc41
SHA1 8875dd899668a6975b2b14889066cb8590b05222
SHA512 c31bc555f18e4a4b5ade64b725c80e1729861e97f5b5a1414ab6891f01c41a6846f9427e2d8b52a037aeac8bf2dd994b595918b5f2e821e81e7f63bf281a496e
SSDEEP 12288:b0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:brNyBo4kx929bL3Hnx
TLSH
T1D94523125A0C623AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 0dbd8be8e81771f378926a628122cb4465f986621e570326503b8a05c18bf344
MD5 254c7ec62a8ee0a3ca25f07b312f6534
SHA1 1e48abd83cdbbecfa308335e64ea3be309bfa10e
SHA512 aa53f759798203805c07b5abd718150f4b1e449bd4c809d5d975bd06d4d84615e33aac298a25c290b35af8000eed516d389f8432134b9403b66a4f6b5a323d4e
SSDEEP 12288:8PLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:80NyBo4kx929bL3Hnx
TLSH
T1524523125A0C227AF76D3FB0654A8554CC38BC8F1E9693D8EF27987759BCEA34A21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 7a1f465aedd4c71087ae340d0619a9ef26283890c3e634ca8acaed92457f553f
MD5 3e5a3d29f43b809a5843a10bae03d4d6
SHA1 58c4a8a41bf67f24553757702086ca1673183ac0
SHA512 5f212446fb35799976fd4939cef8c9d1ccae4e943f608dffdfbbfc200243514e90d92aed72ba55fb5f750f5979f79372a2a5822a0f64a442bc2ae304f37cda49
SSDEEP 12288:U0LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UrNyBo4kx929bL3Hnx
TLSH
T1B64523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 860682a63a2edf576d82625e41f280167f8aba5b897509783be460d189b5880e
MD5 19abaa93ff8ffa3da3a4538e9c1fa7a6
SHA1 b4e2815cf4781c76c47d52ba85d0f8c9cffbcd83
SHA512 eb1155ea4adf1079633eeabe36a3270f11371d9d16e266345899e322192ec40a4d622225637f41acf287fb910b29c31bf47a89eb6f7acb4aabd2484343e19b81
SSDEEP 24576:Xfwvqk9RX6wkyAIVNyBo4kx929bL3Hnx:bMnYICB+kn3Hnx
TLSH
T1BA85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 59bc3f1dbd4700f74f4a60ffd21c971a3883bcdef8314303d64dddf0e6f529c9
MD5 54e5e767a037d5171bfe7d5ff135cd2e
SHA1 797709984064aece5729a9e16c5326295b606abf
SHA512 06d805f09ed6f46a6eb33f8cb9705c1f03e529205b9e14e65515be7adf2bd5671a47a1b55de49e867c4ad51a06b9398bba01d4001cb522dbd0db0b124ae066dc
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bB+kn3Hnx:BySzP1+k
TLSH
T15E066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e1fe16d34d112c9402eface336ceddf060ced617eee10d82e088df7b0fc501d0
MD5 267cf2b4fc2c4583c5294af7571ff998
SHA1 6c907e753f0af43df4aade17715c18619b1227e9
SHA512 69018e5b723e9966ebd5449089327571f9ac32b7d92accb126e7041f0de4cd13507558d01bd8885d3b84157b09e619ca34668a229dded814f05be51dce3c575f
SSDEEP 24576:t47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYONyBo4kx929bL3Hnx:t47JUQjTirIhCnDHUPfF/rB+kn3Hnx
TLSH
T16B65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 129884748e2fc0ab54b3e824f89961a6ceb452f72d2297ef1bb03abd135fe41f
MD5 cdc0a4241647c4d7dae6ba882d4c1cd7
SHA1 fde2f81d19581569a026fb5036f2064ef8dfa456
SHA512 b5427ddcca4e7321870beb5b4f0348642bbd2183a9dcf644a27bfccd41735a01a8f57353670371114d48b0f48c9040498f4385a7bc6377f6fda512f2f75a6321
SSDEEP 12288:8psfyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hZNyBo4kx929bL3Hnx
TLSH
T18D55F00AD25812E8D16E2274CB468A40F7337C5947E1D3CB96D0F87E1F7AA919EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 7de1fc3fe2bc8509ec57aefe8d7f4b0af0c174d94380c26559a8e5db27f44ec3
MD5 eb490b6800977e664e48f20d952aa874
SHA1 304db596536353de427824811e66175f85302c7e
SHA512 761360c4b57d285a187da67da477455de08c3ec7080cf8cd15da5394a04ea3e2568518c84f2222e7277d59b3d59aee42236e05c4765b4cea50de43e2cb2df80f
SSDEEP 12288:U0dSU3fu1LlJR8xMqwrvbQDqAJuNqUy8NH7WCu0+hRBlfiqo6:U0QUPSL4jNUfRF+fBlaP6
TLSH
T172351740B62AC75FC6A984331E32D5CCA7707C41EE44AE0773C9873F857665DBAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 91d10b21207e829d0c40e58f57653e2b61e4e04f40a367009376dae90c91507d
MD5 e7c7c87e256acccb5ee2127d6fb3956f
SHA1 e69969fca2d2137fe3b660028911ccb323ebc967
SHA512 d16b4e743adfefa6a9ace8743c18fcf5afbebc00a8f78d4e125dcaa5f5782d04258794c9f42be7ccab61cd80cbefb1127f8d668b620f09f5eabe62455c76db8e
SSDEEP 6144:e3ESHmfuq7vR0JaxM4/xM4T6NlGgb01muBNdAmWBAurItMxgrItMxKimCSs58gHi:Tfuq7vR0JaxMaxMjb01muBNdAmgs1C
TLSH
T18465D8409137E3CFD1BA603203269B8C7764EC46B6496F26B3C9453ED866B56A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 996128c5dc0e09e7910aed08bc5e3fdf1da851d0ea21f7148242324e4b76f9b3
MD5 0434eb8f00d043948e1b23a363ff402e
SHA1 d50bfcb11fa4ea20deb004e2f00f02681e4f7cd3
SHA512 190e15ca0a149fd35fcf9628b5651a0d5cfcbba7558ea94d3002d82670aa64312e866d4d3f2b28f51776a2028aa944cbfd9cca2093c4473b2f94828be2e54501
SSDEEP 12288:sy7aLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:bxNyBo4kx929bL3Hnx
TLSH
T126452312975C623AFA7D3AB0645EC124C839BC4D0F50D6D7EE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9089de2d0881de1ef3c8b7f37f5284980b5b4a11cad2302b06fa4d7d3479b43d
MD5 d3d8ee0a30b226254a5e3211d8559067
SHA1 6656c2fd7d487232f2b2fee215c2bfadb3682549
SHA512 bdd61b812636298ac5eead906977506e5a73190ff78a891868008906af7a5ee9786ee2b2a356250eb4bce2379d2648171765278c94df1871dcd2b9b5c3274006
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYXNyBo4kx929bL3Hnx:Qgb4mBIBhGFlB+kn3Hnx
TLSH
T17065AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 692afe15edea27854831f667e911f83779b2d18a1c701fa44de5478869a56347
MD5 b9f15cdeb43939fc66f273a5a6da9498
SHA1 e26ad8139c39b677ce868a129a973409ba064559
SHA512 c1943523acc0a60b5a17c3e21013be83b02b924580d02718db1b0eb721f0634017f2484e0ebb61d035325abc27894186ef62c12cd15952192d876e4fb1983e03
SSDEEP 24576:OG88u8FpJqH1Jzria7/meNyBo4kx929bL3Hnx:F7ZFPqVAa7/AB+kn3Hnx
TLSH
T13185F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 747b67402cf60bd566d7e0e9db5c1ef542689587a2103272303f17d535ef7379
MD5 02f355e99b1674054d0cffd1ceef4863
SHA1 1eb20683182dec9aeda5dc2c8927e8cc76492a93
SHA512 ebc2ba7b80a7b2df254b2cb2ae28e18f56b8f70ecec7bc017a2f688cd8fdfba9e3de28066347c42a9f11b494c1e7f5f3bd7205d3834a18871b5290e143c2ecac
SSDEEP 12288:vHvUrBFrEjwaQNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vPUr+NQSNyBo4kx929bL3Hnx
TLSH
T19E65F22F22AC18E5F67AB17C85868609E771B8560711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 349f144cb89ed5f921f0a59651c620dd1456cfe87a1cd412a9f2e28d039e5419
MD5 c8332ce94397202251a98d91307aad72
SHA1 198bd57e6d4d2265dda43dfe349cafbedce5645c
SHA512 8e1687cb85c470d66be774fdcb46a072261c5b88f9c186fe976af3c913f3b954c7e6df95c5b812a688eabcdffa88a7878d4c549f87f86243630297b7cbb9ec61
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhB+kn3Hnx:GG05lO43bi+k
TLSH
T160D5CF6A62EC11F9D1BBD17CD9C6460BEBB23815033456CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 aae315f8c2bd995bac23b1c7888fc155bf36fd80eb5fc97fcf39a87a64d573e4
MD5 07c3cb69dc8bfe969bdf2cfb543f359a
SHA1 7d68277beb46ec88534d5781eb5cad3a1ec548e7
SHA512 0b3c5481594c59e548cdc91009c641a848f21147ddd78272eeac1a8db465724afab846173ce0d71747f2aefe7ea93b56d9589bff69bd4923fbe09a2ccc011193
SSDEEP 24576:efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnYNyBo4kx929bL3Hnx:Ga5POZ3BJt2pasx2+mZB+kn3Hnx
TLSH
T14F65AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1ac769482bf253cb6e58441ee52c8897329a2c41c527c4716714931dbf0d4315
MD5 6e05b7a7c589fd750596700b5ed3cea9
SHA1 dc277a1360fdfaf8e14a35e2cee5cd5f25533ffc
SHA512 6a33b6bfd44169e133208a3d344ddfcdfeff5d300c7866608ec0564e3077aee60cf12f2fca92dacc53773d6ee9ef250e80d137891e964b7dc78677f439ecdb0e
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkmNyBo4kx929bL3Hnx:0Nc/zEOVHFgB+kn3Hnx
TLSH
T164858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7f9f3bc0087e1c415967e473eae668197ba772fd2a457568fe19c71f37bcd86b
MD5 756348fb5da97ce975d648c3370d4fed
SHA1 11943ba0459d544f551d06684c483dc073bf35b5
SHA512 83e68394ce5e3c9bbe5f532a8f72582f1050f247df37c022581baa55f58a1eab2fd1702449e157c005b31ef35fc22485e0a20b358feef142db2e76ee98be8ef0
SSDEEP 24576:4TkNvNnaFeYhJNtmZBm0NyBo4kx929bL3Hnx:4TMwBtOmPB+kn3Hnx
TLSH
T18655AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6d29b042674fa5a846ef48b2e8785180f1f779bb1cba6f541ec182522f1f470f
MD5 964fa84a799b8f7f7423395597134c2a
SHA1 09802d120c59e99c9c824536d9524edf86120228
SHA512 e66aeda1531957978a6e9d6a246151e3768cc37cc499e43332c17303d0a82dc42f7b3e2f5380d27e769645ccb9448b039f288dcae3541f7d851f6ea8effb35c4
SSDEEP 12288:4QcMxWDXN1Dp/fshBItT1IQgAOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:aD3FHshBIYQgA9NyBo4kx929bL3Hnx
TLSH
T18175E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/796-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/796-374-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/796-359-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/796-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/796-82-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/984-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/984-358-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/984-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/984-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/984-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1768-361-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/1768-106-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/1768-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1768-108-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1852-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1852-356-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1852-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1852-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1852-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2456-286-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2456-65-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2456-67-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2456-73-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2720-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2720-15-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2720-23-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2720-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4092-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4092-132-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4092-121-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4092-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4092-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4648-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4648-241-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4648-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4648-54-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5140-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5140-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5140-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5140-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5312-302-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5312-78-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/5336-301-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5336-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5336-0-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5336-9-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5336-7-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5336-305-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5336-77-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5992-40-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/5992-52-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5992-50-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/5992-46-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/5992-39-0x0000000140000000-0x0000000140174000-memory.dmp

Download