29e75b41fe647e6a6a1c325e3acb4ca8f6602fbebd6d6daf682a9b32776ca276

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
Size 1.9MB
Sample260709-l4nwbag16w
SHA256 29e75b41fe647e6a6a1c325e3acb4ca8f6602fbebd6d6daf682a9b32776ca276
MD5 e9f6f48c8fe665dd68845ff51749e101
SHA1 58ea6b7c14cd0873727ddb7a7c19459dd0f2cc60
SHA512 c282ede3672102126678f7f0c343073deaf772be46fe4314f360d9c09804f928e7ee8ee03cab463d0695b372a8ea38e4adcd21e3a9be563291faba96bf78cc9b
SSDEEP 24576:MjI3QSVL5j/cY6Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MjIrVL5jjLNiXicJFFRGNzj3
TLSH
T1F195F019E39955FAE6BBD13CC9A24506E6713C55CB71C3CF03A1195A2E33BE08E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3536	elevation_service.exe
4232	elevation_service.exe
5636	maintenanceservice.exe
2172	OSE.EXE
4184	PerceptionSimulationService.exe
2620	perfhost.exe
828	ReFsDedupSvc.exe
3080	SensorDataService.exe
6008	ssh-agent.exe
1824	AgentService.exe
1840	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\422b3983ce3e03f1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b662dbce8a0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000052b987858a0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c3955868a0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003325f1818a0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e29ab8ce8a0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b95e6c858a0fdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4300	2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1824	AgentService.exe
Token: 33	1840	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1840	SearchIndexer.exe
Token: SeDebugPrivilege	3536	elevation_service.exe
Token: SeDebugPrivilege	4232	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 3640	1840	SearchIndexer.exe	99
PID 1840 wrote to memory of 4236	1840	SearchIndexer.exe	100
PID 1840 wrote to memory of 3356	1840	SearchIndexer.exe	101
PID 1840 wrote to memory of 2936	1840	SearchIndexer.exe	102
PID 1840 wrote to memory of 4440	1840	SearchIndexer.exe	104
PID 1840 wrote to memory of 2912	1840	SearchIndexer.exe	105
PID 1840 wrote to memory of 2532	1840	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_e9f6f48c8fe665dd68845ff51749e101_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5636

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2172

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2620

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3080

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 74d3ea63722da8ee7f18a413072d7f2eb4cd2e4fc7b12b125dbd75838d0a7c92
MD5 be36ae683f5313857b67bb139f956837
SHA1 57da58845add0b7d546facaa49790f56cf836b0e
SHA512 9bec98c09527b29f7efe06d70663df40e57f9911d2510056773b8ae7f6e6f6b4bc6f19f0885fc9e35bd03f21aac4a21ae0a1e949eea4f5490ae10143bda147f5
SSDEEP 49152:1b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrLNiXicJFFRGNzj3:L3q6mjB47wRGpj3
TLSH
T152D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 2f795bc7a75eaabe5b32a12fbb386c880d8cf3348ad69c04cd794a4447ada010
MD5 c742752614e9ba1944bdbbfb411b7e72
SHA1 8127a256554deced07805d2f997e0a11421bf533
SHA512 3893dc68b2e2ca04eba3abfc753b97b0168d740e484ae338a0517619128af853d352dcdd66b4e1e334bab9e9e62056e0b86b1d23e79e4a828d6a7c9df1343e31
SSDEEP 24576:VXYfDtczA8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Atc5LNiXicJFFRGNzj3
TLSH
T12C85012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2fa6975058e8deb0f67fc5238d734893a3727380f3084d1520a2599aa9d601bc
MD5 719c68242318b2591de65486fcf2bcc8
SHA1 923242b8696f9b628e8f7e0f3414746734081b8b
SHA512 91d97647b136ad9311c9a9b19c08df458f30fea68525c856316b166c71abb809684e14acc685c8601d9dba6936c94d699f01fc0eb6ee0de98469f21d4d5d8bc2
SSDEEP 24576:i0Le5ji0hmxhrMD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iPji0AzOLNiXicJFFRGNzj3
TLSH
T1FFA5AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 57ed83cb90acafca3c971fd5c27ebbaf5ab20a6e0e36fe815cf1da282f417dbc
MD5 25d8a930aeb4a2063469544206d5d84f
SHA1 3e660e9b1ecc65af4cd21a3601844fab76b7e9bd
SHA512 94569bfd618c95c926a68352680fd1891226f97e2a7058e36a3ace504a8d53b7f0668a160451c8804d73d29bda313a96ba8ec1d5fb927147955c7fde836d7883
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWj6q8wyuJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z/ezSC6vUzPv+HjySLNiXicJFFRGNzj3
TLSH
T12E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 20fdaf9332eb407ab7c773accff4c785f4b1446fa1decbec52c6ee90a65cbc9a
MD5 3ddd85796630f47fd5fc148fcb08b5fc
SHA1 f649de8e57db0c5cc7497de251e6d7e0f369a4f9
SHA512 9d58ea1ad4611409622880f70355d6cf61904d52951c1e4dab3dee065741ad07a8d6ad274bcbd541393c3b7f2a1408e1c33c1ed33b1d4e79f7545a8b6fc2efda
SSDEEP 24576:OVbqPb88hv/l+BI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OVO88hXl+uLNiXicJFFRGNzj3
TLSH
T169559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 59273c822e9aa50079a4c93a7fae856e98586ed85775032baa76334f59f5f7fd
MD5 e9dda3168f9078648875db8ed3daef4e
SHA1 3e472bef80674b5a78c38f5df7e686cde8238509
SHA512 be5911126f8636acad05acfd338e5c1c8965300cb30c17eed77e72ca1cb96a33e3ac86396b236e5daaf337114d7b66ab0e90163b96efe936cb0abe9de567654f
SSDEEP 24576:nGf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eLNiXicJFFRGNzj3
TLSH
T1BF7523D3468855B1FBFD003A867A5828B5845E2CCA5A5DE2D2543E5E913CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9c5fb1d75f08c4535cfa163ddc43ffe251bcd94e7041899a3f361ee79e4a4922
MD5 99d1df5c925a5cdd4c1b8d0e92ef6a80
SHA1 e8cb66c167e4bc0aef1e9827cc23f7a2bf31c8af
SHA512 496cfb489e0c7d7ac1b360a2c736cc088d423a18ad4d567b0fa5924fe4956428e530868944cc8818c5b73ab9fcd535acbcb7a2be1e72d7bfbd06d3cf59e59c44
SSDEEP 24576:JJIUg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JJIUgLNiXicJFFRGNzj3
TLSH
T11C85CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ca317b6b7a9ae4c24a1081c5f0aa87e632ead3d56c920374c8f04fbbc4a4b9d8
MD5 7b5d1b9ab574d4f1624895b9e0cc1211
SHA1 647ef05a41faebe50b93958d1dc48894c0360113
SHA512 56d0b1e8ed84dba62fae071156aeb0697f115eddf805ff5f410207de4ed7fa351de757f49ca51d052326d9edaa2d16762df60fd1c3cd9a3f7ac3ff276ba97d21
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THe:nQvGAdlCEL8c/WRNw5CZ7wRGpj3
TLSH
T19B266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 9f1510fedbff55a61edd05e4a21ca974d1fa4fa57798810be125975443d0278f
MD5 b82643a6bd37e99ae483d9eb73f4fdcc
SHA1 9939f88ed663797cae20650367dafb000392573b
SHA512 85c4d18cc69f2eabc3e1028511b6ae8ab971da36f046ae19e73515e9af429f5007222fea3ed9435e65cc7937f0a54e14ddd5592e7eae532ce335ae5b23f1bfd9
SSDEEP 24576:pfewsAje/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VljeLNiXicJFFRGNzj3
TLSH
T19D95E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 60ecc94b0f7a8f134e56a0ad3407ecaeaef2964def185b7fd482c488991052af
MD5 5a7f3ae9d0bfe1d698ea6a348c71d932
SHA1 71c76b5903af239f110c2b9db8eb1ad33923ee57
SHA512 f181d29967345fa0e2af974b66fdbf81556a6d9aa291c53666db94d836626db1bd5338bf54e8977156b23355a5d9f6f7721cfc2dbfd021845f065d849c7804e4
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHqF9:xUEtQevvqc2W1cpV20I32O9
TLSH
T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0b5a11b03954bae18e32e366f4ffe85fa30992dd4fbb09712ba511a5ed5bb7de
MD5 460580f7dc36e0a665d6d6b5df9ff8df
SHA1 514aece9d97c182d3b83169a9b791b3058ab66da
SHA512 f06795545479df635948bbc625e4d5852d0b41090d4e0175d996f5003478ba9247bed40146b1028af58bd82be9e7a170733cc26d8eadacd5b0bd333905698560
SSDEEP 49152:sCbRquA/m2yL5zLfFiV+XenmE3/z+LNiXicJFFRGNzj3:Foq2Vjnmt7wRGpj3
TLSH
T1A0D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8e80cc708786326a22979097338e5ddf9ef50f9634c373d6b810aa1e52419bf2
MD5 f16c5e12236816dde3a3708a55375ae8
SHA1 5d90f6237c073ba9eb50f6312bea77d675144cfd
SHA512 4ba6db15299f8f488b80ee490c0395b61095f6f563e3dc8b2cf914484477216b507bd7f1b5f641fbff03aaf18a9291cc23ac16c78ae044b4bc7aeaac0dbe07f0
SSDEEP 24576:vAhGL6IFoiwtA5l7S53N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vAM5Foiq59LNiXicJFFRGNzj3
TLSH
T12E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 be132ebc7718080bec623593f9b7f0629f8d114f8bd45a6e8682b26b5643f748
MD5 e94eff1af8e132bcdc034dd18bc9cef7
SHA1 a5a1c44a012314af296a1e1a511999c426c43db8
SHA512 278e852bae7c22a99326f4d6c46b30091e64c41816fb858d76ddd3bbacb5e18d711a8a91539561411d7207537a1378f2294e51dacc553d6dce326e863a37e223
SSDEEP 24576:lwuROWy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lwSOBLNiXicJFFRGNzj3
TLSH
T19885F18632941CF9E9BA41398657C036F7F2BC152A21DB5F4360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 578d0915dca770c02dc413f4a5545b3c69d8c3371177e55317d3da0ba5c72dc3
MD5 79ea874e386e9160ffc1bfc89028efb9
SHA1 0dc65c0f08ffff21fb792d67613f000ecc07a6db
SHA512 3194b71d92839b49a92073c7796510133959297fb5bf716e3999e43418d49fd521cfac879e842e434e1c1f485eb87309e4f8cb42e0b64447ce01113a8e3e9a22
SSDEEP 24576:VZu7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0LNiXicJFFRGNzj3
TLSH
T19475129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2f5467c843eea17b44f70e923a863ed3b70af85de7b16e12a9c3ee7d1eb453a2
MD5 5b59acf9e1814794e26250be8dedae43
SHA1 810a6b8c76c63d35880cd842b6b97352954cab3c
SHA512 66deb4d5c4da7fa2269765b1d561047aac4edd33c994502578eef47b2c103cbe6ed4aa3821bb0921c82d5dcee84ee5a99a0fcde0bb91089a3e1bcaa0cc8cb909
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3U7wRGpj3:kQyiKanX+PNQF9
TLSH
T133667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a0302edc7f250a64ed21697e06074b42d186214b926b9ef56598d3c83d44b3d7
MD5 ef3d41e73e299597723b8ef2e0bf2a7a
SHA1 6d72ec110cb5a23389e7f3d9eb3c6f9e7930aff6
SHA512 9352bddb47627ceb583f9780f65b4901eb6d9dbb7620611ff49721d035a6c1b8aaac8b1eab6857fc2f4aa32639a2918ecbd1319e0752e9b3302555279bfaabf9
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3U7wRGpj3:pQyiKanX+PNQF9
TLSH
T1B7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5ec9baa362777a94daaacd94df81c1c1bdba34e4a9ffc2a5f3c6c8394c0813c2
MD5 6b079cc876fd286358a40151129ebb6e
SHA1 9c985cac778cb181cba4d1b83bb7c4c80fef042c
SHA512 4055c2318a049de0f06743cd8655a1af7eae32e86b88b90aaa7620bef755220107a46b82ddc57a3af08347f3f229543fecbcbc5e076769a4dde44a00aea53e5b
SSDEEP 49152:h68Qg55nhkeWu7PNU3/OLNiXicJFFRGNzj3:fthTRc/O7wRGpj3
TLSH
T17AB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5c2c7cf15879c4309c8690afe19cbcbd34208c4edd892094a70a623edc822d3c
MD5 bc44daf4f1bf942a8bf962f6fe03c686
SHA1 c0ccbe668b19941a82655e506d4a14ac28e0e5d6
SHA512 440ef5b8a976a24d2cd4f134b3bcf384e9acbc1d98c0715e0bf6cf594b80f2cf73dd03f675f32921c5bbe76e83fa1b5d623f51428511c8f8f33555fc56d25d6e
SSDEEP 98304:yy5112gYy5azzVvU69nLKnhZf7wRGpj3:7LIHRWhpF9
TLSH
T1A6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ccd88af606acf93b21b8b1c22607d7ae324595d95c7a2e8f5dc3cc79709cfa2f
MD5 c417654a6882d0229b8b930f150cc2ad
SHA1 ddc16c412199ce9eec2db033a7c517e7c80d8072
SHA512 d8a5fc7aaf255205ef1b3aea3789c3d9badfb97ad0b97f5a96a5f173d408083579a7dbded3d07c1dbb051dc95c19d799d0a23afa35c5c08f22b2621943a5bab2
SSDEEP 49152:+B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsLNiXicJFFRGNzj3:su6JmIxd2ds7wRGpj3
TLSH
T1F5D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c4111f85a7720c507f897513779d004c96893d555c89e9327d1dc8fe33ff561e
MD5 70af462d5c5daa2103f764b156e1167f
SHA1 70e3f2d25254ea26e7ea276746a63eb72216a3cc
SHA512 ab3e32c228efc5f49986dfaa220ee689ba0e8ca1cf208d383c99ac4cd97cadb41ceef8e47306947754531268d3ded1f3ba0d275574a9faaf4368aa84c23abc49
SSDEEP 49152:R1hpsNoJpF1A67U44CwH7R4xALNiXicJFFRGNzj3:RmifPqRt7wRGpj3
TLSH
T131B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 36511e7c7d2b9880591e4e75d1b160aaca563b94cca7ae154a517b6da3b5cad1
MD5 8e48faff77241feb398018b9d829d952
SHA1 085af5b487809bed3fdf745c706f23c4417a84ce
SHA512 fbbaf4a1064806c8cc2f5c1fcf5e49b707ea8df4a6e8f7008fd263f18ee52e176bba2455626f8c3768ddd68ed396597a191e11258265f2f0fe897501ebf8164f
SSDEEP 49152:eSuZQIY0Be2KkRVtOnks6NMHq7LNiXicJFFRGNzj3:w5dKqi6177wRGpj3
TLSH
T16DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0c981ab152ee8c153a66e71e20989ee8455b9f050a34c4719d2365b38ad95eab
MD5 f5cb72c9f79142bb7c1d1a5165dafae2
SHA1 17822b2d381e27aac427ad3a337bfdc5a3eafab0
SHA512 911888b2faf6f23d659336a1969c29018bc5b28c4d7a5eb223516ba00712d3fd5482adf038a5357b0916ff805b85254bb00fdfdaf37b8a114f3ef394bf05b115
SSDEEP 49152:KhtSn8EApI0figjgiDn0AP5w8LNiXicJFFRGNzj3:rX2iWphh7wRGpj3
TLSH
T18795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 b0643ac3f99eaf5a05ce7a0afeb061ee1cc6a9ba4a90b9e7186c6899fc30fefe
MD5 c258609c67a50720a28490ab4e196fb2
SHA1 891d1047029a4c676aecd4e69fc2ca2605bcc31d
SHA512 d0c9ae9704b9df1ab23daa6cd4423a06ba599847a9c87b89c805db4236b74b261d13e54c3bdf3a6fa7a699d52197fabcbc95386fcc42bbc0d837ccf7c1eb41d6
SSDEEP 12288:tDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18E7523D3558955B1FAFC003AC6754428F5882E2DDB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 4845e54057f2fc3a484251d6920691109dd47f8f76806eb12b6d8a012e817d76
MD5 30c9c726525c469e369907dea9b56f9b
SHA1 291928e04ee18214ea0143ff87a29499d4051989
SHA512 6a5e87401df0adfa32e4ef60e59bb01235499fc439328119c1841d3f5a2c2e8f438c93c10b5761eee7a8b871e0cc18d9f7e2b349ce9c9c50e33a71c16fd805f8
SSDEEP 12288:4IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:46/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1927523D3558955B1F6BC003AC6754428F5882E2DEB5618E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 2b4af9db93063c3257a975d05085cc2b35b3ad42b2eedbb62e233c4b11fed38b
MD5 5ccafd70f4917238ba36360ef8095218
SHA1 0345448b611cb6ad9ef64d9c6558ed7ef074c476
SHA512 63f4be23d8d996302330e00bdc2e5169bea803578f094e164ef344c3f5d09e79ce82727d563c80d498273fff1b57038c9a3f402891c10a314af09ef63bdb7074
SSDEEP 12288:4OiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:44/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1347523D3558955B1F6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 7aac5667bcae6c534d254e1cc270e0fdefe49dc1e0df8cc9b557bf17afc87d25
MD5 6c8c11ec8a1eec290bdd84adcd5cf2f3
SHA1 32e637afb2855ee70a62ff315099c4e97d5b1795
SHA512 7489b7fc7e4333a0fbcb322920655f5e3e397ae571e51f70b11e0705f464d572032cadc273f7e6680f7ec2dba1b904a44b571c847356efc10f514a95e34c8411
SSDEEP 12288:EVBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T161752393168910E1E9FD8039C6764424F2A47D6CD7325AEBD3003D0E5675FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 9cc594e056f04cc377f018a06aa710467087828deed858cb8c13fc1944d897b1
MD5 ac6497e66690489b0443931f29577410
SHA1 d829a0bfe0fe780751ac614e97e89d8a05043755
SHA512 ad53a5ccab504a193095e10a328cc7e4030f410073931083abaaac1542c22bcb9a9a608534fe42dcfd3b8c9c5784bc28b1128655bbac453ce7700384864f52e9
SSDEEP 12288:+piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D7523D3558955B1F6FC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 eafb45d29eddf2da432811d4afad259a9aef456f132cd9666c043d254ef7020e
MD5 ec6a8c355a0cc033e184524e0068fe14
SHA1 948f61724efc23f9613508826edfdffcfef4790b
SHA512 add8eb8dd7f7b2100173c08f877cc584a742539b1a5163f74a6b9887b16ba4c02ce1ec614892ae6e28d9ecb3bab69b1285ff0b3abd0013ce5a4a71e94adb7396
SSDEEP 12288:psiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E97523D3558955B1F6BC003986754428F5882E2DEB5618E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 ec1e5eec519b394effdea28bddec7537410c135bfd40b9180f4f0c2b21a22680
MD5 2e2d0002fa238319e215397917c8fa13
SHA1 11102c1f6480f55453d28eedc29edb72cd3fa3ee
SHA512 c5adceb2ecf6b69939cef563feb80061827015f9133cd42b382250e3b893b54f54a354a54f7a17e6d65b4b9713b7106ff32c8903d15c35d07266542f724949a3
SSDEEP 12288:CwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ci/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D17523D3558955B1FABC003A86354428F5882E2DDB5659E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 24d5f008bf5a4ebb323bad72ff688e00cfab125e43f42a31fa764ef337031c66
MD5 a3ba708ed0f38c2c0ae05971a9916add
SHA1 f1f547703c1b6ca3f910b2d126a2780dfdd903bc
SHA512 c0b2d5357a8e8fdefce6793a9ce2a1b411e6d7b24d4ab85ac5b63004e3c42a36f5471fe9bacc8d5a1a8cb7c2ed96b1b69b99261cd6a408b7d561dbcc0407c796
SSDEEP 24576:iZM3zFVSOa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iZM3zfmLNiXicJFFRGNzj3
TLSH
T1CA850295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 cc63247fb70ea846382bfe26558bbda5b8ddee1314c9bcf22d58199e00133f42
MD5 754d18fec4d86b687c65b97b32b07506
SHA1 bee9cbf085ac5aae97e3f3ea63d33e7f77863ea7
SHA512 7d679c1fc4e6341a12206bdc2efc74dd6b410679b412fbfc415b7f8c750c8b73ce2666b8748456fe9649f78135ae994ee16d38f831144bccf9709f854a6be587
SSDEEP 12288:Q/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E17523D3558955B1FBFC003986754428F5882E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 aa784acf915bbfe7addf208928f3e0a07e146e14be5d564b0c286b689a7cd542
MD5 78e5346d1bad989c23f8ac1d8267c667
SHA1 f87faf6a02b91aed8268bfc9283c4a503fe5ecca
SHA512 c94e51fa0f55fe6afa59d7dc88e282bec81bbaf5788e601a2fbf3a8785f18edc25ff92f68c4741c56dc2d147bb18a57b980fb4e187f8696bc8ef76dd7663b7c5
SSDEEP 12288:B7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF7523D3558955B1FBBC003986754428F5882E2DEB5619E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d8dbef044788a842c08b9a9fc3155cffa8e47cc91d8b6054389f4aab362ef16e
MD5 50303cf1e1e973d1adca8a2738fac182
SHA1 73f753786317e78ee59c7c71319408bcac5ff8db
SHA512 7099b1eb1c562944442603674b22163962b828bfb71d29d3c1fc87e736d8613e058d546802151c061f00c04e066262fae541207d59a223f9ac38f24c70f66aad
SSDEEP 24576:izyu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ihLNiXicJFFRGNzj3
TLSH
T118750247729530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 ab6b8459b754a7a6f02aa42adc73d7eb20fb0fa035cbfaa4d30a2f5bf6f7616b
MD5 86c4a20dbc8e851152b39191f41b566c
SHA1 deb553b7a62e6ad46964631bd04e3f1affb17b73
SHA512 1256dc44d711d944756ce0e1a516dd1cf819c9d5103ddb1aefb582bcdadbf39b97f73421d7803aaf017bd5819aabf1a9f62f602328adc8cbf9cf8af691a3b457
SSDEEP 12288:S/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1527523D3558955B1FBFC003986754428F5882E2DE75618E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 a016f7af4c368b41c6abfc434cb9202246da69f31cef00bd8fce953299169c83
MD5 fe4778bb645c9e0c8e476c4de9f0315d
SHA1 03164eb45b5138b738a87293e221f440b1ac9518
SHA512 ca2d7056428bb11e439a4b408e84ebed554ba29c818c13c25a5a36f154a168c40941fcce68be5fc87c3a743cff3ad2d2a383ccd613a1b0d6c9ddea5835bf70c2
SSDEEP 12288:6/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB7523D3558955B1FBFC003A86754428F5882E2DE75618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 20ac9d0a75d73c15dd984ac6ca78d447b4c55d0b2b765dd9877dd64db56ad290
MD5 31e5eb7d3b68906c6ddfd91bad38557c
SHA1 b8a6045a38b3755f00706e915619f32141fef445
SHA512 2a0e0f3519bc3070ec1a1b6eee52b78b3800d85e694e4d7b83248c18469c579b8aea9941ebaab04870113db6fcbc6909e55875ff4a39613072502509f89b06eb
SSDEEP 24576:0zyu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0hLNiXicJFFRGNzj3
TLSH
T15C750247629530F9E17A4139C9620901F3B57C3647208AEF5364267A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f1645d45911bb27918f5d45497783faca791478b128a4a538f670e8763ba1fff
MD5 de75ffe1f9fdb223c632c6aabac96161
SHA1 35291161fc28a1cc0918f3669ab802105df5c6ad
SHA512 0e2489e5b3d0761d1ce46b0358a371514dd7d7dd59c477dfa8095a213d9f194fbf68c11746b67edcf422678c60bca5e366422a32aa45fcc663cc86fae80fb9f2
SSDEEP 24576:LT8aLl3z0zDo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LT7LljJLNiXicJFFRGNzj3
TLSH
T1798502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 865e9b9fe7213dd12865b637fe651ba2f1a4a397c1af9aa9de84322b0dda8e31
MD5 4c80f910d612232bf2ed38f62fad5db7
SHA1 4a23a7485c83441a3dacbb3e5898a9b88e4be092
SHA512 3113c0845cec4c2efd1752faf514affa5913bae1451c0ac004cb4a8b33349ea0e1c753662e6aebb1e8de707039c129ce018a607d703e310ea73ba4e92d7ea735
SSDEEP 24576:l3rd9CHKy7GZ0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Frd9CHKyamLNiXicJFFRGNzj3
TLSH
T15295CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 f6c48ad1684a1f90c9655b30151efdb9d3ed0509ecda7f89ebd30259e9755ab4
MD5 9f9a61e901b6416d6afe3ef92da6f440
SHA1 9920d52b42203385d6fab0f1535999cd21180505
SHA512 b1ec5b7c3146fe061a023059b19c6946049492fccb44fe40fcedae89015324dd9f280e57834224af20b87586a92fab63f04bd3b00b073d591e4fe803fa2193a3
SSDEEP 12288:suiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1677523D3558955B1FAFC003AC6754428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 a409883d5fe730667c7aa5f8e96af39312c624a73ea8de39f77ec32db607558f
MD5 d496637d4dad559197cb16e5dd35e495
SHA1 17209d79dfb39232b8e455abb7dfae7670ff3b7a
SHA512 89fb227984a78ee0c309d3fdad810d9379f017849ae03ed3a594c41eac77703ff78d43c81b889488da99d96977dff3d73ff36c93b43270815a7714d8fe1c90fc
SSDEEP 12288:3EiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F7523D2558955F1FABC003A86764428F5882E2DDB5619E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 a543602d6d349b6d45e63a871cea22570b6cccd27f953ca110c93beb8f66e3d0
MD5 1ef14d742307fdff154297f9a4ebc6a0
SHA1 75852877838b46923e79ae7b032508e13aebb45b
SHA512 ab0b1285f014ca40cfe9126f2d0830aa2522d0888a6890a4ddd692a761fb2360ffe86e4c7df1ea7cc09e373fd6fa4bf64c35d4dd7d08d554e9b5ec6ef0233fcf
SSDEEP 12288:ntiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1307523D3548955B1FAFC003986754428F5882E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 8ee4f91b708dfc45dc7105b0b6e05934703ade9e63f1c1af79e6fbccbfa657b3
MD5 6b667e98111b55f07f517e38594060d8
SHA1 8dc84176a4c24e06492cc180d1c88614412dbb1a
SHA512 7a7b3f932f7aa011d98a9b08cfb7105114cc473811a0830de8635198f9cef10f279716db1c5882214bdc9d17fbae5efc67abec5b4ff40055b03ef8e9859ce14b
SSDEEP 12288:N/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A27523D3558955B1FBFC003986754428F5882E2DEB5659E3E2483D1EA238FEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 891016a33fdc5d42bbc2b05683bc1be84d29c00d39305f59673b14378d2e7b0b
MD5 9dfb8f592e3731a9ba949925373de592
SHA1 d088679a740c49d5967f020c9a24e7ca944b5363
SHA512 227d5ea83de2253b6b58e47d8dac9162ca76e6cf7f0545629da4dc6670f2f99b6923d8bc02068a2c163cc283e14018ba927fa18ac381140ad8d03f69e95cb675
SSDEEP 12288:buiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1787523D3558955B1FAFC003AC6754428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 395336df909c75e216b49d5560f9897e408c709a646fcf802095db519bcd4021
MD5 283dbf5ea240e8fa9ad5babe8d8c85c9
SHA1 f3b4b816f493f34ad212537170548cd33ef0fa33
SHA512 53c4e1243b5e9220246c6cce7fabd4aee14561d0273de2229b3bf4283c357c55ab7a7c2f24e2aa63a9f846aec71d611b7032c42de72456b58a97f9aaa85d2841
SSDEEP 12288:FHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A67523D3558955B1FABC003AC6754428F5882E2DE75759E3E2083D1EA238FEBCF38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 3c2abca7c25c48cc196ed98305061565d50da7114a007ba93d52f8f14d1379b7
MD5 5784e2a4f8fac4d626b4ef1a915367e0
SHA1 2935ec3e4ee89f19f8f1cf0abf4d37af5087cd2c
SHA512 3d27362caf1e9e0640aef922af29b6e0c66667025a4e579aabba4f9b0c0b4becc6f23136e737a3b5a49b657607f8acbaf51e6069b3dc575f02206e3b77ceb7c6
SSDEEP 12288:QpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C7523D3558955B1F6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 cab9a7c99ee8a1ca76e71ac3fd394e98fe51abf1e4884fb7c829133cade550a7
MD5 c9435ba94f3f6636a14ef2c7d3a2bb1c
SHA1 9825048092254bc5439bad7ab1991fa32e04a436
SHA512 0b9f20cd7a42911aeb213c537c8dbcc931c2518a36ed34c8c3aa3cd3eaa7dcf6c817204e9833e62d92aa0f8ce10f5f0a5c1c9a9ddd2fbb8452159838eab7d3e9
SSDEEP 12288:eGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ew/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF7523D2558955B1FABC003A86754428F5882E2DE75759E3E2043D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 1332d455d153b248ceff01ca4f0a6cce70af537a0a9b369b302056f7e41c8eda
MD5 9848ef25d876ab3ac460d9f6f3d09918
SHA1 6de333a676ddaf53a7f7d2034e1d7734fd0395bb
SHA512 5c554c08f0aba9a2bea0333e83e1761563b892af85f42d049984c7e70a3c27814182bfc13cecbe0a0743a052b529d88edd8ddd9f6263da42ab81ed7d75429599
SSDEEP 24576:nfwvzk9RX6wkyAI//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CMnYI/LNiXicJFFRGNzj3
TLSH
T15895D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 90c4b73aaf286ea40c394f7f0b01c653fb6ed7eb5b207a89c3dd14aaac106696
MD5 a42b913acc252861e08a40b0c86e3dff
SHA1 bffb4bff6947e1ea8f7bc841fb6f9505e63873c9
SHA512 0816c9aa95f94285e81418b287cc1366f84a963b3865deaf455df2ed32bde925a77a1b854f144e554e55547b12a7c41b11e8c18f0b084335cac82bb6f46e8ed1
SSDEEP 49152:PYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cLNiXicJFFRGN:yySzP07wRGpj3
TLSH
T13A066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 df72cf941439bbf0fffbc0487491f20d694cd044ad88031faafb132713688d24
MD5 286da22dd500f057a312a1ab1ffc5a26
SHA1 8a3061095cd08a9b9540b9db8ee1d8d9f8b3b451
SHA512 13951346857452e6360c1d86faef1612cbd74f2fa77c8d0d10b488b23da9dd956470b56d0fd809475eb8febcc824a4dbe64411a3a71231c36389d4b0b7617b26
SSDEEP 24576:l47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l47JUQjqirIhCnDHUPfF/sLNiXicJFFS
TLSH
T1E465AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f9afe87394840284a471906a1f9d3f8d3105701fba085676ed3777522cfc184d
MD5 b1c0686af1b1cdfc39f36476ef4d7637
SHA1 7edfa72b9a3f257c5f12f4115601432ef1c68f9e
SHA512 dec53fdd4626419e51c74cc90c8d292d815709cfc021238d5a54847d61ec0269bb44f5ac28ccdaac23a8fcf8411bd1a240aa924b6c9132a77c130905de20905a
SSDEEP 12288:1psfPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:W7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB75F15AD28802E8D1AE5139C7564900F3673C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 58faad5ca4bd5b04563b8b2a2d5b73bf7917baff50c2085bbcafb9893b17a419
MD5 c3197dfd37d257d0453ce6b5ce287efc
SHA1 bbb89ef51a884705876748f707a0301c9627bc1c
SHA512 c30182f4edf668a7cb9f7073c7549427f2beceb772d28c88c7c5b9bc8a63f8a1c524c55339419234a4db850ab7070ca555a3d8bb3aca7e9cc2422616cf69c5e4
SSDEEP 96:Y+LRTXmeSpZBUllnCllhMLp/C59PRpZBUllnCllU:xlT5SpHUllCllWdShRpHUllCllU
TLSH
T1C0720011FBC8F420C8D20236EEA4F7EC7B79F4641D60075776C5626ECDA96D94CAEA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 b32b600b66812f6bb952083929dfffb101301d619b7edb6f79b8125494b23033
MD5 a1ee20192464aee81f81dccce50df73e
SHA1 5c9f656dddcef16b4071a8cebb2cace6d2da3ffd
SHA512 7304e1afad9e95a105c8968d8a669868d9815585f6a6cd312792104fdb1fa9f25a51838f8617897fac92e5ed72c2d8f79e8b0efacac747c99e2de68a7b99824e
SSDEEP 12288:TF7XiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T114752393528859B1FAFD1039857A8434B54D7E2C9F1598E3E2043A5EA138FDACF38627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 93c135c4837f7ac2022cad742165909c20cadfe4bb02ef81dbaec03138d6553d
MD5 2b200daaa3c4e5e85914767c8464ba88
SHA1 7776c2c16033e90d85d2b5c8797feab5d6829fde
SHA512 6401202fc3e3339c8adfbd5582ca6d5b76dacf45af331d50f8a5733d1dc62fa8252a5fac900c5351126abe6e9f201e4bf779155a4635d27bb336f63dd8d99d71
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cgb4mBIBhGFqLNiXicJFFRGNzj3
TLSH
T13965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 1c7888373c53369edc2ceedb526837d7ec9d4dd5d2bf5d5973ff5974dc9cb64a
MD5 925b8c016cae33e5d91f7443fd20c489
SHA1 37f3eb8e95a802ed37f771d27edf9ad0f1045a21
SHA512 3ac8e131ba5b4eaee4fc4a133b572e4c404a162fed092d9f9b0bed6045a10d6b14b665f53231cb46af05062e7dd4ca9d9905983eacf606c6063ca9762864d7dc
SSDEEP 24576:8G88u8FpJqH1vzria7/ma/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/7ZFPqVya7/RLNiXicJFFRGNzj3
TLSH
T134A5F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 aad416c5bcfc09f3f88626ec9a8ca6640bae1afa3a7cefd86b8da501921961f3
MD5 faf362fa452dbc31746d1b0f9aa6c5fc
SHA1 bc0914c97f2aa728f08126fb768a7216c65102e9
SHA512 923103f9dafc97e34056aa4db89355d811f7c302f4a66989ec9dab78136d195b7a3616e6b97596583685908ee0af13a3fa6b254c6645adc18dadfeaa12961f02
SSDEEP 24576:tPUr+NQm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tJQmLNiXicJFFRGNzj3
TLSH
T1AE85F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 23c4b2478b97ebcd4685d939f645376c61c82ec464d852d2809e32d2aad1ef6f
MD5 f96c54983815352626993a992d0089a1
SHA1 1e1e214742fe3a96cb83263322b7c61f23aef738
SHA512 094bb216caedcf47c653ba567443c36385789eff690d56da2002f652153fe09f362047a8b0388dc723c180da042d3836f6a9c21ab10438e6733c1f254b6b09c5
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWLNiXicJFFRGNzj3:GG05lO43bH7wRGpj3
TLSH
T109D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3ed70feb6cc0263273e8682cdac2849b873888c7b2fd9e5872a41eda014dc215
MD5 32a651a2a8ca11e1f8ac270542991580
SHA1 cf52953f7031e5617dd2a26847281da0dda2f387
SHA512 83f86671b77d7f286d5055e985a0fcecaf59eb69effdddd4d6fdb9fc63c160edbbdbbb338076a14691d5c4fcfc7c1babef490f62af214253ef73320dd0286bc3
SSDEEP 24576:Efa5POZ3dpyWVM50JicR2hG0lasx2+47eidnc/TwSfVcYG3K/cJHlnFR+IGNe8jg:ca5POZ3lJt2pasx2+mOLNiXicJFFRGNf
TLSH
T17E65BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 76cc2afab7e669921d8f9d1f81ee092ca7a3fa7a18b3f9c4cbe6d047631dcb92
MD5 9b7ddcf26bc229c7b2b64ab3bacc7d0d
SHA1 1aaea54938656f78163007869a4bf5551afa2fcb
SHA512 f8053e8057ba7886823ef90c12f7804f97204db5a39f58e1c75f305745fe970a468e65478dcd37a10f6e5b696b1ae9acb27dc9ae445c3cd07ec819ae757165fb
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1Nc/zEOVHFxLNiXicJFFRGNzj3
TLSH
T1C8858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb36266c91e3ba2d17ed7c2ac47fc313d558cf6c618c058c4b444c45686b4644
MD5 cf62e7df0ccf20b6a43f6beacfeb9293
SHA1 506f876200e630daf8095ff42974c1c50edcaa73
SHA512 37786cab18a70b4a186a01a81299ce739ca357cd296331c62636827921fe19f46841a762aa2b7793539e0470d0ddab7c3c5aac4916daf9420432efe88ec57a80
SSDEEP 24576:gzkNvNnaFeYhJNtmZBmw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gzMwBtOmwLNiXicJFFRGNzj3
TLSH
T10955AF6EB6E806E4D1FEC675CD238512F6727861073292CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 50d5b2f57288538a47bbd793b974b34682b2d6e7acf7b024e777562eb54878a0
MD5 b987c0a98004410960c27a6e4fcba46a
SHA1 a9ed7bca9d5764f84bd479fea4bd445b2561e629
SHA512 3d43932caa7b2f169f5edc326135b54fa9c8cfe7881ca7aa73f64c04a7144388f19720e8c7f57da9c69cfba89cca7a2d18fba8801c97dfbef7ac25c195ab5bc7
SSDEEP 24576:GD3FHshBIYQgAX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GDVHeBIAAXLNiXicJFFRGNzj3
TLSH
T16C95E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/828-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/828-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/828-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/828-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/828-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/828-383-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1824-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1824-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1824-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1824-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1824-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1840-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1840-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1840-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1840-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2172-54-0x0000000140000000-0x00000001402A6000-memory.dmp

Download

memory/2172-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2172-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2172-270-0x0000000140000000-0x00000001402A6000-memory.dmp

Download

memory/2620-78-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/2620-77-0x0000000000400000-0x000000000066E000-memory.dmp

Download

memory/2620-83-0x0000000000A60000-0x0000000000AC6000-memory.dmp

Download

memory/2620-311-0x0000000000400000-0x000000000066E000-memory.dmp

Download

memory/3080-108-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3080-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3080-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3080-314-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3080-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3080-102-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3536-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3536-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3536-14-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3536-22-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3536-21-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3640-404-0x000001C626AB0000-0x000001C626B5E000-memory.dmp

Download

memory/3640-373-0x000001C626AB0000-0x000001C626B5E000-memory.dmp

Download

memory/4184-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4184-296-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/4184-65-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/4184-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4232-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4232-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4232-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4232-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4300-1-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4300-319-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4300-0-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4300-9-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4300-7-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/4300-87-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4300-322-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4440-405-0x000001C129550000-0x000001C1295FE000-memory.dmp

Download

memory/5636-52-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/5636-49-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/5636-46-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/5636-39-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/5636-40-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/6008-123-0x0000000140000000-0x0000000140315000-memory.dmp

Download

memory/6008-120-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6008-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6008-317-0x0000000140000000-0x0000000140315000-memory.dmp

Download