963e9c355c9e145af6650a6699c31aaf1012f67428e9d40616fde56aecf442dd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
Size 1.5MB
Sample260715-l3m8dscy7z
SHA256 963e9c355c9e145af6650a6699c31aaf1012f67428e9d40616fde56aecf442dd
MD5 5ce7cd2ec25c25b0ac3c9c03dd481e12
SHA1 124f57f7ca4a6ea5a3f88fed505d8a9c225902a8
SHA512 10cf63504fc7015f08b29ea12b02480d4fc7080306c7b793d3ad4375bbe3da3a505e6a5aa104d362138e8abc098b0936df8dd3548dc675efcfb0eb08512f16a3
SSDEEP 24576:lHDfaM+9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5L+9LNiXicJFFRGNzj3
TLSH
T1A865F143B2AC7DEDE06A8139897144A1AB31FC351750969F53A07B662E322D3FD39B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5244	elevation_service.exe
996	elevation_service.exe
1276	maintenanceservice.exe
4092	OSE.EXE
6024	PerceptionSimulationService.exe
5872	perfhost.exe
1600	ReFsDedupSvc.exe
4200	SensorDataService.exe
4844	ssh-agent.exe
4540	AgentService.exe
4896	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6410500f83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ac7ff3f4114dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080f1443c4114dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000100d363e4114dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b093b23e4114dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003c56b424114dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bce639414114dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c8d9833e4114dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000081ba4414114dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a043d804114dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
996	elevation_service.exe
996	elevation_service.exe
996	elevation_service.exe
996	elevation_service.exe
996	elevation_service.exe
996	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1240	2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	4540	AgentService.exe
Token: SeBackupPrivilege	1600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1600	ReFsDedupSvc.exe
Token: 33	4896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeBackupPrivilege	1600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1600	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5244	elevation_service.exe
Token: SeDebugPrivilege	996	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4908	4896	SearchIndexer.exe	98
PID 4896 wrote to memory of 2376	4896	SearchIndexer.exe	99
PID 4896 wrote to memory of 1348	4896	SearchIndexer.exe	100
PID 4896 wrote to memory of 4588	4896	SearchIndexer.exe	101
PID 4896 wrote to memory of 1456	4896	SearchIndexer.exe	103
PID 4896 wrote to memory of 3736	4896	SearchIndexer.exe	104
PID 4896 wrote to memory of 5860	4896	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_5ce7cd2ec25c25b0ac3c9c03dd481e12_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4092

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5872

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4200

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1456
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6109e54381aef7435dccf83b8f14b64058c06962b84d0ab86f3047513d00c9e1
MD5 dfee2813483c1cbd30b2f4b5b8ebe58c
SHA1 97925efe301dcc0ab88204a41316abf391f4013e
SHA512 91702d5cf4b5a516a4077c9b7cf177bbfeee3691588e401a534e49f67e83d2de6568e4da5831134dc8a2d8f1253ce855431164b77fd41ef2fc5b6ef87fc4c0da
SSDEEP 49152:ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxngLNiXicJFFRGNzj3:w3q6mjB/7wRGpj3
TLSH
T101D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 993e87ca8fed0a8a16e710a62b5c683e0017797a1297727340512055c06ed91c
MD5 3cca9743e93b2deb341e13c5da0b8537
SHA1 ac311baab186665d76c1096d73970fcfff36b163
SHA512 ade1d041362c16c7e2749b3b835aff1eb0887453b0df3bfdc9af9422cab46bf5042fab1042bd9547bd9e00c52cb98531a227ace5bda31ab0c9fd3d04c8fe0c83
SSDEEP 24576:0XYfDtczAj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ztcSLNiXicJFFRGNzj3
TLSH
T14475012963D408F9EDBB813CC8A28411E6737C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 598f1054893ba2ad269f361a94660be7e028414834ccafc793a0082c29c51a39
MD5 831e946b2798fdfc445afb7319effca2
SHA1 102f29dc14ab6d5a39bd6c740b51a7da3d84f900
SHA512 d6059ebcfc8269566197fc2146e69d522601aa67ba339c6bad817229824ef9fb0d3f406a953dd01dbe6d65b76a908b748ccf6f07b18a48dc49f8881392349e37
SSDEEP 24576:C0Le5ji0hmxhrMI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CPji0AzRLNiXicJFFRGNzj3
TLSH
T151859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 17490626306be7814165b2f222b7a5e7ace83adfc31d1eba6c8792d26e35186d
MD5 a7bc0f75d514b6dd0064d1b5bd00c015
SHA1 3fb1049e31e0508c27f9011003afffcbe10cb614
SHA512 6b5a960dd8bdc25a31249d7ff0fd974d91481d86fd46b731ea742302b27a83b167b43c883dfa5b165b4d60d315be5d9fac4b6ad88ac19b8500b2373de724301a
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWj6q8wyuC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r/ezSC6vUzPv+HjylLNiXicJFFRGNzj3
TLSH
T1B8756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d47ebe1f7c38fe014ff6f2c2645d2c96d88f180a4be81956e60209791795dd36
MD5 5d648626476ca50a3e9d6bee7c05c94c
SHA1 0ce55a539247b861e888a5fb08e41d05a3a3bde8
SHA512 995c77bc77446d9d787b0bda3590fd09020667fffd2019066317c1a0cb306ea92a023b2a443c8b5742b2be5584fae9ee9ecd4eceeba48ed3693cb180d2f1f9d3
SSDEEP 24576:GVbqPb88hv/l+Bv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GVO88hXl+xLNiXicJFFRGNzj3
TLSH
T1EE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cccbbe9cb375fbdabecc7c42dd9a88c1165d80aaa725902dce382d0151759050
MD5 7f158d4d201946b18db1a16589f70874
SHA1 907071d6313141b3a98a35d58401242da94ca8f1
SHA512 9b662766d41012bef640d60a2b553a13301a7078cadde098724bbe58d818fb6e695da3e38f9bd1d9b0263482c60ab9426bae2e893cf86c7b11eb4233773d760a
SSDEEP 24576:GGk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GLNiXicJFFRGNzj3
TLSH
T1755523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6f627a8d376a34bc40e3c07c6c7f1b2be6906b8ea7377bc4978309c510ff2794
MD5 25c1c832b94437d160c1608b0e36c4a0
SHA1 76251742ed4162f97f714fd927e3ad570ae4a11a
SHA512 6a2a3f2e16ab941c0ae6e697d57e9bb58c30403e99d12782b641e5804d119552b22ff2e8749c5a83fff73c8567ead8bffd9e70521d102efa075c4811c5d9ad8d
SSDEEP 24576:qJIUX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qJIUXLNiXicJFFRGNzj3
TLSH
T15B75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 691d19df07453136158afb1b92ad6b0482973d077daf56acd3bfae5ce345e6c7
MD5 00c24bdbe80ddcd88ccea7b92e616a9f
SHA1 761d6407f911ded22444b08f08e06c01d16a2951
SHA512 20b56a15c828905739596c77c270ad8a8fedd57ae4dc462f73d089f3c86ad0dd18b9b3c9750d480dbb9ff94c7a93547d97c867622fcb4a2a85177092354edde7
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:CQvGAdlCEL8c/WRNw5Cy7wRGpj3
TLSH
T1D7266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 cabcc44b6358f5621a2ceaad1c7081934fb4c5a7b3ba194b42a68b75d740f50e
MD5 b0ba3f7fe5d027f98764ec83dbe76b1d
SHA1 d70340efef507c553c8b35c99ecce75222808e1a
SHA512 dfd9bb8cc7b6fb1fa58baf5ecade164943cef8d4d8bbf00c59acf3fe6c0aba3b76ed6ad43358e8d145552df3ee7846e1281c9fa14d2780f50e6b268810ff4e0e
SSDEEP 24576:UfewsAjB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mljBLNiXicJFFRGNzj3
TLSH
T16775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5a3b6aca1182a33fdbe0f1aa426fe0d078465505073d67d12ac6f8e6bc353ba7
MD5 0ef0b3a5896c618646e3ccca664a4a03
SHA1 9c89661b30a227fd5c94d1dab3abf9b8d37d147f
SHA512 c62e7ccb5d13be23e22c76986097ae7979f3b035fcaa2f2035029fa40412c7e4210ce2444d58a393da25533865ac496dfca4817483ca17130be5991c888e7dbf
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHNF9:FUEtQevvqc2W1cpV20I32z9
TLSH
T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3bfad3ad899d173571c21938896f4f367702016d65be6c10e88768a20bc322ed
MD5 42b78783dc4b0e4ffd5a93a0e230143f
SHA1 5646c6a5dc2663593b4e5a3ace21d46269ea7df4
SHA512 0c068289a4472de336cf5b2af00d89952ba2caed8e5659d6536ca27d7c7431e0e8c736ba2f316ff86fe0c7dc1c117844643abc65daf56b91ec524f91d6e47fc1
SSDEEP 49152:TCbRquA/m2yL5zLfFiV+XenmE3/zhLNiXicJFFRGNzj3:soq2Vjnm27wRGpj3
TLSH
T199D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 78e4a8fcd0e3b6645c60f9b6283f7026bfaef6ff6683483690bc388c3526ca79
MD5 1d7ecf1874eec9b2a6c3c47429274d78
SHA1 7a2db1fcc811fdf83c0c176be11d3f3517293d07
SHA512 907233b4e452ef457306afa8b0f42eb33ad4e0e39d5d63fc37f3717a88e39653bb77907691e52b2cf40ee807c80bc5848c3cd52d4c96cba41836adc771997c7f
SSDEEP 24576:AAhGL6IFoiwtA5l7S53W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AAM5Foiq5mLNiXicJFFRGNzj3
TLSH
T1C1359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d5089230976dbb7280e61936bfcf0cf9e1a67f8f8ab301a00fa903eb1e228719
MD5 5119f7257eb088eeef0c5a61ba1a6f99
SHA1 90657cf22310a21ed7033ba8e5cbffe977016ce0
SHA512 c6c97dbc9758ae29973aa4bd2d123a13f460ff62b71a9f03da558d93458d9d06594e4bc0506aaa473458875001cb77b8dd5f8d27cc828e2d323f5b80ff350076
SSDEEP 24576:YwuROWF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YwSOKLNiXicJFFRGNzj3
TLSH
T15865F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a061577ce25cebf0fcc2a6cd920ce97de750a4105202f28dbb6d1e95dee5e281
MD5 034f47b77de52a231a44bc5c049d3074
SHA1 0189f85bd9301deabf53cef9d786e409e9440949
SHA512 b27217073568f2a9ee52665c2b013ca989df6a392f7e3a661561a31ba3e041ae869256cdce796bdbda3298fe6386fcea6ee34311f99573621a055e0943e897f0
SSDEEP 24576:vZuQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5LNiXicJFFRGNzj3
TLSH
T1B255129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cfc3340947156387f64d87a265748817c8170bd30f3cec7ef46d3b007877c1ee
MD5 a5ecf06f301150abd358c368b74a0afc
SHA1 b4d2e2d2fa277f2145490855c68791f725ede4c2
SHA512 dcb0a4eb54b0cdd5c9fb6765cd7ab5190a70fa8f4e7301b96faadd8f3bfe0300c1a6cff53d39cfbdd0f3b6d38706f4bd894ee0ec7ab90f5cb9d9059b10e0e108
SSDEEP 98304:IQRQyi36YOcPDLvw2gAf+PN3L7wRGpj3:fQyiKanX+PNfF9
TLSH
T109667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f9727a268397a3034ef2128875d7428c9b90ec6771ea179a5432891674ac8668
MD5 0e6c4c5f3f17bcae5dbb4fe9964acc1e
SHA1 bd26d7c2d08005d431c34e292c165c6feafae334
SHA512 91afb5181bbd533b73951b1fdaadb1b85503aabd11f0950882e6974bc9033f0e6f515d6e02f9ff0bb3a512f149c4db37a0f36a2624b5532bf4958bc9295e0b8c
SSDEEP 98304:wQRQyi36YOcPDLvw2gAf+PN3L7wRGpj3:nQyiKanX+PNfF9
TLSH
T11F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9c53c14b2e828ee3613bedc3e512edeb762355ca6a13c5ff90abb981778c254d
MD5 b62a9b5888211280920c15c936547191
SHA1 bff8e4a65ddcebfd92ba9fc11fe1211e46ef78ae
SHA512 95ae5d48a6f37747be63520dd165e4da64d627f7abbf7a7bdc86dedf2529905a117206f26584948b850a720f1b33ebef5c3ee67b08d0d6c51c62d0c6b649b41a
SSDEEP 49152:B68Qg55nhkeWu7PNU3/RLNiXicJFFRGNzj3:/thTRc/R7wRGpj3
TLSH
T191B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 81d10ae0bb07097e8d64fac0dcf08f340e4339d7862157e8454a318e28fb5121
MD5 68bce7473c7e009728420593cece8c06
SHA1 ee364f807ffbda2ba3c13c4f08ead1d8725f1441
SHA512 604c8658888f9e30b57f468052d2911a288dbae4985d5ec6a0021a66aadf21bd3a95e6d2d7ae33e6622b580f8c867ba8fd41d52864cb37db5b3744e3d36fbc2a
SSDEEP 98304:Iy5112gYy5azzVvU69nLKnhZk7wRGpj3:hLIHRWhiF9
TLSH
T1C4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 45e49cbc05d60dab4f68a04c8b4848e80e3915ad361532f75aa94dc399f4ea26
MD5 ddbdf6551a3e56d88d6e0b5f8643548e
SHA1 dcf3fc4325cb6636e606f4fdb7241e1cc044cd52
SHA512 c20f6a60034741a5145cc2b6b5238707f4a55dc6ac55c42f529f2b6c48342cad2fe9094652c1fc8c56ebe96a9d73eb7684a382a386c2bd48d919deaa9ad200d4
SSDEEP 49152:YB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glzLNiXicJFFRGNzj3:yu6JmIxd2dz7wRGpj3
TLSH
T1CDD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 31ac4477a9bf63c1040eb3149e6027219bcc2971c4447bfc8a60b127c312c2aa
MD5 4b431fa6d37671c21cc166648769e81c
SHA1 2833cea018a7306fc89b9d7979d7ec3e143d9b85
SHA512 f52408fd1a6a998297e44b271c6d7f14a7dbad98e1ab16f37ecf4d9ef6d81addaf766f19584d3af20ec1e2b19ae6ff6851807df6b0c418ee39a3c93c815a29eb
SSDEEP 49152:a1hpsNoJpF1A67U44CwH7R4x3LNiXicJFFRGNzj3:amifPqR27wRGpj3
TLSH
T1C0B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a7602de419f1e1ae82bdcbf5e74d8ee9140dc48bbbd6b97b7b53b1017718e65c
MD5 2f0a5b7ecda08d75dcc88df538e562c6
SHA1 c0cbd5ed9ba993ac0a2847618bc4276755891920
SHA512 8a33f3df318c6f98aa4457a137a7957b5784eaaba2183df917ae813e4b3949fb66eb66f87630890c81515c6808ee7463c6abc9dfd5defe1ad7a8354aa82925b6
SSDEEP 49152:kSuZQIY0Be2KkRVtOnks6NMHqQLNiXicJFFRGNzj3:25dKqi61Q7wRGpj3
TLSH
T1CCC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 22f53d75cf257656185020d8891529dc13f464223fc341746934b7bc3d76bc69
MD5 be3247e3076484f13e97bc3c1a6735f5
SHA1 33324935e1594dbaa4f88339ca73cf06b6d5c1e5
SHA512 e488861170884a2f4bda755adb307cf1263a8359be2b0fd8a8911c899d99786324d408c465db3ab22673416f15354f24503bba9f18c6e3944835b8459b4aa285
SSDEEP 49152:QhtSn8EApI0figjgiDn0AP5wjLNiXicJFFRGNzj3:BX2iWphq7wRGpj3
TLSH
T19B95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 44c54889cc239b0956fca3eaae7165a35f730c5bfa89726ebbb752a721c99fa7
MD5 c96fe65a816bd57ce855a3198f96beb2
SHA1 fef1669a5ed7c3e1780d6abc1230c74f9c93f62a
SHA512 486728ea50cfc032e0ecdb2aafe31f7e22abcf118bb5d25f9fa2ccd6fc83aeac2aa7c45f19cfeb606b85f24130c295d220ae18e36a29130a20f1a9d1f35edbf1
SSDEEP 12288:eKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9b2b6839676590f56328720b099910adca8bf1d2faa7a8ac77d07448ccbe73d0
MD5 455255b458ee8af1fe39646c8c807645
SHA1 55a6f0801c19a70170b4833464119f733a87ee46
SHA512 f511f2ebaf02706d1f8b8a90cf23d5a42c294f498171e67762eaa94cfeaa403c395ae2bb04d7f42b14a3eba3fe780ba53fb922b3754e91a608c366a82217e0b5
SSDEEP 12288:6RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17A5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 57f2bb37b5b7a3487c3710bb6c285c5f914178b0aa77db68958339e05be8a18d
MD5 cb5db72b28febdb87fbb8eee82317e5a
SHA1 ae25b1efe1b886e12790b41b290b94c39d1b779d
SHA512 01e8ccbc7f2937188e904bfb6aeb1a45d328eaf5da47cb7c19cc42908c546f821d4a5bf05998641c4071ee9fad717f20942ded2ca95b038bb2c10c5b8d425e61
SSDEEP 12288:ZriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ce68237ed79a0e6540c31965e10e2082d018a69734f2c8f725f6314cc5cb38fb
MD5 36a8a8409f90c8e9848f3ea57eda808f
SHA1 2b438bb328df1762596c4eefbeb72b534e819f33
SHA512 eb2129832b59986db3d73c1244c1d7b58234094785823b531e865420dfd33222fc3c3464c3582734eaaae24ec0d685b6c5f42b4d4c14a46dd3ec8f7d21b49999
SSDEEP 12288:3VMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19E552393168901F1E9BD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a1fba69cd19f15b2fb8db1b68b4cfd71612931fc0099fac3c00ffe53cd9994b8
MD5 e04cd0d60795b7df855c9edcfae33673
SHA1 d55ad4aed438d125f61cb42dcb76191b9acafcc2
SHA512 c69f4043c17cb41dec1429b8749d40b30280cea7db99e2e641d993d0b64cf62886f1cf1fa1aa100adda1b246dcd883e7b5014db59427bb80e90938dca5bd97bb
SSDEEP 12288:7kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 98ad64329087515402134d5c742ee1f481436fe60dddf1b8d071a1d8cc58abff
MD5 0da21797fd4c9d4200c8c181a2f547fd
SHA1 2d9cf3383ab51749d356a2211ff1e674ea4f5a2a
SHA512 4d513adbbe0607d40d709ea4d647d2bb8aee931827802e38675bbe0a30781ffbf6c9013b184c934a584c4e831f47854c1c8a1aca13dc1e12dc6b9221eca63ead
SSDEEP 12288:8liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1155523D3548955B1F6BC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 85d8cf9b3c83824c71f3a06d86e11c7977bc5c3c16869b0ff7cd82b9dbcf91eb
MD5 339da077b647e1265f3562d4c9becde4
SHA1 63ca2ee1f2c5af07e605c7f0633add10b6ecea37
SHA512 8e7d410e40619259394add63fb8669fec5b238ad0d6016368e8a687fb0e6f35aa9f02056fb25c525d08565bd2bee3418078bda6ccf4da26a142956fc7f5f15cd
SSDEEP 12288:jJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15E5523D3548955B1FABC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 26b9d76b118d55051a0a6d2bc51abadb9ab439013e0a1191e214bf0474cf673b
MD5 2b08ad6f4ca1c4375d53a34a15ad829a
SHA1 558ba5465e9b01c89d5340b52b161c7a76080cea
SHA512 35e73d1d84f5707b37d4c7151b5fb5474d1152bdd6cd984845a90d49592fb9ef1afd5a5b819a93eadd87ad71b50f536e9190d4aa87c5bfd2f76448f3d1d30c63
SSDEEP 24576:2ZM3zFVSO9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2ZM3zfZLNiXicJFFRGNzj3
TLSH
T1AA750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fd7dcfb04efb51179d8ff1124918900b1517e59713a6dba0dfe525bd4731979b
MD5 e4ea532055009ea4033625a5b6642782
SHA1 fdbefeed41373ac6d0ef4c61bc68d5f13f2a04f9
SHA512 eac3f6b4c57565c5ea049a0c142f6defe2622ac1aa74f3b2fcb505481e8dbe52f8eeabf9e67efe5ab40729a3743336261e6225e10e9ba062a783a889fd5a0c6f
SSDEEP 12288:22iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B15523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 504bc32cb0bce63980fbbb339b1767e9899b8f5b665ff8b49442db217e757708
MD5 32c2185a825e1e7669ecb02f6125b857
SHA1 159822558c26b77463ad56a29f54c217ec65526e
SHA512 307873daa32ee4ebc70d2e936e2e3100dfd3000bdb55e4b2025f4888720a550d449d213748188d4f8b9b4883bd9177713cd56ea0dc9ed1d5afa832dc46bd4ed6
SSDEEP 12288:iyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10F5523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0a61facd0b2093d3d1906287f78393e849a29ff88aff9453d0189b4d2c83310d
MD5 329cd33f8fe1730cd3373c77fcd3dc1f
SHA1 0efd810cb7ec8533240a7ea94d148e5cf128b4ae
SHA512 86100a93c7b2fdae99abd3c4d6a3009c423fe65f3074676053021ea9785ab86a5e3c1b465cba53a855366ac233d6f24f71406f02d25dcbfee75729c3fe4794d1
SSDEEP 24576:Mzyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MqLNiXicJFFRGNzj3
TLSH
T139650247629530F9E17A8139C9620911F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9820bef7749db341683150920d293029684252a90107ea3a5b0a65be5dce9c6d
MD5 c1b33ab924b384c5935b5178c455f7fa
SHA1 de7c57e817a0ea03cb38dc4feeb0fdae0ab1a7e6
SHA512 0284851e40ab089e7a3213fb178503eed68742fbe01e1c18e117838361082d70406fc93d98db8b65a96da45d98ee129218f6f4b9502aedcf0181499e4e297578
SSDEEP 12288:42iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f3751884b6732882ce7157eb8c7961b70f0225d2a8e5246e366f0383d4c59a0a
MD5 6f0a597edc8f00ec26b4ea19c5f8dc77
SHA1 b3c876c33945ddaa4691ab8a11480b5cb5f11b66
SHA512 4688b7b9ce0f3d284f64a1998b3dcafc07b7f2eb3793a8690f91ae14cdf8d3d81b5fd59124fff8b2937b811cc90447d124b4009794cf075c813ec3edfbfa8588
SSDEEP 12288:T2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ddace1c9e52490616cadc296ac03f822bbcd17aaba30ad32de4b546399712517
MD5 6cf9c6358dd2a135051784540b6ae523
SHA1 1ba54685b4c43395502181070cea5bdf5e5525e5
SHA512 6694734bf5ea526c84fe5309f4f7f8b893266b539289e24524a10037130e255d86844cebc106338cada7f43e34c16842544f441a81b960a68edbfdc445c3c027
SSDEEP 24576:6zyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6qLNiXicJFFRGNzj3
TLSH
T1B3650147629530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 5034f5ee561bf04ca8df18a83cb1ddfc238d017498bf35f610d204502ea890c1
MD5 3fd76a611fafd422200713642c461b78
SHA1 0af13c0383f09dcaec86843d64bbd6d58a066cfb
SHA512 33f3fe96d318c22a73e08f35e31d7d0e5047ee58a0a79cc4059c15fc247fb9ff242d13b56e464b463ce9c97fbc52414d6053ffac4919fdd20fbef52714f1360e
SSDEEP 24576:rT8aLl3z0zDP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rT7LljCLNiXicJFFRGNzj3
TLSH
T1277502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 44ab794f358bd110596629f62e3d1a0c5d47b09de395ab7b3122fc255c896454
MD5 f360084704817d8b887423a3a8132e9a
SHA1 2512766c2327ce97128348c10f5bef9d36c45b85
SHA512 aa78694f8409db68030212f2006bccf02f686df5f934895f8f26e9c18176a906294a85f23f507a77ff1ba4a42e8255492b77982fe79333b90d887ef5de2d3ab2
SSDEEP 24576:o3rd9CHKy7GZr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yrd9CHKyaZLNiXicJFFRGNzj3
TLSH
T16985CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a65125f0c1ebfbcba3bddfdc2514da25aab496fea149e9e49b324bc84bc9c08d
MD5 e0ae68e1bb757ef9d8b6e4abf73d9bca
SHA1 1f4f764f998ea3aafadc05123901e85866618ca2
SHA512 1f285cb599806345de5fd94431f3b46f3a8e7a0a268e53e0136d0725b98467978414e82512b496e37631e73f082b3627f188288e42c49ebe91d5fcc852771b64
SSDEEP 12288:zLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1245523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ad95bf649867159b9d838e3bec5f16767ca4f2f8b6d48165b8c01a9c507c5c57
MD5 e967c5b3142ea05bd9712a2f01e72006
SHA1 f8f0c6d62e0304551ddbd3e44571145620311f6d
SHA512 cbe55007a944697fc3a3b4d80a71995a099163b7f68a8d65e1b7e394ed7963461c053437a750f3ed4762db3771c6ccaecd19b258854e7328eee8b73d4bd66c8e
SSDEEP 12288:DNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10D5523D2558955B1F6BC0039867A4428F5882E2DDB5619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5b13806a15818774457fc21f894b63a02f8061d45fddaed05aff47a01421fd78
MD5 1aeb1e309775b078cbe6e8be4144b8ff
SHA1 c64d19b09510b81c7322566b2636f3ea248f98dc
SHA512 bc64fb56944e5ab105a4e73805a0c834596db8c8817ae229243e8f7a2f4c6d4fbc82b25f644d8766c6c9d65ddf4f4126b7265449691e89f11e6e6f71db6c10ba
SSDEEP 12288:boiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ba/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D25523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e7af3ff8379658b5df65ebe7a04ecd096fbc1a6be5b0cc4245c77957f4339591
MD5 97e345fe617211d553117f84cf12dcfe
SHA1 d72347fe732b81c4fa6b6bff28d2568ba0ec7247
SHA512 b70f77abfdc054567b22434f8fac446b8619347d09ec3900216c34286144a41899becbe141fe1154032f2cecbee0047ab9e4d6ba8b103b64d34ec9ffa638dbbf
SSDEEP 12288:02iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1305523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0d65b530f892023790a9a8552692efd7c877e1623ecb7dbe7b62346f13f4fc1b
MD5 d9841d2518b02e46f24d871d904059a1
SHA1 0af6207f1226bc456d89af4a182fc745972f1e2c
SHA512 e5f89ef3aa2744d484f3ce95239ed2a5df973c8b8027e6addb78fb22f764d2d3dcae78114aca3c9a59b5f646d3d9bb6294c80243f67d925f0c02821f1b9399b3
SSDEEP 12288:QLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1775523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8a8bd01361389a06933d3b31aaf13bead5f0ef19c776ed6261e0461743bf75f1
MD5 01541479c50c8056d7d85403a269feda
SHA1 c37b8a17d168ba5c17543bae26701d42ab8c71d9
SHA512 4c5fd9e00bd83aa40f4572b2c595780a5f6b456bf9420b4b7347d5cbd16bbf9191c19e4717fddba228e7b3af786bf14c88ef844a78ea8656adc8adc81eef9a51
SSDEEP 12288:fuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1545523D3548955B1FABC003AC6754428F5882E2DEB5659E3E3043D1EA278FEB8F38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c2e65029255a69a2da490752cfdfb35fff03a520b722cda2875591f9aa1703f2
MD5 530565d3c10c3c792b6a0779c16976ec
SHA1 bcba998766bd56d1571065abfa6ee727be3b6a93
SHA512 dd951da3646a40b3297ad5008f8d4a45bc3e805b61093a3117779327378ef6dc2769786bbc5c201cd1ee7c2a63b991917a181000af711b1247a0f1c2df3771df
SSDEEP 12288:okiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ou/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 6dad3fc832607c93223ae6dd32f41113a5a3d3cba8c11ccfc0585dec0ee040aa
MD5 410545bb6bffa95ebbc29f0324a7846b
SHA1 4142e81b88679d89771cb9a94ee4a27c2f0f645e
SHA512 c5ee1f567579b44b3f28076ea6b57547b7c192120d80f6a53748a2445e5f5559d9e42178d21ef311f8654bd0fd2ec7cb6bda56d4a9fe32274e1dcdb335691cd9
SSDEEP 12288:4ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3558955B1FABC003AC6754428F5882E2DEB5659E3E3043D1EA278FEB8F38436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 47abcfef7852e0fecd343267eee729f17a97cd3a81ec95b87bd2d8471e5900d2
MD5 271aa8b751709b8282434c8ab8ad2b42
SHA1 f63a6261b9ad01a667da28695a0550057790ead7
SHA512 30b31637a4910f9a6e26d048d87474b509170660a9b81fc283af2bafd5d0034917fdc8e90e357d9aee7c03a2f33fa2e86551fd9841a4cebcae9a8c790d2b3b7d
SSDEEP 12288:SkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Su/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EE5523D3548955B1F6FC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 68d2f1c3931cc790bc51d6226ae71495ac95265b359bc4a568700904b06cece0
MD5 3d9c66f146454dd55c7f7b653e366c24
SHA1 5a5313c6d5b598465697572e5a6242e03b55c9ce
SHA512 49b99f4b347e7ff47d01c21d6f429643ab46c4e13e564187dddcc920938ee9b883270ee28f6dd8e85606c58ecdcba6595c1194ce5cd61ba96a6c1be00ef00639
SSDEEP 24576:Ofwvzk9RX6wkyAIE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9MnYIELNiXicJFFRGNzj3
TLSH
T12285DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9422e1840d04f5ca410b1960c7a4c733ddc52683314faea0e1c42ff5098fbb7a
MD5 bbd75ef3097738861ec21e3d9fa9d66a
SHA1 b8cb51da9b3edaf4f4f8d8c21137ec54e39a0638
SHA512 52ea7c3c2d06cc1b019482f1a5e2efc29defe20de97a5a737d971bf54fb2fe7eb32bb391082ca130f813e750a9e07238e1bdc4837c98da103cf0b3ad6aa84a9e
SSDEEP 49152:eYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DLNiXicJFFRGN:BySzPr7wRGpj3
TLSH
T1B2066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 319166a704c4179dad53e11b64bc259e67e8671c87782669d902845d0814902e
MD5 97758bbf6d2fbb128055f1520ab2087c
SHA1 0fe54795cd27288f80f6bd22f30c2ccabbf0e541
SHA512 2e0376208cd4c1055e2085b58218f51a3795db98a409653a20ef687b36e2e660ad403583d477218875fa2ee1091c3b381a960f33037999c6167910ecc34ab3a0
SSDEEP 24576:t47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t47JUQjqirIhCnDHUPfF/zLNiXicJFFS
TLSH
T1D265AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d77af75b3c398b21cfc9f0a98a8f9e51a61b9505811939f6de1441fd16101d64
MD5 c919c9577cb7507939627a8c7dfaa898
SHA1 96ea00700655aa7018af4e13be1c117ec42dd1cd
SHA512 6ebefb8ebbdc2fe5fc858c6c1067d600e2db79c101026938086f644bafbd1c80590526b7375f4399f073834b613f3a66d59c2556ff95749d264d8cee5385f89a
SSDEEP 12288:JpsfmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C265F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c3c530f4583c5e4e7d6657cec9a0df32ae81a2719ce5eddc60df6801c616d246
MD5 6313510fd213e8e7851df09a86da451e
SHA1 ce5e2ee88cb055f187aa1697bb8d10fc7f31b3c5
SHA512 89412f3454846038d622173175ea167abe44d7ca876a5dee75082698824ee19e154c250bd1d54e9c26f3c1768189a18bf353e84e9b5185100119cde512ee0eea
SSDEEP 12288:y9q8U3fiKw0EaTfitGk9FgcNIygoCXNl5Ll:y9jUPiKiaTcGkTSygour5R
TLSH
T132453940766BD75FC6A940325E33D1CCA7707D41FE05AB0372C8972FD576A68BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5fa623a1b8ed44b6e2b783e949be7c3369357453d703b23542f5fc1b4334cc48
MD5 a6898b8b8f3387ff68815fcfe3ae4244
SHA1 d973006a4cbea412c36215c22829e139c0c0ff5c
SHA512 5a8b9880dcb34cc06cbfed470b19330ddc66de99415054fb666a07fb8b086074fa6f0e2019c8bed3f6bae6a7e9f6785fb75c31ad7382e747c3206de00f4d5005
SSDEEP 6144:qGz9Astfs1LbI1pI12yguahcbVtMxxfIxcbVtMxejmKqXOaCq7+W:qC/yNyUCcZ
TLSH
T18B55E9816437A3CFD1FB6031072A5B4DAB64EC42B7056F267388453AD82BB65B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a085dbd5c079f8cb914e6ab38a8d7f524a6b2b81c7f754b79cdad78a33827fb0
MD5 2f6b387b6d180d8980789d794d75266f
SHA1 585fb4fa5de689470c2a7d35afce1aa1770d24a7
SHA512 710b66afab49d1faaa8ddef9639867ea068c58cd9768cbf6f1659d9b2d2153f04304191abc495f8845aa47c81cb92063054c8b1e9b7a6bcfb43c0ff219a94692
SSDEEP 12288:fF7eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T109552393468D59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8c9d01ea18a7e99555d9725ecf257e26be0901ecf519e1b4ce00d7772db62be0
MD5 cb26cc2f67268a26f4cf3637c1fc65e5
SHA1 ff587598a2ead45d50c55bc882a44f667035a6fa
SHA512 5c995eca27c1f0487ad9d4a9157b14f5a3171cb8ee8eca44b1eb5106cc42f1051ce12c68a23ee9cd09d792c08875ed339dc47de864189c644284d7765fc6f983
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sgb4mBIBhGFtLNiXicJFFRGNzj3
TLSH
T13665AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 32d083a079e596ac93c4c992a41cf3ccabed50e99c3d15a297f1d04a3ce16a61
MD5 987b30a8dee0bae3420e5422eecd4431
SHA1 3c87f3103f3b552fe83df6b4ce385b28312a2b35
SHA512 1fd7e993e46930b11f8fddd87158212abaa1d47b9cb1d034c57f9433add54120ad8e581a9aeb1a1c4308697fb24d56e708d090e423d07da0d0177f04870aa20a
SSDEEP 24576:4G88u8FpJqH1vzria7/m9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:77ZFPqVya7/6LNiXicJFFRGNzj3
TLSH
T10885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 feab28d3c368bad235c7cd2e715e53417e7012c26a9543f79a97615e4cf4fe17
MD5 05da090f273c45bf074b74d82f8c6bda
SHA1 f4fd0833c60294e7f0a4bd1e678cf45c7bb7e699
SHA512 bd5bfde53afb217e213bc27d9a030f25c625a0704efd6e6ecee33c72f57f48da81376a76779162beb5b36e0c9232268b6c08344e0566a024a865905bd3c8f97a
SSDEEP 24576:kPUr+NQZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kJQZLNiXicJFFRGNzj3
TLSH
T11065F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 798060d56561722d239974695f994b92dd7073640eecf0cda2ca94ebc07c9d90
MD5 36c270e60d8118a50ec5933895b089d6
SHA1 ce2fcb582f5fac0ad5e1f9745bcba0d4e4f62598
SHA512 eb2445dcd061733c3f45147d249cc7c71ecdfcfc6f420034266e7abaf34cb297a47130edd485528d5125cd2c3b6bc8ef528f43101c2bdb98587b88987b9657c8
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpLNiXicJFFRGNzj3:EG05lO43b87wRGpj3
TLSH
T181D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ca860af23f1eb3fd55172884e00f1078537220d9ddc063e470b9558a7a95b185
MD5 4f52697aa3338ec484a43d7d3a2e944d
SHA1 a35242eb0318cc04e9a41947e0802fd5b695d0c1
SHA512 37f9488ef80ea6cadb0ee3d777794626dea69307f294ec651e6fcd7a8e4f6b93abf1d9d2c89be7e0e5656c13d4640c9cc17343ff276146590387f37bd6d376e7
SSDEEP 24576:yfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnD/TwSfVcYG3K/cJHlnFR+IGNe8jg:aa5POZ3lJt2pasx2+mRLNiXicJFFRGNf
TLSH
T1DA65BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cdd869e8c144141d9db09a50fb653fc4d9cd7dff9b696d2e6bb2c26250161d40
MD5 2668129a8c6c72aea00871f54b77a9b7
SHA1 baad21417a48b590597ab75d610c0d587c23b01d
SHA512 2bc5d44faeefc47099fb7013ac3cb4bae70341eb34e47f7570b3026da7aa6d1009d933316e3c0973f9624c698854ae241cae4877b36ee98d410a49fa48588359
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7Fkl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cNc/zEOVHFaLNiXicJFFRGNzj3
TLSH
T1E6858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 589f22bfbc18eb53cc5b8eb9d85e43bafd2a11f4371cc0420823f23abec9e5c4
MD5 700e0b6e6e4e8855ce4813f112424173
SHA1 3fe9a59dff5f8ee70b7ed6f12898a0c207552ee4
SHA512 3cbd87ad98299c632c98f055aec9679e3f3c897dab5c0accb74a5b78b6a87f53f5798b24a91313ae6f8a07e04189b88fa63fb304e236e0d32bad2a0d016d25e7
SSDEEP 24576:TzkNvNnaFeYhJNtmZBmH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TzMwBtOmHLNiXicJFFRGNzj3
TLSH
T1E855AF6EB6A806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 36c426a3e835811a0d5008838da8b7eb59a8f29b4f6999ebad2a0a1d52e6edef
MD5 c23074526ef194d41a1732b90e6f07d8
SHA1 f820b76bc9792c4020460788443b4949001f2647
SHA512 5a066b7112b4486836cae995deada2eca467a813f215622b411054b4a3877b8b8fc65f231b73eee17145ed1516dc7bc997c8e5b9a86d0355188f49dbde28c5a5
SSDEEP 24576:GD3FHshBIYQgAs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GDVHeBIAAsLNiXicJFFRGNzj3
TLSH
T15A75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/996-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/996-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/996-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/996-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1240-312-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/1240-317-0x0000000140000000-0x0000000140224000-memory.dmp

Download

memory/1240-78-0x0000000140000000-0x0000000140224000-memory.dmp

Download

memory/1240-0-0x0000000140000000-0x0000000140224000-memory.dmp

Download

memory/1240-7-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/1240-8-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/1240-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/1276-40-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1276-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1276-51-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1276-46-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1276-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1276-47-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1348-413-0x000001ADC3980000-0x000001ADC40A5000-memory.dmp

Download

memory/1348-373-0x000001ADC3980000-0x000001ADC40A5000-memory.dmp

Download

memory/1456-423-0x0000022200000000-0x0000022200725000-memory.dmp

Download

memory/1600-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1600-388-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1600-387-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1600-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1600-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1600-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4092-278-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4092-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4092-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4092-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4200-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4200-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4200-367-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4200-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4200-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4200-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4540-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4540-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4540-139-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4540-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4540-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4844-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4844-369-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4844-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4844-122-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4896-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4896-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4896-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4896-372-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4908-382-0x000001A5F4190000-0x000001A5F48B5000-memory.dmp

Download

memory/4908-425-0x000001A5F4190000-0x000001A5F48B5000-memory.dmp

Download

memory/4908-371-0x000001A5F4190000-0x000001A5F48B5000-memory.dmp

Download

memory/5244-23-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5244-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5244-15-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5244-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5872-80-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/5872-85-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/5872-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5872-310-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/6024-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6024-74-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6024-295-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6024-68-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download