8700be13f01d43b48f8fe076008658ab66c8c1aa9ce49569e7a2017135d7f71e

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample260717-nt7lsady8y
SHA256 8700be13f01d43b48f8fe076008658ab66c8c1aa9ce49569e7a2017135d7f71e
MD5 a1909ff1cd70f1c83dbc99ff11978af3
SHA1 9882805fe7a9b240d0b35d682bdb7d2bf6d2ec9a
SHA512 c5a90379fc15d72c8185c01c623a947d4330af2d78043fc1c9187e0ebd181cc5047d16ac74063a887b6ced088158c697bc5a268703b8e5b9379c3c88cfea1348
SSDEEP 12288:EM1mfPwtq9VSrJFggIIvS5ejcqeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:EM1mfPSIwwcYqtNyBo4kx929bL3Hnx
TLSH
T19B75F11AE3A851F9E5BBE53CC8924507DA717C568BB1D38F07920D5A2E337E08E39712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1184	elevation_service.exe
4644	elevation_service.exe
4016	maintenanceservice.exe
4708	OSE.EXE
2208	PerceptionSimulationService.exe
4704	perfhost.exe
4680	ReFsDedupSvc.exe
3360	SensorDataService.exe
2404	ssh-agent.exe
3180	AgentService.exe
3140	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d851377223e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002a0d9862e115dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002feea161e115dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045c90162e115dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4ffa5a2e115dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe
4644	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1096	2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	3180	AgentService.exe
Token: SeBackupPrivilege	4680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4680	ReFsDedupSvc.exe
Token: 33	3140	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3140	SearchIndexer.exe
Token: SeDebugPrivilege	1184	elevation_service.exe
Token: SeDebugPrivilege	4644	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 4712	3140	SearchIndexer.exe	97
PID 3140 wrote to memory of 3296	3140	SearchIndexer.exe	98
PID 3140 wrote to memory of 5432	3140	SearchIndexer.exe	99
PID 3140 wrote to memory of 2380	3140	SearchIndexer.exe	100
PID 3140 wrote to memory of 800	3140	SearchIndexer.exe	102
PID 3140 wrote to memory of 2740	3140	SearchIndexer.exe	103
PID 3140 wrote to memory of 1908	3140	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_a1909ff1cd70f1c83dbc99ff11978af3_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4016

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4704

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3360

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2404

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7a63d88a9730ffa3020b5f883cabb37b3c0831cfda0777ccf0be645d500acbb4
MD5 f698c2c875d5678537e9b8ce9873da12
SHA1 5707fd9d343b1a75a9a7679a1593f20203e5bd37
SHA512 16c7a03d086458d3b9c8de5e8d2277eed168cb0ae1dbc68fe81dba41b551832a387b76796b12eaeda52fbc21f1c6fe41e987251fedd421c3292e85caa4733755
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnCB+kn3Hnx:A3q6sjBh+k
TLSH
T1B0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1ffa502dc4f3a07b230f31c41f03b656f5290d97fa6f8d5ec7c750ba971cfd6b
MD5 ab5438da71bd34c961a3a315871dc13b
SHA1 c64ad60e3be84746b370ae78d70d3d163d685ac2
SHA512 4dc776626ff962f8bfcacf7bb4ec872acca1fd5545a1377078fd6b51e41b65038204f1c9457ae97fb777bfae2fbcaaca6f748159ff3e06fcee174a08cede52e9
SSDEEP 12288:i1XLsswWkxy2lRq2czATLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:oXYfDtczAANyBo4kx929bL3Hnx
TLSH
T1D565012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e1a8d64f197ba509a085103b791a46807a1fee3d8faf314032f6d4e94205e2cf
MD5 47af4c176c9d6d84bb84fe529d0379ca
SHA1 982a2781ef885b84b8ebb92fb6ac33ca6418e196
SHA512 bf5cec76cb0858518e17044ec4178fa6f727a1317442936013ba17b648665260bd0aa05a315863efa04ae6af74454fa368b3bed18f1b38ea4bcd8ec05bcc0a1b
SSDEEP 12288:aXZNYVLeyUji0h90ZD0wxpGZIVuArHseLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:O0Le5ji0hmxfrMtNyBo4kx929bL3Hnx
TLSH
T1D9859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 21ffa4aaaa5ff3c2a228d2d605653f929d0a4686fe4de169d5d4e26add398e6c
MD5 a56d2d49d504b50794326c69a992b85c
SHA1 2dc4d647ae039f06acc389bdde1f5c93aa9ff560
SHA512 97096e54911cf657e3f5da9c63b41b75d177a071f5fd318e1d08c899e102cd941f8f45254e5852cb3873ed12a6de6ee3c4423452782bb95930c4dbe648414803
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWn6q8wyuzNyBo4kx929bL3Hnx:4/ezSC6vUzPveHjylB+kn3Hnx
TLSH
T13B755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cb300b9dce7775436e0e51f0088fbc29a23af0e30a353147d088472cd9282742
MD5 ac3a5bb9f45b50fa8fc1f3a3a4329f01
SHA1 91eba51f6a2bde82c1286ed8055f8e2bfeabd28f
SHA512 7bf58b1151cf7bf1b1c6eda4ecacf51ec80a5dfb4162fe4eb270231ac60e66c22ea0dd5c5f030f3b76685af9d42fae6580cf9d942abdef588e3d7bb5f5970c21
SSDEEP 12288:QVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98XLDAptNyvUgXZ32dT4ePc7N29CD:QVbqPb88hv/l+YsNyBo4kx929bL3Hnx
TLSH
T17D559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f1ea72442e782a1322c384509d2a771f9aad1518912ac5a4a164723c4276647d
MD5 7c20cad0e242630c9a8b17bf363a7ccd
SHA1 531f5d5be304ba5182c6744ca381af2e677774cf
SHA512 d985412c9ff073a544c014a108e4a2577a8261c7b52e4e6207534ad7a09e1f2c80af956506edc52dd3b8f82b7f5ea12f29d31b9ac0f4491bfbc7b1324e7696c8
SSDEEP 12288:AmiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:AmpNyBo4kx929bL3Hnx
TLSH
T18A4523124B0C627AFB7D3E70755E8454CC35BC8D0D95DB98DE62ACBB58BCDA2DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 25495ae94afdcb0649640394cba85b1729c5320fb3439f9236cfc9ccca3bee9a
MD5 f5ee20720c4516ce690af85686194d7f
SHA1 c652519718a6d580bc5046a7603573e9679c74a6
SHA512 d1db993da0a550f656d0e795ab847f56e087e573ef881d9038f8abf3e7698e29ae5e6a08ef80e5740ad3af9578ed10aca74f78a06036d5d9d5a0a95eb80f9b1d
SSDEEP 12288:leBNUbTVO86UfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lJIUkNyBo4kx929bL3Hnx
TLSH
T18565CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1b1ab61ffada2f0e26217b53a657aba0a6cfcdc887f474f5fbd9ab3e1b99e601
MD5 7d330d3e57a3a3ad7a41c3fa12369684
SHA1 8266a383c11e578f440ddb5f07ea929210f38bd6
SHA512 da5175a3b6f562eb8bac9e7aeafc9a8615bbab859c02091ebb7974537dca6f8eb9cc96e96ff4470a26d1dbc94c726ee27a7e552cc0a10fea48f8b46466b3f1b8
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:dQvGAdlCEL8c/DRNw5CQ+k
TLSH
T1C7266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7e304b291ff6eef7cf5709c53de84cfd66ca6c901a55832070a0eb4e7e43fefd
MD5 350a5ed11921e05c799cf344bbac2d46
SHA1 5437495b268f909971d7ed6622ed46df65038131
SHA512 4f197d48634d20e39ab42f84adbc04b7bab8c3ec2ee8c8f14d611588eecf59581fdc1fd23d2b8a1b5142a39216279ff7ec55160ab59de63f50807922c4ddd730
SSDEEP 12288:AAwSfxL/2Dc3XDLLmt0LDQewsAjlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:VOewsAj6NyBo4kx929bL3Hnx
TLSH
T17775E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ab7935e97cefaea9ea6b5f03c0a8a4ee294897969fe8b7b3f3ec5e2c76ff2214
MD5 673ea4048781dbf95408347144464968
SHA1 b21b8ead651848365f564581b291b40a9ee94181
SHA512 bd6b68f2a216ef20640528d4c7f35b2e954a0f95caebdf62943ee22af479196e9530b17652f480a34750f872b16db5757a6bbf2141fdd5db4407801b15f579bb
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHn+k:1UEtQevvqc2W1cpV2tI32n
TLSH
T164474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9b47d5b531a4960288a076d0dc2895e0b00c14e3b36abb3c014a0c6c1ec20953
MD5 c02cfc5b6f17a74e5a9b4d692a672be7
SHA1 094b5936c65e20ef1d6a57bae8c79be7fe542151
SHA512 fda9df876a9c3683bd3cdf8989451195a2c53966ef3d5fa5f133cc524e225ad3da825b0c9075fd32aedff34466710f83f108b3131fabe2ddb5d86d0f1abf086c
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/zJB+kn3Hnx:aoquVjnmk+k
TLSH
T15ED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 23837efd589307a7ea023b9d036c55744dfd6c4426043cc77adad5276902917e
MD5 c9f438a09a0a2b4efeb56797bf701d61
SHA1 61dad2ff5195e0032bb9232b8f43b9ad719b5f75
SHA512 e24c248bd71350fcd05a8e5e505d041b77491006f28e446c1425c2bcf8b726df4459e959797c3e3cc2b0fe8503680f6063775a4d5a0761cb2689292418ad9cdc
SSDEEP 24576:BAhGL3IFoiwtA5l7S53XNyBo4kx929bL3Hnx:BAMUFoiq5oB+kn3Hnx
TLSH
T15535AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b34837291773c92afb73006a1159946b90427b4271fb5582cda0a3ef67bd1bc5
MD5 f45991d410a2d43f64ea51993e21216a
SHA1 53b6a09b0665c6c37f555bf4218df4c2b6858bdc
SHA512 0a1c16e60a1446bbeb9a7e5716d955aed3c8cc92cc7cca7e02840be68dc110d740cb2801d06e2505d9e13a2ddc6c9c3741f4b8a1d1c09fd1e512c8c1be5290c3
SSDEEP 12288:zmw5HEjsChNzBFgl0WDm+CMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Swu6OWuNyBo4kx929bL3Hnx
TLSH
T13A65010677A81CF9F96756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bf8dfe12b63c054d527a07aee5a1ffbaab23942885e77335c1071396cfeff109
MD5 1089a9b34951d7037aa8658fc44ccd35
SHA1 4e83ddcad6c5bc20ae9197ddc03c4aa1dde73f41
SHA512 f726ce708037cc4f0501456e60fc8774f0621518f371ed93ea4c96db6bef22afc28342ee5d47077e03bd0e8da384f22fbad740c2797f4c64c15fdbf84ed377e6
SSDEEP 12288:QgZ1IyVLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:nZulNyBo4kx929bL3Hnx
TLSH
T1A5551216239831FAF2AB2678D8E58505CB327C461B7183CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cc465567ef951b642a8b9772a9fb26ad5d99a63a182efa6b4693653a16cab761
MD5 fa0c971c767512063d7d8b7aa6960b78
SHA1 02c3f5d5814d1d0a039d16d77b098889b35d0144
SHA512 35e1ecca83eac4e998e61c42939932d3de8620dbb3022975aa4a8b8b12ccbbf494e9b383fda185e798978dfadf53d7a7f11325cdc81f65f7e93117e268bd7772
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UZ:+QRQyi36YOcPbLvw2gAf+PN3t+k
TLSH
T175666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a82817c601d815b5b7dcfa361f577b9f0bafcaa57cd9d88d15974e7a430854cf
MD5 5471a3c5da1bcbf3614aae6b8b0afccf
SHA1 1da5376f025ecab935106f8565719e7e85dc53b2
SHA512 44ee6cb7043f5eec16c2f7273cfec295451397df4fef5e8b008e3cbe76301821f34be5fc47d8fb30343e6f27061bf114786577398db9731b1d7adc34d3102d0f
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UZ:wQRQyi36YOcPbLvw2gAf+PN3t+k
TLSH
T12F666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 52d2d31e0a099c27bcdd7f64fc9106428091f138b098390939c0f75850ff1d8f
MD5 1608a1813969db3bb264f014c26a5372
SHA1 33a17607ef5ecdfe88a90e97091d7b8ad873e089
SHA512 261c2cedd5889e4d1bc05d5a796d750206baa617d9bd4ca6a94cb7fc26b562cd017bee7ab224a9ed3400fe64a1f80ffe662e934a0d5cee13350d9b6da10a5a91
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0VNyBo4kx929bL3R:D68Qg55nhceWu7PNU3/5B+kn3Hnx
TLSH
T1D9B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 aebcb1a9dda4ca86435322a20c166069789e5b3c088865d1264c8e7beccc01dc
MD5 99e347fb7b69741e96679688dbfd7672
SHA1 7506e5cac20276a158b7434718e5e6417f05e63f
SHA512 5fc965dbbb9af47ee9af707fc0017d9e2daaf95fe432a6fb0e36d8ebfbbfcf7b22914fbfc49a1d438985f3f2e1a46ef11640b04258b3fb4cc7977cb9c14c1489
SSDEEP 49152:N3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99n:cy5112gYy5azzVvt69nLKnhZO+k
TLSH
T1A6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 70938bf678fab16750c29a9dad020e2a1c532b63fad0a0d6b5dbe6055c3636e7
MD5 9de52bb4b767feda8226f02cab9f7ce5
SHA1 ff8ad08f0395da71bbe2b46bc193b8832afb4f42
SHA512 54a35d55a32715ee2a3d69311083e713742fd902f57b0172063e306780ca2b7aa87424a8ccbf4dd0c1abab0e90237ffce581a4525fac2f2bf325edbdce5529e0
SSDEEP 49152:eB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glDB+kn3Hnx:Mu6Jmdxd2dl+k
TLSH
T1BCD5AD13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d73365e7edd138019018d2e5f71e996b3cfcff4bd5bbe4877763c3437a92e51e
MD5 26f7baedcd225e68fbbbdc77ff68b49e
SHA1 c384976d0bfa553e636015eedee76ab7c6900ea6
SHA512 a81e0f7551d262fb96f2466e4fcbdae42994eb10c5f706f4a28a285e313667044ffaf859c4293391d870de97659e446097992e95700f03d1e18f50b1b321558f
SSDEEP 49152:N1hpsNoJpF1A63U44CwH7R4x/B+kn3Hnx:NmifPWRk+k
TLSH
T1C0B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 305502d62221eda0425927f9b073f5531b5770d2bc91c5fb1d2092a1e0688057
MD5 c28308212757a6c412a6e7a3bbb6e29a
SHA1 8156a73a6d6ff54b4a13966d932d730831c94fe0
SHA512 63a265c0e4292c2b78c12bdf4864db2a8c9464eb352aee36e5b9a6afe9d0f9ea0a02323ef036efbd3621cfa90ca94287cbf0c562af0e29eed8585b060df528ae
SSDEEP 49152:0SuZQIY0Be2KcRVtOnks6NMHqyB+kn3Hnx:m5dKii61a+k
TLSH
T1C3C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f1959ec3af999929abff3794fba749b0763fa62c46d8d8108614d59e302994f4
MD5 09bdd42a2c5ae0440979cb827cae6336
SHA1 8b2a40bfe8c466e8eeae6d4e580bce948fb9096f
SHA512 55b3f413e67b84e1abd7677c7f275e4ff843ec0f67082653410ccaf233141b5879754e2d3f33f8d4af536025ed236710165af434968698863bde11b563e818ea
SSDEEP 49152:4htSn8EApI0fig3giDn0AP5wzB+kn3Hnx:pX2imph4+k
TLSH
T16095BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b3e674e2dfd9fe4861a8e9da8eab9ecd5c1e6cb879e170031ed5981d98ec6ab5
MD5 0a5dfe4a06bbe347ae3e8b5d64d9fbc8
SHA1 fec3bf526c0c50808c4e9eb6323678ba112faaf3
SHA512 d4ab23853f129c38f952244f6c4e6a30640a422422f09b4e4b586bd89239bb46041c0d0c54602446a21aa748a13b1846186419da362c2a54dfe14f1ea42b4ed3
SSDEEP 12288:SKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:SBNyBo4kx929bL3Hnx
TLSH
T14B4523125A0C627AF76D3FB0644A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3a72781dd4b1a8eea39d9a0c4d4cca35160e9b405f9b8322f897646c11ea4a57
MD5 9ebdca4f899da32634634e52dca060f8
SHA1 6227aa85949a4f2fd6961092af453ef2009128ac
SHA512 c88d30e66ef0cf9cdab7625a957960e9c81f0a5ac3f139be9da6e47caf3233bb087ba4d9aabbafa141eacd0f26b6dfac82d2f7b37a2c8cf79888434428c5a679
SSDEEP 12288:IpLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:I2NyBo4kx929bL3Hnx
TLSH
T1334523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 401d1a657b618f2cffce1ba0e8fd5a7224913a8776554c15a9bb2b743651b1eb
MD5 d29494d49238f0e6c65570bb2eb5311e
SHA1 c8848060861bcaca19b445c571fb70acad685892
SHA512 2b5e6b9c77f8d307c7ffc44249cfe262c566a05be0ed32ba093e893d8c2c178e9963c05f3fd9b26b865b74b561d8476b4dfb273ad2fbd959db739f039ee7b421
SSDEEP 12288:YnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YcNyBo4kx929bL3Hnx
TLSH
T1504523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 852b11f43330d4c5bea78126eadd9861a6c8b8f07b8f26a5dcd6bc2c7d19bcc1
MD5 41ca7de421192ed2658a86c182195886
SHA1 cb8e01497c798919f81ff7dd1566eed451b4ee70
SHA512 73b56a9502834087edee66ce2e732f8de573eccf2cce60392e3816e0738575678e817865fefdabd1d5226581fcf967ab31789c92ae561e8029315d5fb23a355c
SSDEEP 12288:8VoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ANyBo4kx929bL3Hnx
TLSH
T12C4523121B5C12FAFA7A7BB098568054C835BC8A5B7197DFDF124C7B0DB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a7f502131d827c30192a6971f43c9a3b9ea5bb5d74f2978dade256627caff103
MD5 f1a6014f94f0e4777f0b71456de0f675
SHA1 743de19c284477d78eb6ec7641ceea123d1f46c2
SHA512 d2dcae6faa04125bb3fe928e7d87e4330dc6d539057cd8bf66a7b3f05e4ba3068ecbc51f4fe8b8960b65f9ac4dcc25b2c1816e7917ff6fe9790b003141bac36c
SSDEEP 12288:+gLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+fNyBo4kx929bL3Hnx
TLSH
T1944523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cedf65e4eb31082f7eebc60df8d9941e2f8e7d2d03be6203c20596a8ad4d9cd3
MD5 676a2012b07ab6e631a2fd052d56b8e3
SHA1 b241ee309f1204463e2cf4d24a2f59252114428f
SHA512 21c7b6ab7a3b069bcac161efa7396622ace09a2e8033146fbe0ea3a712b42beddfb4be6ce0b60488462ff877b262b0243880a82d26fbe8f2eabaf48da191bae9
SSDEEP 12288:dNLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:dSNyBo4kx929bL3Hnx
TLSH
T1F54523125A0C627AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 590d46e0a686c9c5eba57183dc8d43bafefc76fbab62dea445a3d2edbdcd13dd
MD5 b8715ec369697880b2449381e18122df
SHA1 0226a4a6f409553cc2d40c5902237936f7281cc6
SHA512 3408f7a4a8af52d35d8bffbe26b69a03caba8289e35a5bd1affd1aa319854464d8bca26e9d0963f22bab1f73761d89f16293c7e0534696d4230ee615046d380a
SSDEEP 12288:MhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:MeNyBo4kx929bL3Hnx
TLSH
T1AE4523129A0C227AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f341f4f9e7d40db4f9069de9b5638f5dc173428774583e7f29d78ac3af79681d
MD5 6c210c623698d78ed89540312f4caccf
SHA1 06371bdc746776771c6c8cd359ed65911a26b531
SHA512 fae54cf70b37f57f40716734666b943c05f382c6de0f47ce3bb33b7c4aa2b97232ef3c1cb83bfa553f2eef212e6cca6e12a557324507f9074a3771ff23f807b6
SSDEEP 12288:MiZwbjzzFEoS2cPvyJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:vZMXzFVSOWNyBo4kx929bL3Hnx
TLSH
T18F650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5a34c023f526d0ff7cfe5349afaf0bee19b7910f1b885276dc8ba4ea975a962c
MD5 581712edde34bfb08a6723f64aad6268
SHA1 4f5bf8975b9b354d0fa5f0dc9fe4ccecbc205ce2
SHA512 2aeb04968607cde9913aa20087019f58f9ec9a1a95acd06d9d37ba98f9a0534ac917f1f60be25c65be77f34b06130cc8819156a0e97c9ac21601f0b7e89fa020
SSDEEP 12288:0WLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:01NyBo4kx929bL3Hnx
TLSH
T19B4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0c0952a15955ca54fb1230a50ff608c551e422d3656cc0e0d2f77708f9ff0c5c
MD5 409c648121fcc4e58759c1ccb306a232
SHA1 7e90567c370b3bd05ca72a5f73a54eb5e798f3b2
SHA512 7a26405029f374640ddb6f2cdb0a9a93d25035d1d7ca40e3355bfe43c5ab10b7458c0ecb5b8d63e4c41df83ba3359a8e9fe3002807cf54fe3efaa037f1cd9c30
SSDEEP 12288:kSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:k5NyBo4kx929bL3Hnx
TLSH
T12C4523125A0C627AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759BCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4bf915c873e6b5c9a5c2a980e1bb6eb390bcd53bb92249dbd041980973379fa5
MD5 9acaed462fc3755d2e924282c5bfcff6
SHA1 151bbb0fc5efeee2161fde41cd369014ca7917d9
SHA512 7d4638e50a86f5291409deb56f214d49bf62e153607a6e3df006bb62e582699e0e686130ebc52645b39869eecb4df38e951d8682475a14a5b206b6f3355efec8
SSDEEP 12288:SyPz5L8VLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:PzyKNyBo4kx929bL3Hnx
TLSH
T13855120777A831F9E17A6234C8960A01E771BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a11029b74cf8ea49fb8ed9ca8429f9622e203c3d4a0c3adcf7187ced94c43fa5
MD5 ee7639d2849a227ef0821260e4f8a7cc
SHA1 0cc9cff24aa00650f13338f42a09aaddc2897df2
SHA512 648c91db4aa27bffd7ed4564c78ac91425075806f28e08d8a46ae24539c791244416e0867e6f0d57de92d7d8a31e7742bc9f4419b3d649228abad7ca2b46636d
SSDEEP 12288:TWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:T1NyBo4kx929bL3Hnx
TLSH
T1BA4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2720b27cb1646c95144660732cdf3820f3e0e2572d4283e0aea30ce676bd5872
MD5 ab75d85397fe250ee1096745a390450f
SHA1 9947eca99c2dd8a727c57d45696031b234a3195c
SHA512 2038074a9591dc72885ba274a07825fc4869d10e4ca7ec4ce02b91ebcd9203637fee03e2513899e85c5ba7f7b9d73006e6e21e0b42e3616177becbefc0c9dd78
SSDEEP 12288:UWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:U1NyBo4kx929bL3Hnx
TLSH
T1264523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0f163fc1516899d6bfe4218a96d37fe5e7f4b6f398b64d9eca5ce3ded2419382
MD5 e5af1f4fc2755acfd7bad63d8e7caafd
SHA1 0a1d5d6d859835dac7d1f966dea8590dac82fcce
SHA512 a75a979499c50906bc8b6217405d131d94c1e7d2fed520b3642f4642e93f1ce5de92e453f8c5828341779217735bb2c1a9da073d17e391301c13cccc7c70e30b
SSDEEP 12288:ryPz5L8VLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:GzyKNyBo4kx929bL3Hnx
TLSH
T18F55120777A831F9E17A6234C8960A01E771BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 112f62f2608fd09f7a081198dead6a78c7862ca2e43202feda1ee305a952d97f
MD5 e01827a4cfb7eaf446e79a7d6e5889eb
SHA1 f98d7b76edbfea79f7c26a71e0dd037306841855
SHA512 dfe26ef0ad6ff9b64ded900939d1c42ba4c32cd3a2584ad19e0bdc280900e7e6b4ec7c4898b4cf8cf3be776af16b2b263ecff371da548180bca24af029926d5c
SSDEEP 12288:0Cd98WYoaLHF3z0z04PDvh3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:NTtaLl3z0zDMNyBo4kx929bL3Hnx
TLSH
T1936501A5B35018F8EC6B823DC8568906C6B2BC5A0B70C65F07A4367B5F373A11D3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1148242045ccb5bf4842cd2dd2afb03bbc7d8704b6735bb118f9b9f8be3d0d88
MD5 9ad2b5b60d968f803ca76f2942d1f182
SHA1 3c8029f25713d33d96d82562ae5706ae276a4565
SHA512 c9868903a9a5860e31afaef2740b1f6ee083d37ac49791561d7aa9ac267c7d01130940e061441ee5ec3f33d4a23d5a8cf7c9295e9ba38d537072110bdb6fce98
SSDEEP 12288:bi4e7ARdTfgwCHKy7GLbbdIvELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:b3ld9CHKy7GZ4NyBo4kx929bL3Hnx
TLSH
T13F75CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5e60196d739bfd13ab60dc9a96b2975304aab7524e21ed9411b4957406d5e448
MD5 b491776a0459116fc096cd460904ab54
SHA1 af1184b2d618210040e27ca5a99d58c9e62a99c7
SHA512 375f11c2919e9d4eccdab3e504004651a49c32b505e7f1b22cec12505621bd61d74bd9bd2d926498acbd02ce6f2d8fd83cda0464b612b3e21f9f909fab41e715
SSDEEP 12288:nHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:n8NyBo4kx929bL3Hnx
TLSH
T19F4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9923f0776cf499af6541deb9ce4eac1db89531da5412b0ab7993d5f6f448b27d
MD5 da5d18c73a245eaf6e3bfbd14e3a5e5b
SHA1 498d69266cb05a49e0d07c8dfc9e166ae9172dff
SHA512 6aa3777226e887b468b2e9a23b6f63437e2955ccb29d66c598e25f450921c867b73fd33d9c157a8e9de9aa3173a53690d133082bcd23e28de282f15695ed89ec
SSDEEP 12288:31LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:3qNyBo4kx929bL3Hnx
TLSH
T1D24523125A0C227AF76D3FB0644A8558CC34BC8F1E9597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d6beedba6a03da83488b5f3aa97381886df6acb9911300417697ba8c0735205a
MD5 ee65a390ca8e60d14f0f1920863a559e
SHA1 4bf9e9d7287e61cbdca03a12368823afd084e551
SHA512 7cf06eed50fa1b64fe60672ccfb2b780cf9f20cb170ba8f139ffbff1de4cca2ddc313bcee9b70fb9a4a70b7e01c3de1addf76b420ae49618fda89132c06251b5
SSDEEP 12288:YELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:YbNyBo4kx929bL3Hnx
TLSH
T1814523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 274b22cd187174366c96c7a3d410326a23a83b6cd2860fac91ad20d884653fb8
MD5 310a04ed80e011f09c50afd09594e8e6
SHA1 a695cdd2f23a572c72782852448d73e00858427c
SHA512 c23752646842a788143df59d6977cf670906c23971f863d2313c33c393d1f6f69e8dd5ac8b2d4ef1b4efd1ff1b250a5b3f90bb42a22a56309efbbabd9c3a5f06
SSDEEP 12288:oWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:o1NyBo4kx929bL3Hnx
TLSH
T1624523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 906117d9b572743a8cb87078b9acbc12d58293dc369ab61cf3a6d8495f09e5c4
MD5 232390e3b88b40536520f232548f5a46
SHA1 f5d0ae59ae588b375c940f1b7dc64027fe456764
SHA512 d7800537c3180f10964e913f93796fdf31a905c9a9be1c1372e64f01d389a9459a14a9d5390546c04d7b1714760b9bd438b61624b1d7edb39f859f2b1e9d50b4
SSDEEP 12288:OHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:O8NyBo4kx929bL3Hnx
TLSH
T16E4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759BCEA24F20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0125be7e22a7e567899f1775c9c70eb6c38f3abcca9e60a72366674a82724673
MD5 a1e14aeacaa3e9b43e875856586a3475
SHA1 ed7ea9d49de045c47e3fb3f1d16325b317f05a29
SHA512 d68a5f4ac21d81c63bf0950703483dd6639fe9bfdc834ae94d4cba9c4c3f0dafa7b7ee39b2e9991a643bea47e8ad6f0927945d8f1ad92fb51a584f8439c09bc0
SSDEEP 12288:1uLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1dNyBo4kx929bL3Hnx
TLSH
T1844523125A0C227AF76D3FB0694A8554CC34BC8F1E9697D8EF27987759BCEA34B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0e0c5d7da9e52ac211cce7ee35f7da4e102f54e3c4f0ba83e0e279b812f37d44
MD5 46ebf8d36d696460848a966628136e8b
SHA1 f5ad0653458d33abc5284a9d28b39ca60b063346
SHA512 45458268459ba191b5d401cabb4d9ae0f5380026e040c5660744a5a9d1a278613578ff261e3f995b66cc5dbf658170a5333e4a7a521bd38cd4e2ebf5d566421a
SSDEEP 12288:CgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CfNyBo4kx929bL3Hnx
TLSH
T1A14523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 75a035d955440b5a1dcfa302fa641e887936399aa21dd0194a050c6f446dff40
MD5 b79604729b48fc48682402c62260519b
SHA1 a212bffd4b78e89a4d2929f366a68b209b732796
SHA512 bb16da9ab3e110d60b41c0a0d217a90df80f29942887dca11dd476253262e15b7ae0b0d8d390dcf73f2fed5dace0f5c4baa5f4037791eac07cc2f279cdf2af26
SSDEEP 12288:aPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:a0NyBo4kx929bL3Hnx
TLSH
T1D14523125A0C227AF76D3FB0654A8554CC38BC8F1E9697D8EF279C7759BCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 64ec698d9876053e929b78d6e73f0594a53d9529b8219bfa40a1389db0d31f2c
MD5 2941c1cd6ed2ed7c4b2231716ac900a2
SHA1 b62d38af3f36b183c95b8f09987771387817e2f3
SHA512 5e4ab0f63a277d8fd02f990e6af6c62c6187d0726c51623e00507c9449f97f7e759d63d53b4be83eaef3929b353fa73e694d1a13babe09f5752b0cb2d4c64e3e
SSDEEP 24576:xfwvqk9RX6wkyAIJNyBo4kx929bL3Hnx:1MnYIuB+kn3Hnx
TLSH
T10C85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53AE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c30f2766979fef207660fb30d453cd8ee78b381f4d679a03b44358ab78a768e5
MD5 be1b4369b8c3a1bdbed28985b15bef3f
SHA1 a9f1a1dad1b2f053322d1112c256f85ff0c3861a
SHA512 45d49c95a539b6ce195bfb03d4a6ed61d5af939cbdcdc773b57aae722e7aee2c5a8cfdb2cf8f2b3e128a23224f5932286d98f9eac30fc7f37a1a99a98d5fb580
SSDEEP 49152:QYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TB+kn3Hnx:3ySzPN+k
TLSH
T1F6066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 77f30074177ccb3bb3b3bba7ef439ad94f539751e9b65cc736bef15d4a226983
MD5 2a55ce47149b0bbfbf9bdf17387856d4
SHA1 700cbdac20581ef64c583c34034e805ab3377ebd
SHA512 2c8191f271fdd85de0daedfc14d2852337eb1b3ef373c207252f63045bfd30f59b2b9a44a2a950d5af83dacc99b77c37797dac6b15891ef85423e39a21efbf54
SSDEEP 24576:u47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYmNyBo4kx929bL3Hnx:u47JUQjTirIhCnDHUPfF/DB+kn3Hnx
TLSH
T1CC65BE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c821332bbd3f5c4d6b4395243fd28bd6e1c772a22fc3f80668c4467ed78fd5d6
MD5 d2d52825af044b7282e68ca07c067184
SHA1 c12002a66f73b03cee4e686f829b2a7500fafd9b
SHA512 98a828dc3536502690b90da9f4c27f19ad24f2fadfdc1738c7d95bfeed8e27d0d599d4542bc6a71b4440651bd65a8671d7deb927bb6160fcc082389a8dd69624
SSDEEP 12288:QpsfmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9lNyBo4kx929bL3Hnx
TLSH
T13D55F01AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E1F7AA909EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6e675e069586f661f29be3d7bce5946147adc2f0e1c4a4bc66d7bbed3a6d0f1d
MD5 315715482605388bb29055dad4e04228
SHA1 657c89902a9f3e6124859c4a206abde16b79e942
SHA512 b2d1d77547dbbbf6619eda77cb153473f6aa76850e6c6409a6affd3fb0b8f76b1cc18146f7bb27ac30c74059f961ef38ca0b2186e7a810f4bba05f6c61d20580
SSDEEP 12288:TZkxU3fEAVjfm427jZ9r4jblawvlRMHQuAPSr:TZMUPHreXrr4jb00lRMHQxG
TLSH
T1C04527407666C64FC6AD40321E32D5CCAB707D41EE04AF0773C99B3FD5B6658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b08a7479014fd5a8d9fb3b499cfcf8482d128fec6a492fd220e893e48201a7dc
MD5 b493a8a71518952a7950676766a26356
SHA1 6b306a8970b81b59453dd4f909c5f2e8f6d9e7be
SHA512 c48768e1602336a603d4cdf76f55c8b3b776fd13d9f430643736f3727f63ab5e6f2586a2d25c88564cff963401b3ae9cbf65836e6aefc96e521450d2d18eb4eb
SSDEEP 12288:a7BO0d0IkHJc2HBZpJVX9blhDwi4n6HjzC4Bf00d9PILNijvAJ98ygb85OmE2W:jHxlm8
TLSH
T13965F980A537E38FD1BA6032032A9B4C7BA4DC42B7496F16B3C8553AD826715A4FD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ea82744282782861f922e2f1634fda50c64312341e7e4d493ffe397610a2e480
MD5 78f4a5931c6cdaf0e8a2cd257fa91c1b
SHA1 421ef5aa3d8878efc38a3deb63302b5abd57ea1d
SHA512 87d22995f0d2565d4833be8e43cd026cdc416c37bdaf79b058fc97bd2fc27c809986498b96516678fe578704c38d990d405c91ff26c906391810fcc46bb49c9f
SSDEEP 12288:Ty7+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qNNyBo4kx929bL3Hnx
TLSH
T1EA452312975C663AFA7D3AB0645EC124CC39BC890F50D6DBEE1658BA59BCED24E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4e5fee68df44d44947de9ac416425db8a3fab70a5a4688523a14fdfc99bb9fd3
MD5 ca0c1b70deab10e0558796e1ee05b0c6
SHA1 510f6f72e8d119b67a59c6016d686867ac157b7e
SHA512 7d27076c3cc32e3e3831b45df81bd25dd49565276910b04041366af97809ed4e4f4dfbaed4ec7e897bd1472775ed4f0ae836a37755da1934656291dbd7f04027
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYzNyBo4kx929bL3Hnx:Kgb4mBIBhGFNB+kn3Hnx
TLSH
T1E765AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bd81ccc62d6c39316ef45a880825ebe03094d7c8287c8fa1ad63716c93308848
MD5 a78770034b4c20835be74e6d6dd8327f
SHA1 36ebebd7c8e1c3e76a3d5576026dcb51512abf99
SHA512 faac04d4832df1a66095a2f47122783ecce7c4ccf0e7bb37e73a935265d918ded1889a164ddf4515427b12af0758d5f91b39a305cd23205913a261297fb729c3
SSDEEP 24576:pG88u8FpJqH1Jzria7/mWNyBo4kx929bL3Hnx:87ZFPqVAa7/UB+kn3Hnx
TLSH
T11185F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f1660378a3374022865a363beb9550c16f153a8b99d79aee928dcc431b6a7e0f
MD5 1cbd98f131ae7a8f4bfe8025e2cb841c
SHA1 d89d715c1302a9a7ce9676ff84dbc96556c6232a
SHA512 c9926a957033b7c6b010e541d8005c82ec7c1f05603bd7f3f6214e4a8a3cc7cff2f2fe8bbfa4374857e4c8ef5bcececb3d0b428ee4c4d08b83f5a62c348ae2c5
SSDEEP 12288:vHvUrBFrEjwaQ9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:vPUr+NQiNyBo4kx929bL3Hnx
TLSH
T1EF65F22F22AC18E5F67AB17C85868609E771B8520711D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 df94b7ed381809e94bcf5654b4cf644a3a9a6b5e4114319c05575cacaab2b5fe
MD5 3e7126381bb1140fa264f9278c01c828
SHA1 d0be73e940f4763dbe1f80b2c66dce6ef96a4b5d
SHA512 7aa1ed9db7c1b5e33c593778ff8d40301251e2dee43783cb8d6f1637909635486e1dc9dde8427d69ca70500a5ec2430112f6867b077c485bac2a9b56c40ff387
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxB+kn3Hnx:0G05lO43b2+k
TLSH
T195D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a56016286250130d1f35e5391e0fe6e5b0922d686ffc26197c381403d6922102
MD5 2b5074c714ec1139358dfa1b347a3b92
SHA1 d4d10e4dab25ad7d25b193f20d7a3fd257eb39cd
SHA512 5e4485f25c2830447052d2f927970fa370742fcc3af4de4287986c6aed9f78fea60236a41ec51b91a8cd3558ecbdc0461472e9eda98cda915710727ab50345b6
SSDEEP 24576:5fa5POZ3dpuWVM50JicR2hG0lasx2+47eidngNyBo4kx929bL3Hnx:pa5POZ3BJt2pasx2+m5B+kn3Hnx
TLSH
T14365AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e29e1287af3037feb2a46afa82204860bb0647435986d429cff6a4eba208771d
MD5 76cafe19fb1ec2f046ef0d59f409d952
SHA1 4e8177d380d447b4d9ac7ea32f85aeb027793d47
SHA512 f5b72ce1598b77efde55b9a462d65ece5762cabf81a2e3dd359b4be51958a99d001701a0e6dc566807e5aef4b312a4a1e1245b400167a41338882b5e9f29b745
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkONyBo4kx929bL3Hnx:vNc/zEOVHF0B+kn3Hnx
TLSH
T1A1858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 21148621377b6ba7944ed57947445893a150fd3e3bff496fdeb59579d9abcc2a
MD5 b9c39f05f2f3ff7e30ab5d69b9ef3939
SHA1 aa757523e9aadede37f5580dee645c6fe891cd05
SHA512 5062b1b1b988fa5565e233564f9f574352ab30684b6a78d07113eb909825981b377bed27854f01c8bd1dc9c96dc7156dd14db98aa80c85c4fc0f4f0e1058c90d
SSDEEP 24576:5TkNvNnaFeYhJNtmZBm0NyBo4kx929bL3Hnx:5TMwBtOmPB+kn3Hnx
TLSH
T1F955AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 17128fb26ce9baf7730280931e30c2d2cc245945d98bc6a4aa658921e4d97a4a
MD5 748145b469f0fe9eb9f49861fed1d6e9
SHA1 21a7a80a0aae7fa00bf2134f122be8b3ffde99cc
SHA512 d4be8e0075cb16b6936c97c90927f527cf42035a345998a468b6b0353caa1d0abca4d8b0be93ec95c214e41155c431929e1e2f98f205d3cf732d51e5cec04dec
SSDEEP 12288:gQcMxWDXN1Dp/fshBItT1IQgAqLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:yD3FHshBIYQgAhNyBo4kx929bL3Hnx
TLSH
T11675E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-261-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/1096-307-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/1096-0-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1096-304-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1096-9-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1096-7-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1096-2-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/1184-21-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1184-296-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1184-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1184-15-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1184-22-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2208-62-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2208-99-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2208-68-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2404-104-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2404-110-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2404-103-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/2404-299-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3140-303-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3140-130-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3140-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3140-131-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3180-127-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3180-114-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3180-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3180-121-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3180-115-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3360-91-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3360-300-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3360-85-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3360-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3360-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4016-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4016-37-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4016-49-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4016-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4644-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4644-297-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4644-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4644-97-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4680-367-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4680-74-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4680-298-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4680-80-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4680-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4680-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4704-100-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4708-98-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4708-57-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4708-51-0x0000000000970000-0x00000000009D0000-memory.dmp

Download