65e6a9876c71ef2f06209299623a2a7797f92fd63b8beadf13429941efeba7cb

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
Size 1.5MB
Sample260720-wvs4saay6l
SHA256 65e6a9876c71ef2f06209299623a2a7797f92fd63b8beadf13429941efeba7cb
MD5 03f87bfdc6c34dcefc24a6705e86d92b
SHA1 d2aba474f2199de41367264e8ce5df0e25ee3514
SHA512 3439e9f16b0fc06207541db146b40a7e0d0469d79ab8f3e86b5272795710acffb9fe6f6ae9c9d712e6d06f78eac932b093bc1143522d7338fe7e2210d84a69ed
SSDEEP 24576:vHDfaM+XsOp4ak6iW4od3PZXrVCRJ5jAA:PL+cOGakUdRUrAA
TLSH
T10165F103B2AD7DECD066C134897145A1EB35FC301750E69F53A57B662E33293BD2AA32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5268	elevation_service.exe
3284	elevation_service.exe
616	maintenanceservice.exe
3460	OSE.EXE
5788	PerceptionSimulationService.exe
5712	perfhost.exe
2084	ReFsDedupSvc.exe
6072	SensorDataService.exe
892	ssh-agent.exe
2456	AgentService.exe
2076	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5d6a62db83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000650f93b47318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aac5b8f87318dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a546ab67318dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095f369b87318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4c65ab47318dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000176a73b57318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a673db77318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
5268	elevation_service.exe
3284	elevation_service.exe
3284	elevation_service.exe
3284	elevation_service.exe
3284	elevation_service.exe
3284	elevation_service.exe
3284	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1248	2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	2456	AgentService.exe
Token: 33	2076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2076	SearchIndexer.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2084	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5268	elevation_service.exe
Token: SeDebugPrivilege	3284	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4608	2076	SearchIndexer.exe	100
PID 2076 wrote to memory of 5896	2076	SearchIndexer.exe	101
PID 2076 wrote to memory of 4956	2076	SearchIndexer.exe	102
PID 2076 wrote to memory of 2752	2076	SearchIndexer.exe	103
PID 2076 wrote to memory of 2792	2076	SearchIndexer.exe	107
PID 2076 wrote to memory of 4604	2076	SearchIndexer.exe	108
PID 2076 wrote to memory of 1152	2076	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_03f87bfdc6c34dcefc24a6705e86d92b_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:616

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3460

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5788

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5712

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6072

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 1880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 1880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9f1867346a7722546b6e8b9834ec1f4bb51692ea14afc82329496fbc5b3992d7
MD5 fd5117f9c1be2f393da7276b20662a8a
SHA1 6357fdb55c44049ede8a41277e905421bcf08080
SHA512 f7409a75ad26602efed8627379f997a6e388685335ea36c0e12b8caff7e31d65210c3bf87d5252f4415078babcff34d7ed54208deb328070c87cd9c5eafd481d
SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSOGakUdRUrAA:Y3q6sjB5OGTUzSAA
TLSH
T148D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 91de23c093733c4f621f5c1f7c31bcf573b91b1db2cce7f0a7a4f6f9bfecde5f
MD5 aa37c6e4faafcc41814259d191d3e7eb
SHA1 ef88dbb853fb053491b2e46fd3c4a79886679803
SHA512 425f964edbae35a2815712db7ec304e49051b3e5e062aea366bcaf776da50e02cd2f9b1eb7841729df91935a5dd2bb8da34645dfcb27970cb71ead01ff81276e
SSDEEP 24576:eXYfDtczAysOp4ak6iW4od3PZXrVCRJ5jAA:9tc0OGakUdRUrAA
TLSH
T1C575012863D509F9ED67823CCDA28511EA337C454760E7DB03A4AA661F337D85E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3142d6afdf2e8f546a029551b072a7b509e70e0b93e3ca8771d26569eccd6ba1
MD5 4e6882269398e9c87c8345169c634869
SHA1 816b02b5bcc3c4ccfc2ae08b7c04596d9b9fbc2f
SHA512 1d9cbe8d6634a18e1b5870293c758ef12cd81a9c8ef3ac283b6cd23f0229b8201d990e229b66c0ef6a4d5f11e967d9afda23cf06f9cc1a61dc12c9cc84c8275d
SSDEEP 24576:40Le5ji0hmxxrMBsOp4ak6iW4od3PZXrVCRJ5jAA:4Pji0AjrOGakUdRUrAA
TLSH
T1E4859E16F5788335D073C0B9C5D2A68AED7134865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b72e6aaa0cda6a9bb68ad5ed3d979ba7db7b4d1f2d9f17fe662a07ddac27de7c
MD5 d8b9a2e290ac76d814e4b572a26146bb
SHA1 ad2735f724fe1416983b780e19dfc302ff1e5bd8
SHA512 99ddf53194ae9bc9ea347afaae8ace80ee8ef878ee8c1625737dec11e8ba523298a564031009101cafc7f34f739f8e86645b592f77e38b0b2ca84baa49b3dd0b
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyuPsOp4ak6iW4od3PZXrVCRJ5jAA:r/ezSC6vUzPveHjyHOGakUdRUrAA
TLSH
T1D5756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9872535f28e3ed1c331fc894ac739cb3a84054c285d91b9bef1a56d66bd059da
MD5 3b239c99f0f5558dad5ff16918802a20
SHA1 a03d25c9bd95d5061517ff57a97b407ba24e685c
SHA512 e37769c4624474b3535f0ae631a74fe53ced0a22cca4c21a8ff4c0b1b2b8ab5153289fe5ae920b25100b3a2a48c865e9f1461ed07eb7e94677f4748da73fe6e8
SSDEEP 24576:BVbqPb88hv/l+YmsOp4ak6iW4od3PZXrVCRJ5jAA:BVO88hXl+cOGakUdRUrAA
TLSH
T1EC559D66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 64022a6a1ee10fef5766b27a404f9e837f4da614061dd967ffd36d0799717b6e
MD5 fb81f9552f6c32c8ab66c1431112e56c
SHA1 00c49d97af46d241c0c09706ba10972875bc90b5
SHA512 15447c2e2db203dc42c6c7a36cc643d402beec6e448324583909eb94023c0d39be2fd8cb2d2855ecb56f66c3704353e232868714ef0e00495fb558f9bc611cf9
SSDEEP 12288:jLVss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:jLlsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T117552342814E4398DF674674EDD66624EC3D7C884C68E0BB8B177E8B643DB1BE095C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 72ef588d581c9889ec9083050ded1bb5d4f2129296f4e8f46d0c39ec9174e658
MD5 39b40f2bd11cb6a8b01d0d41db89c5a1
SHA1 1014fb70f024ff0973fab36df977a74b21730aa0
SHA512 4a95de2f9e6f5dcf0e4fa3f5c038cddf6a5931826508f8ba42ee6ec1b4c18f460d0edd7f9f6e983c563ca08b7cf08babf3f1a2532b5ab04340b4e16aed061801
SSDEEP 12288:AeBNUbTVO86UQss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:AJIU+sOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T13475CF3BEE28ECD2C27A8D785A918600D77678704F61E3CBD165830EDE236E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7141c4c4656655511c132250474123254334b0c3f12acf9a1066d1fa0ff50491
MD5 b1f600e433bfd989be94c9b3a205bdb2
SHA1 72c215eeb2ab9d416ce85c6d5f4dfb75a903e80d
SHA512 48cdc818029b80a3ec67556b693f659d9c2b6082dffbae747fa89a367c91c2c04caabfff12643d9c05523a141e8da314bc8a979481f2f23affc9c9fa6f00035b
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THb:LQvGAdlCEL8c/DRNw5CUOGTUzSAA
TLSH
T115266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3f2f7a5cc57316f8f5fd08a7ab19d90b5575ddb9cea9d20d213df38bcafbf3bd
MD5 eb65d9213a3c241f7fa097c7ae7dad16
SHA1 e30cb7be71244ee8bb48aa7ac53e2cdd05f5a6b6
SHA512 7d75e2a0d92c9210fd8bba744f2fd034cecb96976079ebca6b2ff5d344a88a3cdfdf1474e0d729b6e7cfe1d8f6ed577a6a0b047ca567608c3d6d01442bbe1b1c
SSDEEP 24576:10ewsAjssOp4ak6iW4od3PZXrVCRJ5jAA:OljbOGakUdRUrAA
TLSH
T1DD75E031FA75D036C7BB0DB61B66C716583C7D204B6129C3E3A89E8E59342D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2df7564c4df071f70951e26fb6b0131e031f02cbe36f4cac9656b54b060b4cd3
MD5 91dd232f69c7810c3fa2e849b1132e76
SHA1 8b0b248467379d009efc42a03d98b7e191b10d50
SHA512 fe3287f3e67197fbfdae4111be03b64b2d92bd00eded3fe9a2bdedfe8295d107d1ad15d6934ceb8d36e7abd328e98dff4191de158596b2f3917363581b04ae52
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHrUz:fUEtQevvqc2W1cpV2tI324
TLSH
T1A4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2742f3bf1e685ccb91d7f4f2aa7c9e4bb21125c53437ad969009ac4c103f5775
MD5 85491aab7563bdde271103a09f18b880
SHA1 9a332d27874d415ec09e04bccbc34000f1854f0f
SHA512 ede232e02d97dff3b6d43e506d3498178ac462c39a03d35e610ab555aaaa023844a4a186b3c127fd8cf52450705eac12fee1555fb6e0a68709a289a148e18ddf
SSDEEP 49152:9CbRquA/m2yL5zLfFiV+XenmE3/z7OGakUdRUrAA:6oq2VjnmQOGTUzSAA
TLSH
T1CED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f75a819add7d958504f07bf72393bc0224ca69645701294be6fc02f6bd672bfe
MD5 7580bb32f1829375f18c479bc5210610
SHA1 d8b80640986256c8c126509a93852bae9fe6f93d
SHA512 1f267f29b314b3e35f6a9b910dd1a31fe519604e3244dd8293eb2da3ee25d112e1f99738ddbb01ee7c71e72b7ae27dd0e76dcafd90ca4a908aa81f24356f49fd
SSDEEP 24576:dAhGL3IFoiwtA5l7S53bsOp4ak6iW4od3PZXrVCRJ5jAA:dAMUFoiq5AOGakUdRUrAA
TLSH
T14E359D81E7F945D4F5B3AA7899B69170EA76BCAA5E30D20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 89ebe48895f688d31f64bdd6aa02b21eef9f4049be1a27eea8863257ef2dd3ac
MD5 195a643169b6b251683c674b568a4d00
SHA1 82f1c3cab6c09e06b3f4a07d6dfb34541973ad81
SHA512 816b0bf71b8e59272209dc04072a94c4f85dd677665fca7823fa8aef301875659b0ab095b7fc4df12478a06e3b254cce637f470f51e9e88bda82795f886f3509
SSDEEP 24576:wwu4OWYsOp4ak6iW4od3PZXrVCRJ5jAA:wwvOsOGakUdRUrAA
TLSH
T1AE65F14672990CF9E9678238CA97C136F7B6BC052A25D71F0760C65B6F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 00d727147bffdf2b88054ae154d7865a6ebdd1b6ade96fa2d677b5703b382ac3
MD5 0e01e4ea1955bd0dc0fe18a6293c62d3
SHA1 1515b0ff8f9c4e7794bafea35539873cc5b69e5d
SHA512 ca12ae846e79f9282265a2c551d5f04e197261d6a2060b304e052520e47d6407749485b722d3f37e89215dd84416bf57e22b7a9fb91c487026301313e1fd2c6d
SSDEEP 12288:OeZ1IySss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:TZuZsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T10A55124A22C822F8D6A34238CDE15605EB767C561735D3CF0625669A2F33BC66D39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a4b1b7e829432dd2377a00e3793b17b774e8f4294e97dabec3e8678d0f45a718
MD5 542018df1a1c78d11004529592a3022d
SHA1 49bdca1042ada31dbaf0f89d9d69fd249d381b4f
SHA512 5740aa11a94a0e1d3e65f7911e7d8f4fabeb0826c50e37bf976687e065c6e12f1b522fee8236cd44ac754f549d4097504d4b50bb0b9cd0108511035abb335f21
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN39OGTUzSAA:YQyiKa/X+PNhUz
TLSH
T167667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ef91d519eb3e1a8981df939ba11ebefaa256f0bf552600ecc26f14001c3ff1ba
MD5 5b8a5fbea91b621bd3e6f39fedae4228
SHA1 a0da9319b84c7ffccf79965a15bb874580172cb0
SHA512 aa09b4f768fe9dc429629be7d58737820685fd3e3988d0ed78e6d5063d4cacd86afc866001cebd9172d8fb74c38fb3db7e576c7cf172da72847f14f7aff1d0a9
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN39OGTUzSAA:wQyiKa/X+PNhUz
TLSH
T1B8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bcd5024665c21418734535204f50f586cc882eac776230752cfb3fb6357b27a9
MD5 3cf43765e1776beab27a87ff4c593ae2
SHA1 e7561dad1f60e1a3c18bf941c4df54d0944843d8
SHA512 1f9be0d91ac4ac7b12edac7d2d6c76c6f0a7995709e3200c3853ca42d32b02fe6242d7da22eaf3aa00eeaf458183118ff4259daec041eda854b616dfb8bb8163
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0psOp4ak6iW4od30:268Qg55nhceWu7PNU3/rOGakUdRUrAA
TLSH
T10AB54933B2F600A9C44DE1769F4A873196E17C758FE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1402c9c961211f1b3694a7a976eec69dbe165eff28c1e740da049f2430d02293
MD5 c79cbcfda9efcf1caa4b2bb5771ad5a2
SHA1 4866a43f3eba92cf2bfdc7d874a5f126e6e942c0
SHA512 ec0a9f263af3919c948996e556e5bc6de34c1e9a89b95c590b160d70db67aa3a8852ab1b416692d027177365c4358f66b683ab1c5857b94c32e9cc63b5928d99
SSDEEP 98304:9y5112gYy5azzVvt69nLKnhZOOGTUzSAA:gLIHEWhOUz
TLSH
T18C167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 226608aa672eeda22dbf8cac35cfce762491d5a992d3ba58400ec206c574a6ca
MD5 772f7a82342ea9144218dd71739181fb
SHA1 a19a5e34b2f1ac757ceedaa3bf58ea61bd4a2c98
SHA512 f65f7e04b7044e812a75e2a7849436ef762a61b9b39a3d1fe5ca9aefc33a1bcff1db964c99a0c86e689555fce60fde015889bdc10066ee279c7f0d4fbe360c62
SSDEEP 49152:1B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gllOGakUdRUrAA:7u6Jmdxd2dlOGTUzSAA
TLSH
T1ABD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9898facd0ddda76f072559b20862f77cbdb275a9d0f6c5703a11939132001f3c
MD5 74533c355d5d838b75e6bc8b1afc3d6c
SHA1 86136d5d84bc85663701bff46db2b5729f3d7ac3
SHA512 37fdb9d23d164fe6082365e5047534202fa0bdcc6581cc8b8d8d9b6dbc3955fc4179b0f11a47f847bf1871ec9d43a5deb53d666a0d1c73e7be43e0b9871e7a6f
SSDEEP 49152:v1hpsNoJpF1A63U44CwH7R4xxOGakUdRUrAA:vmifPWRQOGTUzSAA
TLSH
T19BB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c7148015ba102b22c69ac9a557e937614289e6a72bac2a229d566dc1b0342eb3
MD5 db5140c880d2713a4543bfa11c2cca75
SHA1 c9f1ec5cbe9c2d3dc6a8c3485c0a037ee85c8627
SHA512 de6ebd768f3f222e80bcde0f948b844fe8bf23f1c2cb4b193e94988990346d1f0d6441b69040da24cc423d2133e36dce16b484233a01a3d4477e965cf6ea8d8f
SSDEEP 49152:VSuZQIY0Be2KcRVtOnks6NMHqCOGakUdRUrAA:75dKii61COGTUzSAA
TLSH
T1B1C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 42d22ddedbe956931f85622b91236cb2ccce10210c1ca954fab26f57e8554d1a
MD5 59574f78cd0181e2e1264d4fcb5901f6
SHA1 ab6cf78e73e5d96625c8d0925eac9bf66fc2ddb6
SHA512 a86ba5517534208e5f2f7b7c53e2bad8721a79a62312f1c39b175f6d60d78f240dbd7d6e7dffbd88629c03ea950ee01e1a0dee3f05c11ebcdbbb86a370308f7f
SSDEEP 49152:GhtSn8EApI0fig3giDn0AP5wVOGakUdRUrAA:HX2imphMOGTUzSAA
TLSH
T12595BE13F2D901E8D05ED178C7468632E962BC160B38B6EF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 caaad52b359f06d47efad6be13bdc414bfe1765d135d4eaea14afac47079990c
MD5 7c0a768bfe2876a88b81c97cdb5bae3e
SHA1 ec6130c5b78638a1ec0671eca78d2c6bc21f7c05
SHA512 3dc426a65cbc2dcf2f0e4ffbcca9cac6e0bf99af3d37bfc81b6d8abe277e14fc234263c2517e62b4af2878809bb95d90e4b471726108b2afc3a0898cfffe04b1
SSDEEP 12288:ONss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:OdsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1E3552302808F4399DA164274DEC66754EC3D7C8D9C68E0EB9B0F3A4B753AB1B6495C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 17567b4de1e639ccc41d862dff46752f918a5691e3449ecc5ed2a34a1f0df67e
MD5 d9ee9d4a68e35e2fde3befc115158d0b
SHA1 e4bcaf464a3ddb4b3aec2326ce8fdedb6d1bbb36
SHA512 067e8fcd6793733c261de3a44e6fe285ee6b1faa0094bbf673f1a3d0476727ec534984f9e476f1711c90228a9eb524e7b6d5c28afa84ba2f046b2001a5e99d40
SSDEEP 12288:92ss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:9gsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T13F552302808F4399DA164274DEC66358EC3D7D8D9C24E0EB9B0F7A4B753AB1B6495C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 14bc023331eaa006e70b79bed2851eeca73d5e7898a9645690191d12d446c23e
MD5 cd6b818663d5241001074be6b92de9b4
SHA1 cc63be1f04a082095c8add8f27f902af609c59e8
SHA512 98d8ae7bb84da633bb5ef044305bc54c03b324bce7c8a111b13631261f03141f9b267098f6cff14d41162922a0cc0113d0621d620fbdaf9db0ce5bacc619b4d8
SSDEEP 12288:OIss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:O2sOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T148552302808F8389DA164274DEC66354EC3D7C8D9C68E0FB9B0F794A753AB1B6595C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f2d2f2768de4b69b7fc98529eb05347bbab83089cbfa30bdaa6e1e8edaa9f33d
MD5 cd01c3d2a1937dc2d2b489f6e627ad5c
SHA1 7153bdb98227883335b312eb5e4b24ca96c486b0
SHA512 6c47d20ca2fc4ee08c8dac9a7f7ff3098c229bb0d7dc5f70f581c70b0d044b7691e2e1d41e97da8ded75cf0703b5f4280425ce75c9faac0af54ad0762e637d91
SSDEEP 12288:GVnss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:ksOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1FD552302528F43C8DD67C374CED25214E97DBC889A35E2EF8B063D4B2D36B566874D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3eaaf36ed7a061426329f6e140a60bb60cd0ac7c4336681f7f0facacbf6164e6
MD5 c4c47bc3b96b2d0939a1fb0cdd270730
SHA1 fbe7104d006ece4205dba5f08ab2dbddc95cd7a4
SHA512 813c5deefd7c76edce176426452bac67bc4850356830c252f1c6d8cb59784bbabaa4b715e9e30235e37f407635858f5c6531063d768d403fcdda61f7326b3f1c
SSDEEP 12288:tPss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:tjsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1C1552302808F4389DA164274DEC66754EC3D7C8D9C68E0FB9B0F3A4A753AB1B6595C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 62e705d1f2ab126b14f3f9bbb6b635c4ab927798cc2ae482afa4ac754656f2ad
MD5 404cc3cca0913729b54421535dbbdbd4
SHA1 d2cfcf07fd1953fc114a7987485d8f51bc6cdfc5
SHA512 435bb1aea167be48f8d7f4d2ffad16e36bfba8f9ab50183159208d2d7364e022549587bbeda0b4e3ab054596e9e0eae734d0f2075418935fa2e2b01c2130ebec
SSDEEP 12288:nass1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:nEsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1AF552302808F4399DA164274DEC66358EC3D7D8D9C24E0FB9B0B7A4B753AB1B6195C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b1455234fb9a2e2b02518b13bec7725a22c7645e1c3017d8a46ebdcf130a5fd7
MD5 097ccbb310a6abe9b275ec549137a085
SHA1 995b07d59459f39643e89cf490ee1c305062450e
SHA512 81cf30e5f59b22ce6b9b6dc710a5e8775c14ca0cc83f1580642f52ae8698d47414a5a3b8277e7f9f1b79b1017608833f3ead377cb063f16d13b50f8b734ecfe8
SSDEEP 12288:++ss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:+osOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T17C552302808F4389DA164274DEC66758EC3D7D8D9C78E0AB9B0F7A47753AB1B6095C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e950caa51af9abe2fcde870d3351105e09159083b59006fbe8de4d28f105726f
MD5 f01f985b646d30715d894fed3b659eec
SHA1 4ec936b7d7211a1a0b15fbf2d68d915334de628c
SHA512 678f0a3fdcc581e5540f4faa54c5a5932e53c9b550e33796218b9b668aab3048f77221db19b288d6f7c0330ebd808ce671d9cf4ce18047843817d819842314ec
SSDEEP 24576:GZMRzFVSOAsOp4ak6iW4od3PZXrVCRJ5jAA:GZMRzfTOGakUdRUrAA
TLSH
T1CA750195B39409F8EC67823ECD558905D6B27C5A0A70C65F03A8366B5F333A11C3EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0c10e73057ca4a1ed63aed65080b13e1ac2fb69b13aee642f9601901f89c9355
MD5 c409059355e5017d75530bd112e4417e
SHA1 aad5cf08c788f7887df79a14c0b5c73cc381c4fe
SHA512 b7b205a88d69b210fb7cc05bf7da0daec71f84d51b1a91f4cf3dc7642276cdc690d728a6e87c9592d08f7a65e4c48ed72db4625cbae763f0502ce5e7c03c3c61
SSDEEP 12288:yZss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:yJsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1BE552306808F4388DA164274DEC66758EC3C7C8D9C75E0EB9B0F3A4A753AB1B6595C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 be80955e9ddd69cbfa5fc300b8d7174b34c91f2f038858fd290acb6166ea7a5e
MD5 8061a4927190e1ceaf2f81f9c26f0f0b
SHA1 9cc043195073fbba5323479af79f29ae0d5bfc19
SHA512 4c5c00cdeb14816ea6449c303ecbc992b9b23a1522a316fcafc73e1450eaae0331847e8b0a8a16e1a147b120d6702913a8dd3951095b58a0ad945e2b1477c059
SSDEEP 12288:cFss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:cVsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T145552302808F4398DA164274DEC66758EC3C7D8D9C25E0EB9B0F7A4B753AB1B6495C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c99e25703ccd0e9a66b9770eaeb6253ac84aeb81dad06b0b1a08718c92b5f494
MD5 40b7e4c258ebc9421753cffba22fb2d1
SHA1 5114fb86964b639ecd1d16e410b12069b44abaae
SHA512 30935739846265280bef3decda01abd398f45f0492ceb6a889c8ea391265be9516fbc7f7fca4d65251fed893de6205b9ab44aeed24ea9f9926e4cc9a28a63eb7
SSDEEP 12288:QyPz5L8Sss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:hzycsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T16E650207629621F8D5378238CD921A01F779BC364B30DAAF176427762E377919D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0237d11352df33a412b084a129b98f07dc7bba036fb353e0422ff0a8e126c965
MD5 aaeb90c1288ff1410e1a57154030edd3
SHA1 352814d19105b3705ae1d7d7ab7956d7592ae4d6
SHA512 344b926905409dcbe206a6eade68d938c662893375766cf27d0540881d61ad3504e2c41e67411a0c6bcf45e30f8b50f7ac35512b3b5b63bcf16492bc02bff847
SSDEEP 12288:MZss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:MJsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T16C552306808F4388DA164274DEC66758EC3C7C8D9C75E0EB9B0F3A4A753AB1B6195C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c67f4bd027d7a14f07d7afaca3a8dd20d92fd1776ca66fd9819ce86f5cab7f89
MD5 4837806ab3ca0c27b4b8a4292aba3971
SHA1 b4ddea5c8ee4ba60a01e90f4b886ec751b5dbeb5
SHA512 9616f9db9e989b209d4fd39b5afba186cccf6e858c068f06ac1db892db5aec8ee6313ea6097ddd644cb77464b2c795805b102991f3faa5586d55018c6823903e
SSDEEP 12288:yZss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:yJsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1FE552306808F4398DA164274DEC66758EC3C7C8D9C74E0EB9B0F3A4A753AB1B6195C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6262e6617cb782492bdbd37c9b7dfc9eacbcf3d0eb85d545f48c72866b60d4d7
MD5 2f99d69f56abacd9c1df2aecd86d738b
SHA1 19aea62181fa807cc75b17dcc022ea5605b94e2d
SHA512 4cfb4fb0b9a2626307bac32f9fe6e56913726014490a0d04910f9b55ba77499cf27e311cc226cc055509be0c0bba8e06723f62d212a95c3161e065a8464a9132
SSDEEP 12288:AyPz5L8Sss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:xzycsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T15A650207629621F8D5378238CD921A01F77ABC364B30DAAF176427762E377919D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 96606fabe5a395a3e283d00934502842faf6269582bc2044a64dc40b9c9c6eb1
MD5 a25df61d787fa059c2e440b6c5c5439d
SHA1 2ffe4c01cc37cc77dbafd29880ce9ddbbefa7ec9
SHA512 f4f8020c3130faaa03d4d9426d69e457677e8fdc674c3e488582597985844097a46d84a3fc289db2b91d1582737424c43731deca644ee4146d9e40c9abf34f62
SSDEEP 24576:nTDaLl3z0zDGsOp4ak6iW4od3PZXrVCRJ5jAA:nTuLljkOGakUdRUrAA
TLSH
T131750195B39408F8DC67823ECD558916D6B27C5A0B70C65F03A8366B5F333A11C2EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 563d5198eccf6f3985563fbda57ac600818400492e66a405fa7f3bcd81c4460e
MD5 9589d92b716eabb7331bd4da85af734b
SHA1 ebde9f198bc4874342d2e94d10b35c7617f1d5b0
SHA512 3166bde05e662c347bacdc28daa68189676e958ac1ef1eb6aeb8844ec1bf25a923bec6ab6455daf0f522977813dc920b2120e75df188371dfb27bc1e8ee60b02
SSDEEP 24576:A3vd9CHKy7GZqsOp4ak6iW4od3PZXrVCRJ5jAA:Kvd9CHKyaTOGakUdRUrAA
TLSH
T14185CF90F3E811E8F1B78A35CD665511DA767C5A1B31DA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5d9577b7e5bca8747ec2256835cf65e1abf57cb265dadac48d1c3ca33c7fdc9e
MD5 baa35867e799f0b614f0765a67ef32ce
SHA1 b344774611f76af55ee0599c0d34b950a1528295
SHA512 a4eba65038211a17ed7c8856f402a83c722fb27108e80a46a122df6f35f4cd5dd82b643338179e96f7b0997c19264abe15ffe2d20b1abc1031aeaf6065fb6cd8
SSDEEP 12288:Ooss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:OWsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T108552302808F4389DA164274DEC66754EC3D7C8D9C68E0FB9B0F3A4A753AB1B6595C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c93401b6aecfd275bb81f9544a5bd307a4a070687e8c7c416c808dab350edaf7
MD5 e6debda107b52d2e1fe28d56181eca6a
SHA1 98186ace0ba94b14b1101b7f1295b2da3879fd40
SHA512 201076e59a5ed96082ca161e8230384d00f00e546d8c8b0f77c2c2b2e244b1e0454697fceb36e53e23355a6b2174acfb0c986a975c42f7aea56d9fc8be0d6b1e
SSDEEP 12288:6yss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:68sOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T140552302808F4399DA164274DEC66754EC3D7D8D9C38E0EB9B0B394B753AB1B6495C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b2ebd53fc3bb656261dd3084f423328b9e0428f9305440ed6c221a3f03b7fd3a
MD5 231acc7b7972b7a8b7855031bc916df7
SHA1 df68fbf66b2c2176db6e0feb6a1da639b529f951
SHA512 cc0fb52b3c9b5fe592e8deca2e40c38f5a6809d501b7e913b71fcd076c97e1c568230b7a1e4c7ea8043f641337411a0cd60650f0d339d333ab0a2e1b46a84ff7
SSDEEP 12288:LTss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:L3sOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1C9552302808F4398DA164274DEC66758EC3D7C8D9C65E0EB9B0F3A4A753AF1B6195C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7990d32f14f97ba4a4ac19f874fa24ed312d05658e1e849de8c9d349060738fc
MD5 f37466803389c4fb8e0eb1569284bec3
SHA1 b80c6c38227fd41c832f7003fcbe488223c34f63
SHA512 df79ea9eeae3db1aee17f798ed5dfe6423d26154005a8fe0c8034c2d047329a42231b8811c042ba84ec4548dac2361c03ed5a877fced7f6f603e58a2bff615cf
SSDEEP 12288:1Zss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:1JsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1F4552302808F4398DA164274DEC66758EC3D7C8D9C75E0EB9B0F3A4A753AB1B6195C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 89d51f8bfc7dd7d8fac186c79a32b06e8e56c592ab4d9d7c2895eedeec6d4aa7
MD5 433ae4b6f3891f1c4058b80e17f5c8c3
SHA1 e9eaa6b0a8c71471116ac2af69368146cd5679d2
SHA512 8bc43bc4a7c248c483f8409604ba897aac220e6d87a14703c9d1fbf58f7c28e9a7f438b92b09373f12579f7a6fcff1e28aa4f19fed22536668c5c766001a199e
SSDEEP 12288:Soss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:SWsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1CE552302804F4389DA164274DEC66758EC3D7C8D9C68E0FB9B0F3A4A753AB1B6195C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5c47a0810ffa065d0e43f5a4f024dbd720b092512caa4c3a942fd1e9ea2d6305
MD5 5641be76b8576de7d10e4b3e453460cf
SHA1 ef58a78a6074c912860cc27c7dc83fc88883b42d
SHA512 cf6b88946948e06dfc91d64baa28b725913506bb93512157478c070baf2c537c017d6ed5fb9cf7d82c835532980a15539d9bc52d1bef3ef382d3af8880879c0f
SSDEEP 12288:Bhss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:BRsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T127552306808F4388DA164274DEC66754EC3C7D8D9869E0FB9B0F7A4B753AB1B6095C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2b4e486224cba224cb103de64708b88abe949c2f0b77d3d99c51d63a59322b06
MD5 c35d99a367111fe73e0f6dd5b684e233
SHA1 826e1ffc52c05c0c6f1ba7f41edc3b2a20e22fe9
SHA512 27e18435b8c1207c565436c77def061b7098766c78305d48f169bb04746cd966b2aa25442db44be72c1659df7c4c91f9f591621badb50ce0cb5d3ac5d01f553e
SSDEEP 12288:IPss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:IjsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T11D552302808F4389DA164274DEC66754EC3D7C8D9C68E0FB9B0F3A4A753AB1B6195C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 98098eee3900086812eb93e7e0efa427d5780d0e16518976a54b9c06db00b9f4
MD5 e4812ef2a49e918837fa7f14c6b63636
SHA1 f7faa0403178b3e417c76dcb96925e37269cd930
SHA512 c81b2adf5ea0a671d0b1e6de91572d3b2395f5be6c08682084eea44bbc0c137ec8d4f23f17e6e9d41a67f85d693100a007c95c6a86780ad9194d66bcd726af91
SSDEEP 12288:cAss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:cusOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T10A552306808F4388DA164274DEC66754EC3C7D8D9869E1FB9B0F3A4B753AB1B6095C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 c0723d1bd0104cc53fbd5a62f9bd93e50346cdc1f20bf77410c28f8d1ea5aa89
MD5 1110d50999a7c7c56c7fe5b739000436
SHA1 807552f92ba014bbc5b0d1c65ebc5ea1bcb3f2f4
SHA512 85ad0cfe960f7cca3e389b35fbe496df18360f50458dc79806bdda39e4693161601ba9da8540dae1e78ffc36822e75da32cdcd68f8b385c44a694925593165e1
SSDEEP 12288:OPss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:OjsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1A0552302808F4399DA164274DEC66754EC3D7C8D9C68E0FB9B0F3A4A753AB1B6195C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7c12b7397f779a21249eba1826f081f663a37cdf4a82e68d7bd73fa6a6d0de54
MD5 d560b57b41fb3ee0bbed661e265b5fde
SHA1 c60957820fe3ee3a2b85f7a245d38b01d3edd57f
SHA512 419ff5f44e21e228339695a988e0cf305c6854ceb847fe73425b78bc206bebcf009e3a80331d889ef3582f4779ecfedd716b00db7a9f12dcd633996f0ce23dd0
SSDEEP 24576:VfwvUk9RX6wkyAIFsOp4ak6iW4od3PZXrVCRJ5jAA:nMnYIuOGakUdRUrAA
TLSH
T1D785CF29EBCC44E5E177923C8DA7460AF6B178591B31C2CF025A53AE0E37ED46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 842115fc3e5e87f17ec8590ef5801bf239a2ed6b670dbba988cfef60f01cb2a1
MD5 e4be516a81c996a28787f5065f5de7be
SHA1 8959c7d4ae6d705613aa0fe5dec0095fb8ec6ac6
SHA512 4ee182998e4a973283791d6b88e971ae3cb80f21b6e97fbece4dbdda0d45e4ba3212ca37adff069ef963802a031e8a04264859461cedc3c63de1ca669c0e4881
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01OGakUdRUrAA:/ySzPdOGTUzSAA
TLSH
T17B066C56A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 191e3e04d354ed55a46353b8b4d4e9e7e1043392b98bcc070da044b496ba32fc
MD5 be992010ab1c3d9db8fcf1fa46c9b56c
SHA1 774b5447d2d515247bedd445aa833ca13ef7f056
SHA512 0794c1e924dc94ea03112188dba245539b0d9ec2aa527593b658eeba36c3bb015759e1db8925bdae60acf9244a95b3d106f82d54616f4c636103ad4cc311a2f3
SSDEEP 24576:s47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYwsOp4ak6iW4od3PZXrVCRJ5jAA:s47JUQjTirIhCnDHUPfF/lOGakUdRUrr
TLSH
T11165AE1EA3EC02E5E1BA827885554A1AEA71782D1F31CACF1270537D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 cfae566f19e42c80e33b61a301774b733f881154fec376d465bb4c73697a2313
MD5 ff755c587a5bb324c2d40a28ae829259
SHA1 6aae6bc70bdab88c1c98b80edd168d5cd46d57c2
SHA512 2c801727747a7de898f55eaaff5be2fb8eecb4b12784b984f87a09192cbc381f74b2db44321c557816b401ecc4c0a898c1d2d6c5e72f3a7742b0651f02af4ccc
SSDEEP 12288:Tbsfpss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:mZsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T18D65F10AD28802E8C06E5279CB865640F73B7C6587E1D3CB57C0F93E1F366959DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 8491da9ccad74f6c8aef7ae1ce83f20ccb7bd4e5eb99fdc690f1efe2214cbd90
MD5 4536f54e2d7c923d132b0f19ead24e6a
SHA1 93dcb13549b10ce692807fc9e87047c023fb5427
SHA512 8ecb27d7cffabc842aacc682931fae2b8d44a6c749913a658c7f414c706368cfcf4518b0470b52d3b35202b77f1ee74f74b01b7044699f019d43bdfc0263d86a
SSDEEP 12288:bmqeU3fraLVZ7G+RQgr55UL3tl+a1JkbiO:bmFUPry79d/Mj+c6biO
TLSH
T1BF250610766AD75FC6AD40325E32D1CCAB707D01EE05AB0372C9972FC57666CBAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e897852b0069be9911ee68b1405571c1e94b3662706d3f25f44a00ae90229754
MD5 57b30083254e47df7ec1a992252d7050
SHA1 07031db725993260b4453ba99de5d33d8ee4aeba
SHA512 084f0aeb79d3a4a71907873a06229bad2f02972c6fcf7872d162cc25c6246d8056ad2a776616d5f74c11fc265cb3f7dd7689faeb4289fbada67890490a657033
SSDEEP 12288:XtWocAlqSvaaGQ2WozpAEsWCBOdYOaX+wq3HD4gyXqR3JGz:XtWKvaVQ2WozpAEsWCBOdYOaXI9sh
TLSH
T10D65E8415537A3CFD1FB6072072A9B4DAB64EC47B3455F2673C4093AC82BA26A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 102f32fe82928d73a96a7fdc4b990da6939981cf93de35f029051d3f4a992dc0
MD5 17f43e2ecaeba252aa36691855a19ba7
SHA1 473f5644c89b3ffe89c890269a0dd0686c8a9512
SHA512 f61487293a8d17f5189b37f17391fcc4401c57594857a03e56ffa2619462480901073b8007c1da2722cf9b5c8d3b2f38973df9a35e6131a1c935af5622dbecda
SSDEEP 12288:IF7xss1sOp4akIx7iAv1Nso6+3eGZXrA8yChNC6SIu52BaAA:shsOp4ak6iW4od3PZXrVCRJ5jAA
TLSH
T1D8552302824E4348ED7643749DDA5224E93D7D5C4F24E0EB970A3A8A7439FC7ADB5C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a9779042e28e386a8d8b619ed95437badfbd7f17ce10e11c678dd458bcc4a5c0
MD5 cae4b68aa1cd814349e3e198c8d29cf0
SHA1 e01f0534b73104092d10b75367a113ea45d232ed
SHA512 23cc611b69ae0069db20dc920c42f6b5fea68bb39fe027f5bd2be4ca6b5eb6e85f5ab926de14e91b36f147260d59d9ebe556433522fdf37161cdd12048612198
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYPsOp4ak6iW4od3PZXrVCRJ5jAA:cgb4mBIBhGFvOGakUdRUrAA
TLSH
T19565AF1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3abdca48ec9f77a7a9833f2fb710e1b46d82ea1da5cb325e833122e1fe63fbc1
MD5 b31d2ba348d427ddcdab2f2200eeab89
SHA1 27d2a927dd2362d7acdbf9e72da64466a704b9b5
SHA512 641244cba854099fec6c927c1821b494785d1c7647af43c404bc1c14617375d54534b6706473d4a3e5f9651f185f49c0e7737e024885f4e509fc6d80232d983f
SSDEEP 24576:CG88u8FpJqH1bzria7/mAsOp4ak6iW4od3PZXrVCRJ5jAA:Z7ZFPqVea7/cOGakUdRUrAA
TLSH
T1A285F16562E502F0D47BD1388A824663F6B2B8150364EBDF07A88B561F33BD54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d86d36f988ffcf59417afc356ad374850545c9ce90c8934ef6be36923cafed33
MD5 5084901c1b5dc468ec278adfeb15c4e1
SHA1 757c6c1c1a933d008635382dcae504225868779e
SHA512 c913e713b55aa277883a85a3ec1134e38d2add4db06ca893204dfc47ed1627f500acd87977b710b4f078fd68d979f2bb202068261f069d49d683bb4323f51a10
SSDEEP 24576:2PUr+NQ0sOp4ak6iW4od3PZXrVCRJ5jAA:2JQTOGakUdRUrAA
TLSH
T12765F11F229D18E4E676A17CC9828719F771B8620711E2DF0291917E5E37EE8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3f03a3f25253bd2413bbb2080ace82626c0b97ad8a78aa4ffe4bf82f5ae5e74d
MD5 daa4df20a45f9fa8a4a8571f9f0508a5
SHA1 bd603e23baac139ec7d1050f65f9dab4a1ffd33d
SHA512 e287ee162b993605a07c33e0fa572646a55e9287e0078a293977a5de811a0e6f49341c2fe5a7c6571199ba6f70d906fb1e87b5a26947c5120392933061f36ee5
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjOGakUdRUrAA:YG05lO43bmOGTUzSAA
TLSH
T134D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8d761be77b98204ba0b11947fdf0f8dbc4c2eeb690f68995653cc543e7343418
MD5 cf64092e130beb35ff535cc51003cc37
SHA1 72966f181d811c2281411d9957307e8e761e1dcd
SHA512 97935776d1f3b7eb11a6e8ae8d0cdaa1252985a2db45efd169edc83bca18fbae2d20d23f29a09b7d73ed591e7cb43cbbcb1b579e4c5c9aa97e6f02802a8e5886
SSDEEP 24576:Ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidnSsOp4ak6iW4od3PZXrVCRJ5jAA:Wa5POZ3BJt2pasx2+mrOGakUdRUrAA
TLSH
T18E65AF5EA2EC01D5D5B9D17DC583461AF5B1382653319ACF022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1f76317318a936bfc1521deffe6df843ebacbe7b959e03def5d5715e5278135f
MD5 4341b74c15e05478508691812ad094fa
SHA1 b6a739d699506d91bdefcd17387c273b5240d787
SHA512 2341a616d5874e1182a75174d646dbf19e30ff7356583b8ea35def7ba590cdce899cd9d3ae18126d35e395d76867f345bc99f1169871df816cc2a94777880df8
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7Fk4sOp4ak6iW4od3PZXrVCRJ5jAA:TNc/zEOVHF8OGakUdRUrAA
TLSH
T12B858B1623E901E4F5BBE1BE89679546FA717869133086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c294ca12ee42d45b3fc7491a9950bc6b11f16c29c8ed503424afa9adcc193253
MD5 43de90fa06799e6e9c068e7d02a6926b
SHA1 8880e736a8b345d7599280502cd16c8d6fa79443
SHA512 ccceceb0c701a3a007b4012469391669a14cfc487fc5c07f9af1fddda52d37866a2c2e490f098986e9865def4a1f4753c6df367c58043ad140dfb1990ce0488c
SSDEEP 24576:8TkNvNnaFeYhJNtmZBmusOp4ak6iW4od3PZXrVCRJ5jAA:8TMwBtOmBOGakUdRUrAA
TLSH
T16B55AF6EB6A846E4D1FEC6B4CD238512EA727861073293CB5390C13F1E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 29456755c4f8bc0b978fabeb8ec399df2dd089b5bc0238207b91c4a298e04a11
MD5 d5bc47ed7cf7fc0310e48eaa2ec3307e
SHA1 886e7aabda19cebeb6da0046834de59159af0199
SHA512 89a1e912c7b1c53f46f55cfe6763f44653fd4cd89ab5ce53af307e7a60c39d69d73ad1d6117a87276cae0462da5d92300461eedfe881b87e7184a671b57d001d
SSDEEP 24576:PD3FHshBIYQgA9sOp4ak6iW4od3PZXrVCRJ5jAA:PDVHeBIAAWOGakUdRUrAA
TLSH
T1D775E17EE69D00E4D57BC1BCDA938606E67138A90321A5DB029491BA1F3BFE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-51-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/616-48-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/616-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/616-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/616-40-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/892-121-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/892-365-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/892-118-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1248-78-0x0000000140000000-0x0000000140224000-memory.dmp

Download

memory/1248-314-0x0000000140000000-0x0000000140224000-memory.dmp

Download

memory/1248-1-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/1248-7-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/1248-309-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/1248-9-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/1248-0-0x0000000140000000-0x0000000140224000-memory.dmp

Download

memory/2076-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2076-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2076-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2076-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2084-122-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2084-369-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2084-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2084-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2084-381-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2084-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2456-139-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2456-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2456-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2456-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2456-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3284-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3284-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3284-189-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3284-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3284-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3460-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3460-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3460-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3460-308-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5268-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5268-126-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5268-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5268-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5268-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5712-111-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5712-79-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/5712-84-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/5712-311-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5788-68-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5788-74-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5788-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5788-310-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6072-120-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6072-366-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6072-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6072-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6072-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download