b802b17409e38ba59b5a38d088e2035da01cf5bb0134bde09366dd3c35f856f2

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample260730-kr54dsvblf
SHA256 b802b17409e38ba59b5a38d088e2035da01cf5bb0134bde09366dd3c35f856f2
MD5 86cb1707625944fc5e52af391cbf05d6
SHA1 d0cde2cedee862d36bba0917bb983ec072d58817
SHA512 2d1f16ba6925d9501c267b5e09cdf102279352f60d09ae710c3a50d96d2519cabe486b05dfdda6616787b9e5c081545d56f8585e9ae9563e844c3a278e942120
SSDEEP 24576:Bjk3QSVL5j/cY6qnQ/tbw/2Mkjy6Fr7g0oN:BjkrVL5jBQ/lFTjN4
TLSH
T12675E02DE3A555FAE6B7D23CC8924506E7723C959BB1C38F0391195A2E337D08E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4204	elevation_service.exe
5580	elevation_service.exe
4952	maintenanceservice.exe
4788	OSE.EXE
5156	PerceptionSimulationService.exe
4880	perfhost.exe
3464	ReFsDedupSvc.exe
5960	SensorDataService.exe
1188	ssh-agent.exe
1512	AgentService.exe
2036	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5fb38a70238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000405306970020dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000979d8980020dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4db0bda0020dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007040d89c0020dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c0ba4d90020dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4308	2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	3464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3464	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1512	AgentService.exe
Token: 33	2036	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2036	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2036	SearchIndexer.exe
Token: SeDebugPrivilege	4204	elevation_service.exe
Token: SeDebugPrivilege	5580	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3868	2036	SearchIndexer.exe	100
PID 2036 wrote to memory of 2424	2036	SearchIndexer.exe	101
PID 2036 wrote to memory of 6100	2036	SearchIndexer.exe	102
PID 2036 wrote to memory of 5428	2036	SearchIndexer.exe	103
PID 2036 wrote to memory of 2692	2036	SearchIndexer.exe	105
PID 2036 wrote to memory of 4276	2036	SearchIndexer.exe	106
PID 2036 wrote to memory of 3492	2036	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_86cb1707625944fc5e52af391cbf05d6_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5580

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4952

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4788

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5156

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1188

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2700 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2700 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c155f2b3890aba575a86f4925138873765bbbbba7847e4504c1817caa8406ef7
MD5 59b236993820e4eeb7600f8d3d5415c2
SHA1 d53dd102cf16faaa504daf3c8736b55cc6310ace
SHA512 abf9540daa3a82e65d591b1cb5a9b92b846709569ba1d0f64e333da308555591162b5f383b5ac09f52eeb613c5867131c7ae473dfec7f8f1034cf9ec64195f96
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxntQ/lFTjN4:Q3q6HjBpLm
TLSH
T190D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3cfab2a50de3965903e3e1383f7f0688ad7005ce3d26cee015e125d6e3f6c941
MD5 87094ad72e2db4c36794d2541915ef64
SHA1 1d497d97bb64a3eba2bbd38940e83faeb2c7fe5e
SHA512 3cb95a27c62810f5c1807ce951d7a5725ad062c8b6540165e0af4bf0a6e2338eaf9036c1255027c7076750927bc80bea11c8abd1cfcd8ad2eb819c7a88234b6a
SSDEEP 12288:Y1XLsswWkxy2lRq2czA6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:eXYfDtczA6nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T13665F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0e798b80b58dbacfb733d755893a2b3a3b1d2062f978dd2303c59523fc21c6e0
MD5 09d97d25fd69a1ea252322dde47e5d4f
SHA1 178c33b3588a2e6feaaeca8b56f77e11fe032688
SHA512 b611a01f2044ab21a9e74e0cf37a8db7f73b1b336b2fd40409845cc63064ded083dbfad77622ba357351171a3c032fdc6b0cb994ee88207ef85c7534e535843a
SSDEEP 24576:o0Le5ji0hmxLrMFnQ/tbw/2Mkjy6Fr7g0o2:oPji0AlIQ/lFTjN4
TLSH
T115859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b0677ceb157175788f8a182e31e104bb3027777891f808bbf47d7cdc821639fd
MD5 1b55beb297e3998db5faafc7667fa6d1
SHA1 9e504acf1e32a7ad5cad13e14f1a850e6f829121
SHA512 a2d8bd9cc206897be920b36f3bc0cc235c964f44f81e8e15b849b770da398a3a1ca4707b48ac9cefaa6e9761520d452de3ddcbf34ceecaf2520c05a4b9684ed8
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWE6q8wyuHnQ/tbw/2Mkjy6Fr7g0oe:r/ezSC6vUzPvxHjyUQ/lFTjN4
TLSH
T18F755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0ee12f6ad532183618f3aeb6c3f0eca2082ab7fb2f88a02bd485b596849b2d4c
MD5 bc9d7921ebe4604f043dde31cb9a9c82
SHA1 453c16a3b1c1dc5f19d1aac40195c31a77fe1022
SHA512 82dd0a846ae3b9a5813686f01bc6c314465aa0abce47ab389b7cc2daf53e328893cde8e30cd388f3714610724096c4907d45bbce6d6a5f8cf1a08fbe9fc605c6
SSDEEP 24576:wVbqPb88hv/l+6+nQ/tbw/2Mkjy6Fr7g0oO:wVO88hXl+RQ/lFTjN4
TLSH
T1D2559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b553e8a8d2fb58d9420f7c68820502dfd4187caefc3515217053b7371d866409
MD5 a752611946e449cd90d85b914e626b24
SHA1 b43b2de850d2d2a936e2dd75bb3e775daf6e34bf
SHA512 709aa646a83454dc1ff8c38e897d50eee9c28b605ab76edc5af07f0981e85da408129e232ab63d087631765d9103c611949d7c523c723df75d000c688cb83449
SSDEEP 12288:SzpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:Sz5nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1035523696A14F887FF2B06B15C828482AB7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7358ed529c663aa3367f9fde89044b18b7d71bc72eea4a9b52d06426e4f512ab
MD5 c8e32363ebc99828079d083ca69896b4
SHA1 aa493fecdc07075641fefd68304d7f9ceccd2eb7
SHA512 48f0e038016335b28cbc5138e7e9ad87294d5bdb4abc9647efab39f3e4b74a11e79373db28f54e8560a181efdb229c9b83fa60c763dcf43d6ad89b1017eed8d3
SSDEEP 12288:ZeBNUbTVO86U2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:ZJIUWnQ/tbw/2Mkjy6Fr7g0od
TLSH
T18E75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c397a6f33181f76e5c5005435d7187146defab8e0e9d2ef52a55a57820ca4152
MD5 c48e7a193f71ff22a847fd448c24fdac
SHA1 d31b920a83d8e719aa4b4d3623a6c1af0571e157
SHA512 617ccf1ca54890bcd36ba9e1b86b866ee80f45d0ced0ab235b6fe9354b06b8ca5bfba4e2ff7fd8e6ee779af06fbd080295fc16bee45c521594232e80692f839d
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:iQvGAdlCEL8c/yRNw5CcLm
TLSH
T135267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 02df3b78e99579cc169389a4b938f2ef354db9cba754dc70f793a059a2f3fada
MD5 868d4e5ed2fc805a7eedaaa89d6e8736
SHA1 9dad2ffc67e38dcad11a1a08ba16a0916c3e3411
SHA512 8cc467a8ec144cf650c05dda692564cf2fb0ecf0589e59de78634fb65582eb2393317438083eb1be422a36740a1e2f63656bf3a57b02f64025fd5f1c072630b7
SSDEEP 12288:EAwSfxL/2Dc39DLLmt0LDQewsAj4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgy:ZQewsAj4nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T16A75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a731b3ad5f465ef3b3388ad9ebf0c969afd834397bb1aeb9f87115507c461432
MD5 7c175f281814a543f1e640594705233e
SHA1 5dd2d6539b893579d39ec0b9c629d9d64bbf28a8
SHA512 14b60de15371a7fb9e57fdc7242b5029cd339a5a2b3d0234ad0e4debb358d9b755ee62de924dde94a187640bc1b1e57fce9198bc01a8c96de76b53c03f7933b4
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTL:wUEtQevvqc2W1cpV2EI32
TLSH
T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 67d16743f4f5bb3360e9126e96ff6e49197822b3ac750e65e968e0025493e07a
MD5 6f86fdc2e3a37af9d1ea38928621d082
SHA1 271eb3a518b1f6a3528640f341957920f71900f2
SHA512 b09960056357e19047e8e2f17bd43b9c734f1a9c2a1a47f8410a07b24e4d8221001155907224f9110417cbf48036d5e8dbf318d6b624ab2a66fec396a6c7301d
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zYQ/lFTjN4:UoqtVjnmILm
TLSH
T161D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a37d741bacb7773a2e8e8f2c2398cc2805fd90ef1477a201f015b6059f10d721
MD5 01875b7b7337dcbe182d5e237ca7844f
SHA1 1e52a7ef7b13ffa77590869fe57aa5fce9e21787
SHA512 4024d128ea843cc6501f5c3175b0cae6ec8d107a2dd127a2b13179b768a591e58cd034ead43268ecb58e1c391f7deaf105d66115b6f4359c659fa1f1a83c2034
SSDEEP 24576:pAhGLJIFoiwtA5l7S53DnQ/tbw/2Mkjy6Fr7g0o8:pAMyFoiq5TQ/lFTjN4
TLSH
T12535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 73ce6c3e054bcd06722072c1ac44c64db51045e3e449469ef990b097c455b5c5
MD5 72bca821676746b6f15de3b882a4f542
SHA1 6502cb7eca4d28abbb280b4132fd612901b3062a
SHA512 4a9df5cb8fad341a454a88c4e9f7c9ad83d4cd3852c2cc528cde93e05261ad01062e733f67a91e109acc99e9e536983e52ad51066aee7eaab41a4f3c03a62484
SSDEEP 12288:Smw5HEjsChN2BFgl0WDm+CHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMx:LwuHOW0nQ/tbw/2Mkjy6Fr7g0os
TLSH
T18865F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f657f75b2ef1b1fbad5941a8220f8e0a6476fa338171e6a58c902a87c87b3d73
MD5 4db263ff4797e385e962fcef503d00dc
SHA1 0925bc7e6a54106226f1fc2d31617276e8b174b4
SHA512 ec273d012b376b5e188ccf9adc3a0d44611e4ae84cb77dc816d62eeaa7cfee87d1394a76c52dad31b8dc057017ba49ce73d1341e697d45f4a8b1e965ae02b294
SSDEEP 12288:rXZ1IyoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:jZudnQ/tbw/2Mkjy6Fr7g0on
TLSH
T10355126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c41e427c30d1ad70f094bc2eb2343c244b9b7420889265aa4add812bee7e104b
MD5 15621f744ccd47e4b6dce0143d24f0a9
SHA1 80d93c6bc30c4ee95ba250334acbb8fb7caae846
SHA512 62c71cb3271bd4bff7556b7557830b0038243940bb16d07bad306be8946b4b9f91a3b485b3f1cff44ac702c0084b113ca55a31203b4d6a54d4461c57de76fdcb
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:oQRQyi36YOcPQLvw2gAf+PN39Lm
TLSH
T1A4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e38d8eb05d3cd401091bee2326c35d6befd23d50362b65de16038d757a8ab067
MD5 261109d44fb1fdd8b8e7f8857085e645
SHA1 7f6f2a5553c4b2857c56c29b185767bb6d71be06
SHA512 695c02a06ec282edf0e19c5c6493cb9828c4efcc0fb443fcace1c7c4cd4b7f0136835fcf75559de874de705a42cc96e457435f6577c5d8c87c579e33d98f847f
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:8QRQyi36YOcPQLvw2gAf+PN39Lm
TLSH
T137667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 649bb2ff0c13500238b64c9de137c6da42e689aa140496abde1b3dc78a13a676
MD5 bb310b010af8cd245b2164da7645bd6f
SHA1 1af581cb100349e69665c3ddf0b6f036781d9490
SHA512 edb5c96efd1d137866f12e72991c774ee40700a0bc2fd12b34686dd5f3e6f092a83b6d9a95aa42c9822717c1d88addaf5990eb0cc8c9b569dfcdb684d507f8d9
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0tnQ/tbw/2Mkjy6P:i68Qg55nhheWu7PNU3/IQ/lFTjN4
TLSH
T1B6B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 76178061c978533068aa7909061d771de5549bc898c1b01661e3e2227824e8b0
MD5 8d8640ca83c30cfc333b9102cf8637ca
SHA1 5f2275116b4808b81e9cb5462d4bbb2f5b911c1e
SHA512 78d091d94bb0255f8e02513c8e3f12db3765a15bdfe1abd6e2a32a290d4fc4137cf4976f36ebf2ecdc9c3db4e58858ac1d5a5cec74f74983e4d072d136563234
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99e:iy5112gYy5azzVvL69nLKnhZuLm
TLSH
T1F7167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1eee81385034232d3d433d2242a2e94bdd6887e2ca3393009e300ec2e2a76a39
MD5 f18bad25dee95453094493b21682a81c
SHA1 f0f9a95ccddc36ff18038163787525b0761056b0
SHA512 6a8daff4101c703f63ec35c1b56d3dc5d18f1bbea86cbe4b1fdff8cb85d4ea87e41618eae310de8abad33a7469768d5d227e1d52d7076a008ad85dbca083e24e
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKQ/lFTjN4:Uu6JmVxd2dFLm
TLSH
T1E3D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f9a176a6b06b4ab6a0fb5768a20f8e8ad712f322d01366931b36d71f385f430a
MD5 90a557ff1483f925bcf2a4ba0e90852c
SHA1 f88d35ff0d98488840bd738170f98bc551d7020a
SHA512 70a7866ba0f7327c9f4c421c117d3efffb35c0ac435422fd3d609328d464f2b8d521496f04f7af7b4e0ec9a27516230282ad7fafe6e379cf35e38e6528289da6
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4x2Q/lFTjN4:bmifPbRILm
TLSH
T189B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bd6023dbe10cb5d061410456daa5b797ddbc72f58604d2a35224550ad35c5454
MD5 d830035ef27ece0aa9b7e16d287106f5
SHA1 5ecb8bc4db5835fd1f64a37fb82acd8caf7c5aff
SHA512 71fc4f37322e0aa1ec274b4164dae587b19422f6230a3b39050f2ffe3f2afe33bfae9b0c9b8092dd9e050f4be4dfe19338d110ffac6bf02e9f52d8e16a5c8480
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqdQ/lFTjN4:H5dKTi61SLm
TLSH
T1D2C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d851bb06d499abf78b317eaf239bce926571b8711f7dd5982b9c8d4251f25c98
MD5 2a166acf4114ee38a1d5f75e22ea9578
SHA1 f8833d90f6dc0743e007da8c83ecc653fecee4b3
SHA512 fe5d03c9881856d87b51d29cdd8ba4c3d8acb4cc24b7f321ad76cf05a7aa76cc12febfe5ff0b437d773ca71ae110deb06cf5c3e7b8f257f3b600666c3a013797
SSDEEP 49152:lhtSn8EApI0figngiDn0AP5w6Q/lFTjN4:UX2iyphULm
TLSH
T1A495BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 aa9693731f44cad32a43f9e616ad366e88e5b074327d3b545ce9bff688c29aa1
MD5 f377a2756ab76da2475a26306b484d87
SHA1 6365bf6ccd638077bcd8b296901374dd9f40e450
SHA512 9d11fe673e96b1a5d5d71952d30884c700fea182dbb1da758b8af3957491d380178c6e25b344bdd9fa97657f2bc350e2f12d8a197d94af0e41eb244bf270b8aa
SSDEEP 12288:aBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:aRnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1475523697955F98BFB1706F18C828182A73F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 52f659aee6cd35c9a69b52ad2dbca7253969ea9ce0d8e8780f0207974d450ec6
MD5 b65f65a1ffd32a3c934fe665fc3e1226
SHA1 69acbcdcd334046098bbe7535b3e2de0d1d5d571
SHA512 a30616d2ff3dad719f63b253ad6b2834b5b5471f144ea1008a1f61599b3384af78a3c8b791455c90131b8866aaa6713839621f3d3ae790cb702c648d9e58a2dd
SSDEEP 12288:OcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:OcnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1345523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3c498fad677ab54e2ffe741c68f92e9c1c79f4d4c8af11f03b3cee13fed574f5
MD5 77f3f56f1963267ec6e0d60584462b7f
SHA1 8e6cd3936e77b2afbcaa419695845293d8a66bdd
SHA512 2b9b3d9f1c416e71795d06fdd41fbd35b016d6a1f7437a881306b4e6a048311d2160e9099a4273fc13130dc1ef332888e03074effb504cf833c755ad37fee4d9
SSDEEP 12288:QOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:QOnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1045523697965F98BFA1706F14C8381829B3B0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d90e8cf886f2d0c682bdf7fe27e366a2257c66640aff7f3b3535857988d4347b
MD5 a6455f09416164ab14ecac88355361ff
SHA1 419334a4fb5d93b628161f8153a5adf9f9efb6bb
SHA512 a23998c7f5bd86cb83faf7c80b8d75f2ab3fdff9302f56042f557b6731cd0e781c3748b15d7ceb9f3bd7da3bb1d0e921b8ddd9efc13d65ce3dac86ed16758208
SSDEEP 12288:PVzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:JnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T12B5523693B69F4C7F92742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5183e7d8b5fd7cc56b4e297ad8707a6d943b1963e6c125b025f91ce62d7a2831
MD5 1d15eed22c345168d81e4d8a48914813
SHA1 d7dfca1164e96a509d54563b65ca0fceabde63ba
SHA512 bf6b4cc20ef667f706a1798fa967e464da8e62dbcb76fcdef1529150be52e07523fa930cea51e4cd091000f9872e6967ede1d686856e2db53bc57e1a3f93ca9f
SSDEEP 12288:FbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:FLnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1B55523697965F98BFA1706F14C8381829B3F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b794b430b8cccd461340e3e6df46c618a9f87f642bb0eb6131443e3eb5527fe7
MD5 9bb9a6fadd89f62a863bb7850f6ca31a
SHA1 431f637dbdbc87bf5de5f78545e18e71da38ab61
SHA512 ecf8a5d0b4bc0901f5d795045b7d3944299f668b08d9b83a0704afe64fe2b9a3fc7550d34335b94e6d3c933bae41db9a2156c304dfdf70e7093e5fb0e0ac4d87
SSDEEP 12288:8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:8wnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1A55523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967C39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 449e781e0bb5213b2e21fea92025d192fd9b964399df410e6c6163c75e22e281
MD5 d3bc616962ab06d0f0977638d3843286
SHA1 99ce927951d3f21d6b5c9ce1cb37fbc8b8dcfa4e
SHA512 8689f5364319fc17a881cb45de218e2e3cc89009719faa0575579ce884d2e4d14ad21db7080ff40668826a6e9a6154ee642ee43d59dcc30f93343a07cff51263
SSDEEP 12288:tkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:tEnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1DE5523697965F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f79838cbe28fef4e07de734e83f6c407881d294c13c50fc7b59800f118dcfb58
MD5 b1fdeddfcbcc5bca02f03492758bfcd3
SHA1 605ec9bf34f9cb5a4c3c82b5846fdf21f949bb1a
SHA512 2520eb0e213fd496c08870eb9c12472543ee1153c5d0a9426dc92bbb051495665d083d09ae5486b9ea4c544f94e71f15c2c5c0aceb410576096fad27cf520d24
SSDEEP 12288:+iZwbDzzFEoS2cPvy8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:hZM3zFVSO8nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1727501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7d5e1482588928b3038c2cbe7aec62ca83a0a628514f51a0a7b42dd1f4c08ffb
MD5 77cfe03fd4000f2723c0c8c70a6e1bd1
SHA1 19a5de8641f90438acfaa433d853f7782b75d003
SHA512 2315df15bd09906907ccc956d7b3a6f93f30be495f58c982edc877699eec495028836dda06b447e6bcc1210d4fb88724af145fea05901e6fe375b3cb40f22bed
SSDEEP 12288:xtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:xNnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1D25523697965F98BFB1706F1488281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a10cd06c80097374a943a0f2c87c46ae861b5f40788b0980977e0f14a7930659
MD5 97f0ed775d70d2b756d5951a7b121eac
SHA1 2677bfe9d46fbb6856c7f8a8b0563aee33edad8f
SHA512 e09bd767ae8d2c4874bc9013b1a6660d7a004a01a422c1366725ee941626120f4bb6a04ac06db130f02acd668c31f2b5d312e8d941aca6b1e44ccea72b1e2969
SSDEEP 12288:dZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:dpnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1565523697955F98BFB2706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 de1f1d0ec2f041da1dffcb02434591a0d27f58cce2b24cabd1f436b9eab6297b
MD5 7cc35f21cec662d14cd719f055223c26
SHA1 fecdfa739c52f5f785ef73fe9d2699284d6e9d09
SHA512 9ee58e288ef9bdb857ee166f1b8b4600c9b57d1b5559ca235d08e7d1fe7b7e7b11971f4ca3b50666c0258bbd42cfd950a10b6b2465cfedc28d56f9c5230d0fc1
SSDEEP 12288:cyPz5L8oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:FzyonQ/tbw/2Mkjy6Fr7g0oE
TLSH
T12965021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f106216b29a8164217bbd0d50bcf9a43aef436033312ceab050b5fb4af282276
MD5 77b789e0dce886f370b17e36b5202557
SHA1 4e122608d8f26f6a59807da0e148e4edb76b4802
SHA512 6d97f90a537c9daffb076196abf2f09bf7ccc0375feba76da7046889c35660708cc658bebe62527dd1ed8771014e34e3c2bdbb3bf99db183ad53aa8e5fdf55d4
SSDEEP 12288:HtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:HNnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1BA5523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 90068131b25f055a767108ec823f5cf811982476c4004405d27f8b4db4e14aa1
MD5 99435837b3fbbffb4a0fa0a43f0ac83b
SHA1 838deb68b9c151394030646d21af4e5c25dd9ab7
SHA512 c00a0e822d168375625bf5fe0c5d7de7967e7d8b2bdfe56dc2a7c408fedbbe06e80c32d81c4320b801892b96e7c7b4a944c40a25e7856bdf5f6d4c71f612d1a1
SSDEEP 12288:ytGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:yNnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1205523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 82db67a852b634f85a8c6c27c1d3e25fd811d58f1b67aed540eb6df2a3adc00c
MD5 454d736bbb2e8a37e0475991e6545b88
SHA1 db54704c497acd2edac627d724865911ee6cdc9f
SHA512 57b01ac0273f833fce8f048075632a843fb0bfc69083363b6ae9aa76483f7e2c71469a3c7205c5efe73d0a1ef94761574cbea16eb7b914d69790fc65c1f57005
SSDEEP 12288:6yPz5L8oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:nzyonQ/tbw/2Mkjy6Fr7g0oe
TLSH
T19865021773A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 1d0353bf878d3685204e6c79d34963daa666d1e3c59a507d4750cd41e8baf803
MD5 f31cc4c8081182efb9fddebe4fabc6fa
SHA1 df230d24ff2720884bb939111aa5902b26812faa
SHA512 715902a155c7a6addaae4806395325170493d1506385098ca662557f6fd3d6c60c2da338a9bd91826fb5397a3f418b9dd8dc94aa87fc2b060871c94493a83e0e
SSDEEP 24576:mT0aLl3z0zDenQ/tbw/2Mkjy6Fr7g0ou:mTDLljHQ/lFTjN4
TLSH
T10D7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 71fd51b461b55e72f759c7cf6775ea66518e32af861279f81bbd6f0f20a2460a
MD5 52956403194d9dd546c87c9959500f8a
SHA1 bb6b2d3556ae33f80fedaafc1fe8c530683f7005
SHA512 2146bc9dcbf4bd95b729e32bd9409e967b274afdb33685c76eb8048aa5b74f72b0c7ad4cb9b53b25b8d64b3219694acfd73d528149fc5bca265be33ce3f7ef40
SSDEEP 24576:431d9CHKy7GZSnQ/tbw/2Mkjy6Fr7g0oF:C1d9CHKyagQ/lFTjN4
TLSH
T1CC85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0230a002cd517f9e36fd3ce10c80c46a4dee2be18b190def483612b242aaa984
MD5 ca503aea2d6dee4e1faf8473f7a66d34
SHA1 114c5e861170d144d0349bccb713fbee7649832e
SHA512 9604b31558bb794e4cb37ee30d3e0fb97d41e5ee2ec3265a76984de6d4d5637b3c926f4ead7030b8f6a0c9655da321b8e0b731d4b1306bdae5c63576264c746d
SSDEEP 12288:nuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:nunQ/tbw/2Mkjy6Fr7g0on
TLSH
T1355523697965F98BFB1706F14C8381829B3B0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8e411e001a7ca5076c7371c8e699d3366369affd59793c21daf799f9b34f2a0e
MD5 9ba2dc4ceba83301240e4b03942112bb
SHA1 3db41e4d269fbb621a3d6b9c0c66aec116c4b27e
SHA512 f41f85625102ca9650e6dbf9f9705d3c5775b47b1812dfb8ab12ac87339a74ae9a92fcef704c02a9fdddf92c398f7f3353c7598e413d5583bfbc0667f0f2bd97
SSDEEP 12288:nIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:nInQ/tbw/2Mkjy6Fr7g0o/
TLSH
T17F5523687964F99BFA2B06F14C8381829B3F0EC6BFD1938F7B481129967D39406D67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 eb9bbf6f604ebfd8a02d3ce3f22ad923752147e1c57c6de298bb825fc0a95922
MD5 5d9a7ac6bbe2ee6fa94d838dae9a3b5f
SHA1 ba8b90ca5fed12bb18057e4dd1b32b36432e2885
SHA512 6c682744a39160281d464a7848037290b771e71aea54b4fe808e0918498dbaab3b6609432647e59de9351a941b809033def7f5c2986b027fb982f18b50aac968
SSDEEP 12288:YvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:YPnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1D05523697965F88BFB1706F14C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 dc905fddab930675eeb5a9f1362e4f9e750910e2087db14914ec65f78b857b11
MD5 41adda4d0f9aa038fd778e817d8d2974
SHA1 0397a49af52d06647f6a2911007eb493c0dce6f2
SHA512 7b85b2c866d9dac2f9632bdc4142e08b69e1730501003fe4230acc3cb13f552da0cefb72f5ad9a8bebf335a6b5a55e24ab578def4ea3dba74bf12ba07ea3cbd7
SSDEEP 12288:4tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:4NnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1775523697925F98BFB1706F1488281829B7F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fc986db54d4ba57077a7f39f260aacbcae85ebfb6344ba273c0d7d0dc6fb4dd1
MD5 33e886872b6577e2cf60319bcdf05059
SHA1 326e0371e7f3e7efcf13a15696146ab7469c10c4
SHA512 46aff4d0ebf75b6f86c86772b8c8b59f93fe1013b4a69f9cf8a70d87a6e3543f9ef7c6ac046ff350bddb9a104bef26a422f5cd566460c029e27b6df03a2cf910
SSDEEP 12288:guGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:gunQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1F65523697925F98BFB1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d6f788d0c7e5c7a69f819bb962515887466c310df652938a2febe8d5f7ecc478
MD5 71455ce37f4778d6900abe5e1b80fccc
SHA1 20c03a0773d56169baed3a2839979bd2b20aa7c7
SHA512 cebc7ecb0d68f8983531587ce6f2bc2b24402e84e594d620e45e9188bef347632709ca4f19ec483a6d40ad2a3089e2bc7c5c2828042611b7ce99e85c3c2a6a80
SSDEEP 12288:41GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:4VnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T16A5523697965F98BFB1706F14C8381829B7F0EC6BFD1A38F7B481129967C39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e29a7cbe078723d3bfcf62674764aaca3cf8e61fbff1fc1c955e3c895d2ecc88
MD5 793f872e83ace9bed655fd3cf8a977c2
SHA1 f8e08634dd4fe3546d4de1a459103239e79ac611
SHA512 4c6d1ac7e17caf688b22bbfc3a12cff63da8e3e603c8df501cade51346503fa6b9b8e1fff3379830e2fc44b647581e2a8b1693c80e9f5101cf93159e48e68c9f
SSDEEP 12288:zbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:zLnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1E15523697925F98BFB1706F14C838182AB7B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 74000c68eb7a7176157d7b4ad3b17dc59c862c6e5fba5813e98a0ab02b375a06
MD5 691115c0d57b8b519725f1d963b1eb1c
SHA1 0cd865e78dd4880b0561542d268ed9a56eb3f7ac
SHA512 db566aa78d863b919bfed861c7827614c815ac2dd0db895d25452b164fd0d84ebe7709ad9257b831aba3e69e7d94010502ed4724ab41c98a9de3ac89e17b9235
SSDEEP 12288:pmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:pGnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1A55523697925F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967C39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 6d5d90ec8bd66bf0bd890bf56c1dc3f9404db6fb27dc119a75d6f4c2755dab67
MD5 df7b3adb9c876f266b296c057b74a5a4
SHA1 5929ef1b41a988e8109986acbce1d01c97d952da
SHA512 d17386f083c3962120ffaab47f3fa7c0cee0b9a47018c4cccfbedd5cef17fc79a9eba18aa9ea667ceb67083412dfffc755e6732539329f09309f251dbd9212c7
SSDEEP 24576:tfwv/k9RX6wkyAIZnQ/tbw/2Mkjy6Fr7g0oZ:cMnYIZQ/lFTjN4
TLSH
T15285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e2132bc8abb9298b4dfb6dd2b170774431b2bb78cd46d26eebd63f72562a2b7f
MD5 228ca9e957357b17cf4210359727face
SHA1 3088f8a638dee3e9c04472c6be268374993291ce
SHA512 e14c7f2c2b45ffe66a344ff2bfb7755be4b6d09a49217407aec03e63c57d1eb4e275dc066eb1472e7e3d62c43d2313d69a96a2cd98aaf2491cabd67b5055c010
SSDEEP 49152:QYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aQ/lFTjN4:+ySzPdLm
TLSH
T14A066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4d0cea326219c57cc7ecc4a36058b8a8e410a8408f18c00c4f160cb6ec9568d2
MD5 9b46b6fc82f09b7ddfd55019cc579db7
SHA1 2c959a8d2f1cd9c709749bcad8b02de40ec073cb
SHA512 592d7e48de6995ff38909586380f31ed66cd9e5afcdf8a8f132cc29b6443eaa02e0f7e45935642dab76a2c8192f47a1faf64d7e34229f06db5a85ee5909d5a25
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYsnQ/tbw/2Mkjy6Fr7g0o8:C47JUQj1irIhCnDHUPfF/KQ/lFTjN4
TLSH
T18365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c1e1958df4b623cded602d9b16cd7fde494f44e68fdd547c3dc5c2ef29bf10c7
MD5 99c8b6644f13e34d569478053a20fcd5
SHA1 ccaa33f5d90885bdfafb42294c22a7b055fdd67b
SHA512 1d616060a8f4f35de5097bc4ce0d024685f85eb749e276c44168d336bd7906468eeefbe3303e9ba4b4602725934528d21d9497712fb6ee0f05d3990b77410546
SSDEEP 12288:+ssf9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:odnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1B565F019E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1a981b7f5776429b8bb767e7d3342976b6b84867d69022c61c3588fb2a6065ee
MD5 b5b55d25278a98fdf1905cf86dc98e38
SHA1 e06826e2b916179801ab89aee28a5c0e2d7f51a5
SHA512 f11a730e45f98809fe928d09973c29cd09d55511d9ba5646302053ffce722db329f03761efec5a1ea9ffaad8fe3ee0897c8c78a708fb72a72af0c7506d4f3701
SSDEEP 6144:osBC2na2gy1HsrER4fKDexHw4my5lHIyGMYPPO58pbIv50iwy1/at6re+N21:pjpj5y5l3pQC8pW50i+t6re+N2
TLSH
T110351851762AC75FC6A940325E33D2CCAB707D11EE05AB0772C84B3FC576668BAF2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7118daf63fc257403aaba9d221259bbc77a030f3b05c6e69760d593787c84076
MD5 875ca4c8a852e47126e2e801f484c9a4
SHA1 0ced46cb577040c186ce12d59d9d4a15bee75e24
SHA512 3a81221976b201a57fb4cce36e562e85205dd3abfcf7792086dc0b91f367acb39f2a7924de425b19c1d8460dedb1c543a59fae9e3eed9ce487b322fff643c322
SSDEEP 6144:UsOo12dwIqdwIadwIHsH9KOacvB/u3S5A+W89IRKDexHqRKDexHdRqWtOmurH9TC:2o1KEQ7vcvB/u3SuXi1RGsV3aOS+
TLSH
T19065E8415537E38FC1F76032432AAB4DEB74ED0277096F2663C8093AD86A765B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 479142516054f35a1461a54484602143b814e211ff2fa47b3fbaeafa5d2e2fed
MD5 943d37a0fd3cc154d376112f81d02016
SHA1 7efe393e4fbdd7de30a41b69b1a125d4c5c71f00
SHA512 a4e64c04babbad74f5883475af40d22f9f5f27c2ee4c8b2300fbb323edee1335cf1627a258773485120082560888daf7d1c5b2763cf51c14a3f43929dec003e5
SSDEEP 12288:t67FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:klnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1145523696668F94BFA3B06B048838111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c890983504ad3c2dd0298ebfd0f2a6ea040de98a9851d09209b5d436e3f5bceb
MD5 83fc93c55467f7cfcbf1e73df969e8ed
SHA1 8fee9c8d0e574aa006c1389ca4eec91c36146547
SHA512 3ef8e6d06814d5ae8f8d1e4815f1508db696118211a8c61a318778b2e4c7d0516c203a53380e94fcb879f83e094fd05ff821d8e6b14e26c4e068b8c5d597715b
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYHnQ/tbw/2Mkjy6Fr7g0o6:egb4mBIBhGFsQ/lFTjN4
TLSH
T17E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 bede2678a5f892842484c15e87ad417acfd482f9c5ffdfef5049e7b621d8fe97
MD5 cd36f0d6f9fc86299f89b98ff359bda6
SHA1 12f5893e6e73782807802a1828d1638129550af1
SHA512 0331db2a5bcc386a995a74352e855cbc7ae57d40afbe4f4cb30df186586adbb2ee73945e83fcd844f00c2fb771a07ce37e1fc630a1b818987e6c8bd588bc8cc5
SSDEEP 24576:UG88u8FpJqH1Qzria7/m8nQ/tbw/2Mkjy6Fr7g0oy:n7ZFPqVva7/vQ/lFTjN4
TLSH
T1A085F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c798dba32f994c00c063e6a24610867fe7680ad3f5d51dc2b9d82551764012ee
MD5 42d45df882e6566f5458e58be85a9b83
SHA1 d41a48444a37d4de8a88d12aebc82069a511811f
SHA512 d6292df7fe2b15d872e4c82d3332396c919b2b5b7aec1ad557e9247ab5109d28f12069e5eb9fa72ab689e8ba49b585f4369fb8dbfc6dbba6b6297b514211332a
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwQ/lFTjN4:rG05lO43bmLm
TLSH
T1AAD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 50cdabab442f5ef4d2f5573a5a73e9fe2852350d6d9bde77866f8d8694f6fa72
MD5 166c4a823f097b6fa0451c9bfae0d781
SHA1 b25f55f5d1cb45726aa90fa9a2a99c408b8ab810
SHA512 4a6f5ec0c75e13c77deb7264deb80a56a9f7536bb9de78438495160fb371f5f31d55224e4d0d37f6ed62c8f8f7ca9d8ce927d10175529b7bfe80e5bd483d32a8
SSDEEP 24576:jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnanQ/tbw/2Mkjy6Fr7g0of:ba5POZ3+Jt2pasx2+mIQ/lFTjN4
TLSH
T12665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f06fef8a07f6032d37955fd06e0102538479b48bf6693807c20167b1921bcb6d
MD5 1a5d5c8e25fb23997f78c76f99bd13f0
SHA1 a4dd2c6c9123d724fc27833a7d2a198cdd958d3b
SHA512 3ceee29ac44882b009d72ecb1ec975b2bf16f7e3713ddf77028ebd23a6af40eeb4960fdc7bcc669020773c10c3d5663efb280d19423a0ea39d0bd0c9d43580db
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkUnQ/tbw/2Mkjy6Fr7g0oy:UNc/zEOVHFPQ/lFTjN4
TLSH
T112858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 041fd64df5ec47f2bb68b51b8b10378b44da3defe4ebe36742477475ff800ef2
MD5 823c7dc00768b8d140c7c560e43d33ee
SHA1 33acc5bf4d60886547f174d3b4e17c03f32d5b47
SHA512 44b1a9572596a73b29827793586ea3529dae8a0db4c14eab66fbeefbec97dccfd4002a997782eb816fce65c82b40a91fa5396315e76bf3e860d75eb6cc947803
SSDEEP 24576:g8kNvNnaFeYhJNtmZBmGnQ/tbw/2Mkjy6Fr7g0oY:g8MwBtOmGQ/lFTjN4
TLSH
T16B55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 fe22652129fade011b0ab991e9cd435636c1814da38225ec9846359bcbdda22e
MD5 0a09a366c07a48dd25955398cc223768
SHA1 b5f4be3cb7241fc48a82c1233f84d461778bb13a
SHA512 59d48932e5c060e7ba77f593ca791a0a838e3dac1dba54123cf96886fa66e3aa8dd435f6b81fa995b6c1245d50ed0da09d2fbdc0c3195f3867307a395cd5c6c5
SSDEEP 12288:RHvUrBFrEjwaQAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:RPUr+NQgnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T18165E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 18f9a8fe6178dfa5a2fa2e6bcf1c5fb224cc4f0a7f8b3a326dc566c3deae35c9
MD5 51c45aa7975d292a6dfd863461bae6c9
SHA1 d87a067fc8c8a05a9782c13314a186ca25d2760f
SHA512 1a01653766f09716247e9f0ee3eaff050e6602be2453d11dea9e5411d816b5530786a4c33feaec9d78214a0d5c516343bf7f0e27b721168ef84c4b6dc2af4a69
SSDEEP 24576:UD3FHshBIYQgAxnQ/tbw/2Mkjy6Fr7g0oh:UDVHeBIAAxQ/lFTjN4
TLSH
T14C75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1188-121-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1188-115-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1188-313-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1512-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1512-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1512-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1512-137-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2036-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2036-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2036-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2036-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3464-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3464-381-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3464-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3464-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3464-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3464-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4204-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4204-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4204-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4204-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4308-87-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4308-318-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4308-0-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4308-9-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4308-321-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4308-1-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4308-7-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4788-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4788-280-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4788-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4880-310-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4880-78-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4880-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4880-83-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4952-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4952-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4952-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4952-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4952-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5156-296-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5156-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5156-67-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5156-73-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5580-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5580-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5580-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5580-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5960-314-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5960-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5960-108-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5960-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5960-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6100-372-0x0000020CA13B0000-0x0000020CA157A000-memory.dmp

Download