b91c357a965fc23db68ccf1b27b599acd5857841e670c36e07301d0d7107fb46

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
Size 1.6MB
Sample260730-t6v2eascmb
SHA256 b91c357a965fc23db68ccf1b27b599acd5857841e670c36e07301d0d7107fb46
MD5 fe673aaca87b1b3e54e791a35627147b
SHA1 d7bdc4355fafbe9a3064dfcd38c5ebe2a7f39cc1
SHA512 93096bef6d5af09c9956095b2abdd8c22cdf96f0c18f51733def23e03b2ec1a2c7643752d66aa936d6d1365ddb10270d2328b8eb24074872c66b8633f70df863
SSDEEP 12288:iHDmD+0JJ1BwM+5tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:iHDUaM+56mctvE/BT76+1NCE
TLSH
T1D475F142B26D3DEDD0668174497191E2EB31FC712750968F53B17B262E322D3BD2AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2828	elevation_service.exe
3096	elevation_service.exe
2976	maintenanceservice.exe
4764	OSE.EXE
5436	PerceptionSimulationService.exe
1792	perfhost.exe
1572	ReFsDedupSvc.exe
2784	SensorDataService.exe
2700	ssh-agent.exe
3172	AgentService.exe
936	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e983b0cf209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007dd4f6334220dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfb8b1364220dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040b09d324220dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad8adc334220dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ca698324220dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006bf3a2764220dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2828	elevation_service.exe
2828	elevation_service.exe
2828	elevation_service.exe
2828	elevation_service.exe
2828	elevation_service.exe
2828	elevation_service.exe
2828	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2800	2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
Token: SeBackupPrivilege	1572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1572	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1572	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1572	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3172	AgentService.exe
Token: 33	936	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	936	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	936	SearchIndexer.exe
Token: SeDebugPrivilege	2828	elevation_service.exe
Token: SeDebugPrivilege	3096	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 5016	936	SearchIndexer.exe	99
PID 936 wrote to memory of 5892	936	SearchIndexer.exe	100
PID 936 wrote to memory of 5328	936	SearchIndexer.exe	101
PID 936 wrote to memory of 2824	936	SearchIndexer.exe	102
PID 936 wrote to memory of 3540	936	SearchIndexer.exe	106
PID 936 wrote to memory of 1808	936	SearchIndexer.exe	107
PID 936 wrote to memory of 3480	936	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_fe673aaca87b1b3e54e791a35627147b_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2976

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5436

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1792

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2784

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2928 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2928 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 66187c33d8b279cf8a2a785d814a279e870933968177643e257cac771c07dde8
MD5 46da84cef3ba5ea5c73c42d0c322b753
SHA1 9d4a5dbd97998a78dbd7c4cc79fa23814add462d
SHA512 623cf4e6ccefda1b30f0e6e2988e9500fc5b8382fdb311a86a2ca47ed0c7ccc6829cc065c43fcdddd243882839376e10a05a9699b1ddd75c4f62f58749c2bbe1
SSDEEP 49152:Wb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnX6mGvKVO+n1:I3q60jBgXeN+1
TLSH
T156D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9da9c2991cffc01d025f46a3b1e53e18011f3275c9ab5d44164678a06bf321b3
MD5 9a73f6029d9c42e565c92071d3fe48d7
SHA1 f524e72ff522811d6e6b1902200367e9447c18fd
SHA512 00515ba78d72d2e73ae7255d138d702a7def99eb45076e5491947eb02deb1dba2d78dc84abac02e71e794ae4b16fdcde77f340fc54ef124fcf2861b35f1bd86f
SSDEEP 12288:O1XLsswWkxy2lRq2czAEtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:8XYfDtczAE6mctvE/BT76+1NCE
TLSH
T126850224779504F9ED6B4278C9A2C111EA337C9547A4E7CB03E4892A5F333D86E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f611267e0a267bf65d26168aef05fec058cbf1e738da110fcf6553c2c223da31
MD5 ff2b93fb526c434c09e7b7fc5b1d84f2
SHA1 624efdfe032102302b93dbc0ee81ed47ae0b9ccc
SHA512 b9ae4aa9190b696bd07af200f8629100a1041e10ed7e502846a197292bfda5aacbafa4db747251fd29467d6a885501dab68bbfd91567d656d67191338ea89532
SSDEEP 12288:pXZNYVLeyUji0h90ZD0wxpGZIVutrHs/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:/0Le5ji0hmxqrM/6mctvE/BT76+1NCE
TLSH
T115959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 91b389ed87e2721921c2dff5cfa979e9614ff00d4def2ce1a89b586bef51359a
MD5 ae4b59c8c7940a2113ddb50ebc95c1fe
SHA1 517858cc85ecef53f2c0136e9b54a4fe2149dea6
SHA512 6668c222d4c2ea221775c6ae5a13d0760330fd441d39b544b5dab3301318df8171391a11ff6e45000ce937e6fa2fb7806e914ca6d693b8792aa7163b34292f52
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWr6q8wyud6mctvE/BT76+1NCE:c/ezSC6vUzPviHjyK6mGvKVO+n1
TLSH
T1FD755D15F5788323D0B2D0BAC5D6BA99FE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8958c04d0d3a797a14b57799ed741588ee2f7276c8978763f39e91e320e7fcba
MD5 a187def528b0634854b39c92a9cda4c5
SHA1 f9ef8cace01205f152fc65f8a613c39909068fac
SHA512 808c3542bb482c2199487463fc0df05a70b34173818a9e665c9031027dc07e361918063e1a9c8db68db5710a044826f15d041fc88afe2fa5330338ac9437c7d7
SSDEEP 12288:ZVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98wtM6hct28uP18WR/FW2Gb8JTCMx:ZVbqPb88hv/l+bw6mctvE/BT76+1NCE
TLSH
T1D355AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d7beba130ad61f0e2e06176b6b0150e12c250f5e2195bcf2a80a66d389281477
MD5 0cde15982cd7d95c7ef5444a732fa42e
SHA1 23e3cc168c3b1819e20ceaa5bb1791fddddb7951
SHA512 265bb894177a9c20e62ac16dba9268c4efd8f8cbba9ce49f4c868a3b2cf60e068ea9af70a8fdc3fac03abebd8737926acf39dbcb0838cd8ba33f0ca8981a5d64
SSDEEP 12288:3M7tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:3M76mctvE/BT76+1NCE
TLSH
T17E652382881B11D0EFFF07F16395E296E8516EF934DA1C81D322991F9D30162FD4B9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 1c67e67aa887d70258dd047130a7531f1334a04006e707401befd33fb219d03d
MD5 511f015ef32e118244ae264fa22c6e22
SHA1 a1b56d2fcd4bd38d8272d5542e0726bf5263279c
SHA512 ead404ca02f5655339413d37746a3c76873b66ae4a30a11ea9befa414ed376d4592788666aeb9d169d08624859d48694870c7b591fd23465a4c26cf5639cd16e
SSDEEP 12288:QeBNUbTVO86U4tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:QJIU46mctvE/BT76+1NCE
TLSH
T15C85CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 32c737f239bfcd34f82e64f069f77b44664a181fbeba84f01b297bfb4d3dd5b3
MD5 681b6004c856f049b0c6c5187820919d
SHA1 eae213395a100e0a94b739c2875792001d51dec3
SHA512 63a3e72e0b525394c431985f2c1f2365e5efcc0a7dbe8ead52eee0544493686d21f83a890dc4c8f66d6b55c5cd8f2b0a815862a3ac01d1d95f83144489d6f783
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THy:kQvGAdlCEL8c/RRNw5CtXeN+1
TLSH
T163267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 3a8deca60383f5d61f4170aa75715cbd5cdc33bc9641449b5fa0d002f8e1305f
MD5 5ac51050ad4d09be9b1043b6bfe34ad8
SHA1 97b12e63fe052dd600a5c8420fff8c2ec1a6a7dc
SHA512 0581e2da4abeb0751b55db98e104c34e761717a86078e52fc02eb22667d07635ed471c858579726850911e007b35731a7594a89c5426a6eb06e715d2bae8127e
SSDEEP 12288:bAwSfxL/2Dc3+DLLmt0LDQewsAjmtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:ErewsAjm6mctvE/BT76+1NCE
TLSH
T1AA85E031FE75E036C6BF0DB21B26D316547C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c61d6f835243998c97e114db3732d19da4180de4db79726555317932b29e6d28
MD5 fc5a2b7ce69553d1304e1649d792cac2
SHA1 f1b3914cfe8e3bd66f48d093b398d55c8404e4cb
SHA512 eb4592b8c571d7ad7db0906f765065972e7deedff85990448aab9209899b0d509df57bfc185612f86ecc2393791132bad286ec4b53ab9df29726e5994bb8308c
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHeXeN:kUEtQevvqc2W1cpV2RI328e
TLSH
T19F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4ef8a1f61b391ea588e7368e1268a686adb8218db3965892f3c2b73ca37dc05c
MD5 555e52e652f948d49697a174b6a2ec7f
SHA1 26c8a27651004eb9130a50bd36d8ceb6753e3c41
SHA512 6e5270e0719e885e528af16a16ad5b645ade9071bc899d0a3960ee2d56aaba065b979499f02fb7e09da509415840e030c4e100af1751c4c122c91192cb2731ed
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zG6mGvKVO+n1:1oqtVjnmhXeN+1
TLSH
T104D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 80fe3db09d002338631773c735b3e72ce9c6d7e396c694357911ef8050690a93
MD5 e22b941540d16f40f411cb54acb478fb
SHA1 209d9b1aea0ce00d702a8dada7b45e6a318b245f
SHA512 bd9f2c91c927c5bae6390d57bc36821f5c5f616341166fe624e25c4f3a201eca492adaca5aa9d7b1aadff44f6d86f948ccb7c43d9eb82cc8d8d1bd82e4dc00a8
SSDEEP 24576:DAhGL2IFoiwtA5l7S53B6mctvE/BT76+1NCE:DAM1Foiq5x6mGvKVO+n1
TLSH
T1F6359E81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 3ab46662b4809427482fa9492d0245a9735c2e5f6a5ef2ed5aa614f554b8b98c
MD5 046bb2dc52f136dacd0f3daa55ec605f
SHA1 6a52df96f78210ca7af2bc3b7b59421fcdb4f5ad
SHA512 24f041206514bf3ad55b440b0c49b7a2c1c0cec20ed26ec9d9b8c4ea41455e74ae0ccbd88211b3a210fcbef922f78c86e550e2701e686ec6abccbd0cd3d94866
SSDEEP 12288:fmw5HEjsChNDBFgl0WDm+C9tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:ewu2OWq6mctvE/BT76+1NCE
TLSH
T12375F14676A508F9E9A742788657C136F7F2BC513A25CB1F1360C61B6F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 14c586a98cedbde136b35aa5e432ffdd6efece48d900c73229683aa56547d78c
MD5 ad74b50146e0a22dfe05c1cc8719be14
SHA1 afa26bf038a03a85c5b60dc98c6f8eafc72d3efd
SHA512 f07d098b7d3dda58fcf0dd0a39f1f6ac63be9c6546a4c08dc80b896b67e65971bc69ba24f24ec2628e5900808e65726db7410753d9dcd8176ddf2a63516736c2
SSDEEP 12288:NMZ1Iy2tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:iZun6mctvE/BT76+1NCE
TLSH
T1B2651286226520F4E5E702B8C9E19245E77178E6377603CF5221466F6F33AD26D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 80ea13a4f8b209508eb39d46f7f7fee75976200cd700699b4f12cb231552210c
MD5 b5977ca6f1ae45b13d8762dfbbbe1f91
SHA1 eaefb866e91675323b63185148ff66f755dc793d
SHA512 5143545c638ba47552339334df73dc6e804b04c953a333962384e2968bdaa38da01a5fde41c4686dce4b2ce57c199239f9b40006104ff815b47637939755ed69
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UO:DQRQyi36YOcPhLvw2gAf+PN3MXeN+1
TLSH
T1EC667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0901f89a06b7a857c14f00929c524545b54b7c6f978d22e4db6ea6722bf302ad
MD5 37d0ea1045f72753eafb0f55f8a6d069
SHA1 52be7f769cc1464a39db9abb8b03978ce6513509
SHA512 fedb1c121e831d288611f9a661cd82712d3a61fd2caff2cb403ee7806a3843a4810d0fbe6b7fd38dd922bbdef407e58e07f6f8c7810687c0c72866aac0189cfa
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UO:sQRQyi36YOcPhLvw2gAf+PN3MXeN+1
TLSH
T151667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6d8d2fa4ff4221e7db78ee63be8f5e55c7650ca17691aee4d1c472fe92fd97d3
MD5 69cfdd745240fabad296b5336f5d42ad
SHA1 32d701ab6f4700d8db059de4e56ea0a18bf81699
SHA512 d9d13b9e93fa6db62de404a961dfdcf5b03c6468ee2e402302c09b7989f637d4e2e385fc8be1816d90030be6dbf8ac6a40a7b7cac04b74d5c42a5f72b4fe6003
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0X6mctvE/BT76+13:P68Qg55nhceWu7PNU3/W6mGvKVO+n1
TLSH
T158B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2762aacd9b685101e09397d4c4cea94b87f80279581d80621852f605ede6f01f
MD5 74dfaec00d6d0532c37c7873142c3640
SHA1 1a84e690490925b1752cce2853981bbb5973c645
SHA512 9ff47b72bf2889a81aeb84b96c029a1ef7128063604ab51941fad8f96ab6b255bdafec0ba7696502fddcb373f3f3f00deb1374cd33e682bee167725e929b700a
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99w:7y5112gYy5azzVva69nLKnhZ7XeN+1
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 44c1d76c7a7149282b4c120792a5c270ae5ab536cde5dab83230e64c9223a3dc
MD5 7d58c2ad70a8d09bf84f9908385e82ec
SHA1 111b1b91609b26b8f9f49feb95019cb32549741b
SHA512 cb75963a8881365d5a6ef96bf917d6a307648cdc812715b61d20f4ea9032f07daecfd3d7b691722ddec10a87eba750686d17bdb552a3689fe750ab0fd3a619b1
SSDEEP 49152:+B+taZ3usBWOBr4tEG20bqx0z+n217aau1gl06mGvKVO+n1:su6JmUxd2d0XeN+1
TLSH
T12CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b305f7cec49989729e820f6d12acdfdfcc7e3707f7ce2d6d4ba93d8c1ba624b7
MD5 4039f7a9793598e0d5b990b3637392e0
SHA1 f29c6a8ea35f5b9cc25865499253082fc46b9f7a
SHA512 463dd941a54a7539df90dec112384f3ec292d46b85820677c5ad7112d602770b591f8dacdf73c363492433f5f7d8e1c7ad7d48eb1fb806a746598cc43c41265e
SSDEEP 49152:v1hpsNoJpF1A6BU44CwH7R4xY6mGvKVO+n1:vmifPkRhXeN+1
TLSH
T1DAB5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d63bdf27199106493248692dfcd8dc42e4504ce1cc063b934906f7b4544eabc0
MD5 5944b3ef51082e356c73c5cb83e314e2
SHA1 50fe93e1f4b4235712cb566544c4150ca891ebb0
SHA512 81c155f8fb7a8311387d5ec4bc7370433d10e7acc52aac17a611f0320784ba0a4606e7db3e9b72491715d14f6062f10053b56eac9f37fe8d3721ed25906e6c9e
SSDEEP 49152:iSuZQIY0Be2KNRVtOnks6NMHqn6mGvKVO+n1:85dKvi61nXeN+1
TLSH
T1D0C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2f26c482e7b60253722f28eb125adf11e6867c42f5c0c8f60aea90966d237a1c
MD5 bea79c59e504d81cb60397a8b0ae9414
SHA1 15a5843cb51265083c1cc8477af7621b3bc4ad3f
SHA512 86534f2d842c9d552a680e7acd9a11f66d200b01f37e7f50f8be9bcd651c4a0da9da0d3c2b8ba3058fe04c65f532168128839e606f2522291982c0a3bd4fa3cf
SSDEEP 49152:AhtSn8EApI0figXgiDn0AP5wE6mGvKVO+n1:RX2iyphlXeN+1
TLSH
T1FE95BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c017eb39d4729e1b38e00eb527db9cdf6ae8706491ffea09aa9570bac452cacd
MD5 fbdb635a1f2273c2b4ff11800c755ded
SHA1 37156ff7c967c44b58b53b0a51bfe1df85bfc409
SHA512 8f4a6f60b083463e5e2bc15c11e4d3bcdc569662a043ff56fc0a55ff7ad9a4ff1198781b29eb8af54b9f45968f1cf662563e4f2fe0ce401b9aa9b80a22dca80a
SSDEEP 12288:kjtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kj6mctvE/BT76+1NCE
TLSH
T185652382981B01C5D9DF07F19395E29AE8502EFE74DB1881F316851FAE701A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 292632131353d16b97161f51d1e5d6cb9fd99532c4347c17e86db8afc45c3ba5
MD5 ebddd83cc8216de2310562001ac414e4
SHA1 c67a49c92b985a762952990643aff6ae5bd7e045
SHA512 a569c89e39850d9ce154fc08b88b0935de7fff74a736036fbc0e379ae3699b5d14fece3d95a9d656a966a919f9c18c7d3cadf39b434582b39b8ccaf3714eeb15
SSDEEP 12288:uCtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:uC6mctvE/BT76+1NCE
TLSH
T149652382981B01C5D9DF07F15395E2DAE8502EFE74DB1881F326841FAE705A27D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 b9e7ca34b4e8706e8f1e4dc154dad6328363c7328d54a09d644eb79e73892763
MD5 5fcdc5d53086a9317bfb1c23b903d36a
SHA1 b70ee1db25a2dcc68ee65dcec7289a099619456b
SHA512 d0b022ef38118b5471334ce3e56ba63e07733ad81b4fdb1d6c17bd2de3ae14461d8c0cbcc5fbcc83f813c9bde395a503cd0d3fee84c4193e5aba42b077c73512
SSDEEP 12288:NgtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ng6mctvE/BT76+1NCE
TLSH
T1FA652382981B01C5D9DF07F19355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 971b5a1cbb41c75f61a9a53123d57c042495ca4dad95e46854916af586e123bb
MD5 add15f7d6e8af8e4f6e25d08359eabc8
SHA1 c910a28734d768e7ec4c8e729191445b2906cd65
SHA512 0704bfdb4860f01f710cde880abda4545063ca9cb3d9d73874d97e337ab34a581e049db0347b0f75c1dc342840a56d1e0f11ee13b056e4278f9ecd979f233787
SSDEEP 12288:aVhtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:i6mctvE/BT76+1NCE
TLSH
T1B7652382692B01C0DCEB47F0C2A2D296E5B07DE975A719CBE311491F5E303917D2AFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b3b7963002f975f00baf9118ed4c9be71634e7f032b4e646de467f69d4a8c0de
MD5 2a93fa38d1ddea28764b989df82e7bf3
SHA1 1bc62651bc97fa09cc3480c2224e0afc646fd4c4
SHA512 7fd448c06c37204377b39b37fe30bc92411144dcaebb28c02e30d3654498237cf5aa6a103d638a0d2f293688141fcc37442b5e4c735c71ccd4c70dd34b761312
SSDEEP 12288:eZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:eZ6mctvE/BT76+1NCE
TLSH
T11A652382981B01C5E9DF07F19355E2DAE8502EEE74DB1881F316841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 04f344e064e0a480ad015056be3a0ae6536bff72206dc63ea68064e0cd1439ad
MD5 4ea352ca9559d1b642d3af68f9087020
SHA1 cc972f55d466cf7567728479e3d6eb9f0a78b0e2
SHA512 a82749b46a9ed7fa6d7add1f0a725785a7cf8725c37c522f85a365a345ad9371c7184b6243d740078edafc0421a3ffe2a767a895e3cd1e8fd8f20a506358d303
SSDEEP 12288:KutM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ku6mctvE/BT76+1NCE
TLSH
T11F652381981B01D5D9EF07F15355E29AE8502EFE74DB1881F316841FAE701A27D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 a2e4d28de40e492e4a4a5a4e0acc8aabecfa0c1219e93d4dc8bbd9380b60670e
MD5 ac716d6d28571c860ebf78d167f6d464
SHA1 06a6f43ac1c0f6ceebaa3b47e4c6d628eba35c3a
SHA512 7f0dc1419918d11deb4d58871bf8a2a2a16107a948fb25f6b88a5ed1f32a2b6cd5b61dca42cbd20234ae2951de5f41cd56dd704219b68690797bcec56a1407be
SSDEEP 12288:CatM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ca6mctvE/BT76+1NCE
TLSH
T1BC652382981B01D5D9EF07F19355E29AE8502EFE74DB1881F326841FAE701627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 a3d00226b24d766b798c208d0c11c68307335dc2e39490150915f5ecfb18f316
MD5 df1489748728a5bf43eede400c2bef33
SHA1 4d589f36bbe1b9bf68cb01fd9cb173f5bd14a4e9
SHA512 84143fb18a292343fa5092887067b26a0dae2872a435a87fd3a4864297bbb7298ff332b60d976ffbb1407c76f024d091d1b1500f5f044a79923cdfbc2e6a48fa
SSDEEP 12288:KiZwbrzzFEoS2cPvyitM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:tZM/zFVSOi6mctvE/BT76+1NCE
TLSH
T1C9850295B35118F4ECA7427EC9558506D6B27CAA16B0C60F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f2e4b6618dd4172b51ebb78eeb5812a4f15f4870d2d7d5fdad4585aa441a5664
MD5 bed57bd760bdc326aa91c3b5ff644e07
SHA1 1d4c587ef0fff68eb176a58ab05b15f247c9dda7
SHA512 addf38edc9a0c01bc31323f39d0ea71657986f57d297c98ac0a4bc786ff6f2d31bda11128a68ce8d7cf490334ac2306e07969da9ce1828edbb901ab4e693ad6c
SSDEEP 12288:G3tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:G36mctvE/BT76+1NCE
TLSH
T16B652382981B01C4D9DF07F15355E29AE8502EFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 409005799bcc7236fe6091e04de3c39ffe1e76b92d803fc76464cc01ef4f3fd4
MD5 2d9340b5fc4a6c4a12058f78634585ce
SHA1 ef39f0fe1c6d1d50dbc413c227c9f1d0bbce5a69
SHA512 56e33e069de1d9d2b700c587cfde5b70e4556b2b0e1502c83a9d42303dce8c73bd9589708479662c9fd7199c2d4aa5988d8dd640fb3adcddba98c82044321eb2
SSDEEP 12288:zLtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:zL6mctvE/BT76+1NCE
TLSH
T10E652382981B01C5D9AF07F05395E29AE8502FFE74DB1881F326851FAE305627D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 d7d7fc800362c80f3c8b416488bc416f1ae9dd546f71ec9f218e448aebc01c55
MD5 9b01034a1aa0a542bb870a22a4449dbe
SHA1 79470c38a414f30bcc0c62244b6a27030b337424
SHA512 3082e001dbde8ef7298cdcc39dd4a336a1548beceea77feeea0259627444426cb92bc22cb90af1af07f04d6f954d97f6fc58f4c126521baee963c0f8c94b5a4c
SSDEEP 12288:ryPz5L82tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Gzy26mctvE/BT76+1NCE
TLSH
T12E750143726630F8D57B4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 cd50bd202469167244b719ea30336f2485c6626844bb68b6f128fddb6e841ac1
MD5 749e60eb7301d527d8ec0b69525b6a77
SHA1 850cfed7022039a3aca2808f08b577c742a9c361
SHA512 9b519f19ba92722d0512082c9508bc2b955c9af3f03e716cfb6dbfc994df5bd1dac783fb78826971b618fb08dd73d44d840a5dd7c23a7e27a77f6b7c3fe6eef9
SSDEEP 12288:l3tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:l36mctvE/BT76+1NCE
TLSH
T19C652382981B11C4E9DF07F19355E29AE8502EFE74DB1881F316851FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 05d85e3884df887b8fda7a20d1a4f028b6c05df95f7e4c152e525d77780eab8d
MD5 558d97a261d07ecd6ec8521ebc965163
SHA1 a2f1f73ab9c3d5cbe913883cef406a9e44e7c6b2
SHA512 4e29032b052a791462c597d2c8c23421f6b68b29d222e54b5d6397813cbd5bf2fe3c64c7fd80c6279a28400bcf2172cb9174148b00c79b3746a4953038b06597
SSDEEP 12288:j3tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:j36mctvE/BT76+1NCE
TLSH
T19A652382981B11C4E9EF07F15355E29AE8502EFE74DB1881F326851FAE305627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 cd39fa40a10c54d385ea033fb1e823bdfab5927f495d4613180c9ff9fdb82190
MD5 ea991e802bb66cbbe3830da625cb3b22
SHA1 4b283b77603d2ade28232b2a0dc889ea18fc70b8
SHA512 ce36fbe1657005ec5736a0de483489bab2c09585368df37ac5b7bc05b9e049d52762d64d2f08ff176faa8a0d41cbc26b24b08d9a957a4a7b90db63668e60844a
SSDEEP 12288:/yPz5L82tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:yzy26mctvE/BT76+1NCE
TLSH
T1C3750143726630F8D57B4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 5df0c0acb0c6c5b9611470d9e6bd106160fd08e9891a9c54f9a9d446fdeaee3a
MD5 85ff5b08eae6fdcdb815044fbaed20a3
SHA1 830b6b9ef541352df3e6f629b914ae96cdf47676
SHA512 0b13b2b47e8f2fd39e4a83a7cdcb952c5278b33ecac58b2027889149d66b29148bbdeee512bcb46d84dc47a84e0bc3e40fa11b143d9c1db49c76c6986b32a5a6
SSDEEP 12288:3Cd9NWYoaLHF3z0z04PDvhQtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:yT0aLl3z0zDQ6mctvE/BT76+1NCE
TLSH
T19B850295B35118F8DCA7427EC9558506D6B27CAA17B0C64F03B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 7308853cf254a0e44d9dfdb1d83f58041ead87a60525a710bf8530879b433f12
MD5 dc00108aed791f57cc743a497449a77c
SHA1 b4f84cde5bd99f75d29dd23dfe14b2fd7f0376a4
SHA512 37fa4193fca0c18d282e2605efa289d13f506b1d4ced08f05fa95f3e6732d2d8e5dae68a80d35dbd63e1e389f640b185178796a5ed131efd4fdcfae2145cb243
SSDEEP 12288:ci4e7PRdTfgwCHKy7GLbbdIv1tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:c3Id9CHKy7GZs6mctvE/BT76+1NCE
TLSH
T1DE95CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 11be5e80500a967ad4d4c1cbc59cfa940819bbb3d278ce75a0e49d4309409f5f
MD5 6f23d72222c4d3e5babca54420da3050
SHA1 48d7a6f417e595f661cef348c691cc952bef31ac
SHA512 9ab98776885e980a34e8b36f57002bc620680a91c10c13cf171904799b67432858a5ebca2bc89648eabd3c0c24fda23b5fc0a95f2dc8e911a2275ffff32d2112
SSDEEP 12288:WAtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:WA6mctvE/BT76+1NCE
TLSH
T175652382981B01C5D9DF07F19355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e709d531e8e88f4e78c082f3b1c260e7caad7e84a4bcccc9523fcf3d9317266b
MD5 10f824197ae672c748b5aaad4021cbb2
SHA1 04896c23f7dd913dbe3eb340752dbd6367688d45
SHA512 7130a4846264f0c6b453cbb0af7439d6b358d3388b4462bbb9524add2b6b548aa8228647433df38e1dfffa2e645d0474acfa6d1e88972582e0b02162d579af94
SSDEEP 12288:xWtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:xW6mctvE/BT76+1NCE
TLSH
T1B8652381981B01D4E9EF07F15295E296E8502FFE74DB1881F326841FAE305A27D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2dc97923b8613770e654ae06de493f9fd1a8b55194dd371e965ba33e81180367
MD5 93fd35ec465e71cbac796399f3266c6f
SHA1 4789c0842430870473611d4753bfbbac7d6d5bc9
SHA512 8bc0a47fbb108b89e04c22445dfd8b3d5735accd73c11118fc03226e4543dc011c430696693220b39d1c4349b1c3fcd4ca847ccda86afc18a2187bdb34faa13c
SSDEEP 12288:N1tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:N16mctvE/BT76+1NCE
TLSH
T1A4652382981B01C4D9EF07F19355E29AE8502EEE74DB1881F316851FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 d50808caf0ee64a32358aaebafab8445a07c7ef92c683c641a14c91e841a5706
MD5 d6b1d8cb7cc991e96d6c3fe1b50c49aa
SHA1 a66cab1908f75f0ede327384bc54d1b5cd64a35c
SHA512 da8c2cde86a5d2a7721f2a1090196b9c20252923c2836a4913bee709e2f8ca6becf701666a500c74e51064459e3c78959e6468c74bb92f21bd39d53f0bcb6859
SSDEEP 12288:n3tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:n36mctvE/BT76+1NCE
TLSH
T1E2652382981B01D4E9DF07F15355E29AE8502EFE74DB1881F326851FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 d5f241326e38bda103bfd2f361380d1419e7acaa45f34eb1dba3d7b340d4f473
MD5 645f687bf27b8333a06b05a708c4b3b0
SHA1 f525857945e4d6491ae16d794bb312ebd8f4126e
SHA512 6594a2c182e5434ca7506d42edf08c64fffa8fd55cc2ed426abc031f0569cb96d917b8aad8ef25906726e219069a0f081163d2cc861bbbbfe8ee303577c67ca2
SSDEEP 12288:YAtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:YA6mctvE/BT76+1NCE
TLSH
T191652382981B01C5D9DF07F19255E2DAE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 264ed20b62be5938a0606369ee2bbd8790c6c7cd2ba137fbb0f13c9bfd7e06f8
MD5 e86c5fa835b185d093ace6c7ef22f2e0
SHA1 60e54100faa0f95f54cad1047b64a120461124e0
SHA512 ffc6cc792846c26eec1a39877cb36b081ab4b4d7b929cbf7f6f670bcf8bec15e0660ccff15ef70c477ce52cd77a50d5c2fa84d87ba1ec3c306670b59d5abf35c
SSDEEP 12288:kvtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kv6mctvE/BT76+1NCE
TLSH
T1C3652382981B01C4D9EF07F19395E296E8502EFE74DB1881F326851FAE705627D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 6f92b1cf35e0f4716fa80eed03165c7d65e5e89a7b9ca14b1ff47ca081226fb2
MD5 667cc269649686ba6c66bc219aa95cd5
SHA1 1f2abf5ad396b8dab75c5195a9319e257816bddd
SHA512 cf5239e5b48bbbc8c460bce82171bef092181626f6cb7d2d82adaf6bad721f1676be72b87a508860b76186880271b381c1008659895b671f5b7cc6c0b4ded34e
SSDEEP 12288:wZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:wZ6mctvE/BT76+1NCE
TLSH
T1AF652382981B01C5D9DF07F19255E2DAE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 36b246a726a837c720e1961f63640b1eef060aaff00f50c58a0e4dfd948517a8
MD5 c17f27a62fbc3461f777c249f587ddd3
SHA1 218c4a0ed6d4e7e02e6a04c4b227635350cfd64e
SHA512 713aa9055ca81f9f3c78b8ced1f4923f4fd9bc612a8afdaf0fb0c71ab3025d8aa50620c5bc4b3d3896b55e02f1a60f13e98d1ec9b85ac0698a7c4da15e1b25ff
SSDEEP 12288:/ItM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:/I6mctvE/BT76+1NCE
TLSH
T150652381981B01C4D9EF07F19395E296E8502FFE74DB1881F326851FAE705A27D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 7cb80e0072a1e0b4de35df3ce30f7e9fd2fb58a26e43c4f05435b165769dd939
MD5 f72c1cedce116c6400d1b7b48d75aca0
SHA1 d5bde108a0af1bf38163c555d1e3bb9c7e36be07
SHA512 f4754ceb37ae1772f5dd221cde2965c48da95c8f36268510b368feb56f6ee7a5010f842014c8bbc8debc98635df69553b8da45f13c9e19ba41a45e9006e55b88
SSDEEP 12288:uZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:uZ6mctvE/BT76+1NCE
TLSH
T15C652382981B01C5D9DF07F19255E2DAE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 2a4a1d2d0afd10af85787ad9c19b07909c2230a50ae9defa66a4cfa81328f46d
MD5 a90cb7971c05217fa0370b798c2af467
SHA1 904b6136f8e6d32af29df0e572407ae49cd0f3ce
SHA512 00237bc5aa60810cbe9e1c51280b3b44edeb9af23f3f449f805fe9b9efcd169f01111f9c479f53034bb3c07d490a317958666c422bc04f2de26816e4fd177b56
SSDEEP 24576:gfwvik9RX6wkyAIb6mctvE/BT76+1NCE:iMnYIb6mGvKVO+n1
TLSH
T1C895D129EBDC04E5E1B7927C89B3460AF6B178691B31C6CF125A536E0E33ED05D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 62f149a1c03ce50c663b1fbbd646be83709c2ee2f458fedf054de9263a5e27f2
MD5 e73f2d5f1d819649ef3f5a58fead4762
SHA1 e297707bd1ba0e7afec789a24e59a65e2fe29d99
SHA512 42ea1efe846b987e766ae7c5266293dae8697e0692c860e29e6d2d551aa0583778639fecc9d748e2eb166fb158d81a05092b09039626b35353597a7934728aa0
SSDEEP 49152:OYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0k6mGvKVO+n1:aySzPsXeN+1
TLSH
T16F067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a19e85873abdd9f9b279e87148f0198a48fa45d2a8c1b5200347a985ef4a1d30
MD5 b16c9dc6a10453812532e1adafae7abc
SHA1 9a2685c468e57325f4ca65131f461062fe4b27bc
SHA512 287a3fd24aa782005d1ff82a1e94cd4f6def7ebef559e54b7eba11c178fd85bcc36dddc745a896ff28ab82191bbb3767204087b9d12612d121f6afc477c2ba69
SSDEEP 24576:047Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYy6mctvE/BT76+1NCE:047JUQj4irIhCnDHUPfF/06mGvKVO+n1
TLSH
T1AE65AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 0b8e259f2a9e6c52acd456e639f4a87fde5d3ad5bce36489d1ace47dc1ea64f9
MD5 964eb4cae9a0201369d303f0dc6dd8ff
SHA1 20a0d7cf9457d0a740abefa01af2539b21fccdbf
SHA512 64b6ed94cbf9c77699b6ef95a33db006b13cfd38d833a8fd42b3e1c5a1e39ff4c931dbc1747f316f091c3556a043876332d7e862cb9e06ef90923915a09c5383
SSDEEP 12288:e1sfntM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Tn6mctvE/BT76+1NCE
TLSH
T10775F14AD25902D8C0AE12B5C7569241F7333CA597E293CB63D0F53E1F32690ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 bf375b22aba6cbc4f612a249036a4dec5cf6a7685ecd3302bff524b5384273d3
MD5 f6795ba3d55b6f53db07b21d6294ccee
SHA1 3c0155919d76b460793ff6b82c0148e11957d4fe
SHA512 c5e272bb25f206dda055fb9a4a4066a27c9ece45e22714e5cb6a962f7c6d86079d714c2b8e0a7fdd9bb2099740094a6be695319c5d8a61132b83db1af3772c68
SSDEEP 12288:GZ8pkWU3fyvI0hp/s6KLH+G8maRP1gESvV3Rcj:GZ8p7UPt6Kj/8hJGEiJR
TLSH
T1CB351840766BC75FC6AD44325E36D6CCA7707C01EE446F0773C88B3F9576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 df2d665fc5f9ebf6e49898b52ae22f361d41402d23aa74438300fd3eaef0ef13
MD5 fc1105f35c548e847dd5bea159ded010
SHA1 77c987653fc6e15892fdd1a8dad25e8c7a0d6c02
SHA512 2694994074be68adc1958701d43e27840ae8de32ccda91cc7bb4469c0c4be35c69eb8f712db08c02d6fd1e1f9bfd1060f6532e30dc9413ef24a456291b69be6f
SSDEEP 24576:envkX2sus+XwJqeSBbI6xMSP8hewLRT0tipojKSBAC:envkks+XwJqeSBbI6xMSP8hewLRT0ti8
TLSH
T11875F981513BA3CFD1FB5031072A6F4CB764EC16B7096F2673C9053AD86AB25A1B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 474ae55cec8685903a5066bdf73b65aec12a645f9a5c3f3358bbae523770609a
MD5 2cd25ebda1277059baa3eaaee6e75868
SHA1 008b9bb408a2e3c98bae27d89198a28113e3d45d
SHA512 76c7df51fd25370d01e7ea63d915a19020ec566f490b7171a6252d177d1c44655779806126f1492de065bcc8e55d27d7c734897b7618dc83d8f8e8c5269765dc
SSDEEP 12288:pv7ftM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:lf6mctvE/BT76+1NCE
TLSH
T135652382951F1184E9FF06F0529AD265E8157EF93B8A08C3F212851FAD305D1BD3BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 322bb7716ec5ca440db8f4aa7cb7fa834f286715c15c98a299204224cda1dd80
MD5 4a96ec4c80e746334e906486e6177f5c
SHA1 a84a9ed53145a343c1c4a222c1d9cda6d33d569b
SHA512 7403144fe138518fa2a89c697763178ba286c6cb65ad2120e9fd045945c12e7a01f55c6997a871dea1a981420b979ed55a4e524596537bc883e57b6cd6303733
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYd6mctvE/BT76+1NCE:1gb4mBIBhGFy6mGvKVO+n1
TLSH
T167659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 a76e42b6608c3acb4b8b1f2c86b1ef327e95d6c46a53bc5ea578692bd9621121
MD5 98a83e9e42a50bfa0fd562434c9a92b5
SHA1 c5c34f2edba0d988825f164e0fd69fa6de443655
SHA512 641a52e46adbbbdd938ef606d6e32cfc7b17de83036671cf57470492f03571abf5d16c37ed75de4e4235e209b128ae0de414d49241aae73211825e443ad0639a
SSDEEP 24576:rG88u8FpJqH1jzria7/mi6mctvE/BT76+1NCE:q7ZFPqV2a7/V6mGvKVO+n1
TLSH
T11B95F16576E101F0D47BD1388A864263F6B1B8251364EFDF07A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 6dac85fb71bf538cf600f1a754e5b496f2e7637ee7c2a5d7570d711e3be98c80
MD5 7acbac8027a08df1556b5565da7f492e
SHA1 b4ae9e5770ba30b202579cbf6ff7568ab6c4f6d2
SHA512 53baef4b49a95f7d74eda0d52b59fb1f3b514bf9c8559dbf0716bd1b24961b5e5f6f9d9550fec820f8f2f0f4505c91ddd125d5a43320edb675422ebb0592d8c4
SSDEEP 12288:3HvUrBFrEjwaQ+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:3PUr+NQ+6mctvE/BT76+1NCE
TLSH
T1BC75F21F61AD18E5E67AA17C85828319F77178A2175292CF02A1813F5F33DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2036fe5858a93ebdcac99169c1b3cf65d9f53447edc3f21e3de848f9ec416954
MD5 3ac45d87232bfaeeef6e424f9051f9e8
SHA1 ff6a033a441eb4be6a1e131f97ed47570aaf9dd9
SHA512 a7d090cb542a34cf09dd996048c542b0e604a87cc5060875c37f86b75de0c1faa1c6be992e40489477771be0c3a021d539f12392dffef97f9bb93f563ee96e21
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAju6mGvKVO+n1:lG05lO43bzXeN+1
TLSH
T1CDD5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8316c2558e921f37349e55064ada699757c2f8290d8a0cf0d6a3f6de4f751790
MD5 05f00a5c376de42bf06809692364596d
SHA1 157d5ef0c1c4f9c71e45a43299cd526f6557b981
SHA512 88db0301912f9bf4914d223b60887d27ba1f3f796b8498d15dd3abd3c9de2be6d12936178d7ddb39b7534f21a0633964cb9e69d00f2be8d39db659eb1d1e9e5b
SSDEEP 24576:lfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnk6mctvE/BT76+1NCE:la5POZ39Jt2pasx2+mW6mGvKVO+n1
TLSH
T1A865BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3521a6fff0141071713c68b0956eb7aa5b0080875594435708b7d0d694066ae5
MD5 c8cda9e2f7cf6a0ca6bd09445c4d24cb
SHA1 e44f79aaa11810baa8aa5f12564149879697b34d
SHA512 11c8142a7d16a36ed0b65e29e36b8f00b164d1a2ba3ad380ff20c362eaeca009a3de550245f7d07f6f50af01b144acb39a48e45420600de6bba1697f0b5b20e2
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7FkK6mctvE/BT76+1NCE:XNc/zEOVHF16mGvKVO+n1
TLSH
T12B858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e0a07e57507faa67a7edd25cec3b54ffd92682056850242d9200956bbf4d2270
MD5 557e8754143a77d75bf26bb1f766343e
SHA1 e94f95ecb79645307caaa388cf2b75f6aac282b4
SHA512 eb5eabcc0d57aad03758d7975dbc1515eeee25dbe87f16c939ce58788c1402763cafb205e316d5dc38e09b6ff271959869f5f72f4202d2b80f3826814ee3b72d
SSDEEP 24576:ktkNvNnaFeYhJNtmZBmI6mctvE/BT76+1NCE:ktMwBtOmI6mGvKVO+n1
TLSH
T10B55AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 d7050b586f542cd6bc1fff5217cd42aa82471658269ff8c253baa1270f4b8b01
MD5 a35b1519a479fff3529000b44b977ef9
SHA1 5dfc2a2914ab7509fad5ca7c5068c6b9a1d7dc40
SHA512 e52d93609bd8e5abfb7d262a91b9d6349e7c62c7d2ab952693cd8fe1c20273796bf0bcba6e61b0ebc27a2867f6a0d36fce4f6ed44fe24845745accdbe4a653be
SSDEEP 12288:KQcMxWDXN1Dp/fshBItT1IQgADtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:YD3FHshBIYQgAD6mctvE/BT76+1NCE
TLSH
T15F85E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB0294C1BA5F67EE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/936-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/936-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/936-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1572-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1572-382-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1572-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1572-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1572-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1572-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1792-80-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1792-310-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1792-79-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1792-85-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2700-122-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2700-370-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2700-116-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2700-115-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2784-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2784-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2784-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2784-366-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2784-109-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2784-103-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2800-315-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/2800-8-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/2800-0-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/2800-7-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/2800-78-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/2800-311-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/2800-1-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/2828-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2828-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2828-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2828-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2976-47-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/2976-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2976-40-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/2976-51-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/2976-55-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2976-46-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/3096-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3096-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3096-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3096-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3096-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3172-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-137-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3172-128-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3172-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4764-63-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4764-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4764-294-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4764-54-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5436-68-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5436-74-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5436-309-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5436-66-0x0000000140000000-0x000000014019E000-memory.dmp

Download