52aa4f087547714749d56f5cbedf61b8dacc8abc9b815432a087e1ffd6a4c0e8

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
Size 1.8MB
Sample260730-v2ts8ach97
SHA256 52aa4f087547714749d56f5cbedf61b8dacc8abc9b815432a087e1ffd6a4c0e8
MD5 7445c7d18d3c5232e70c39e2101641f4
SHA1 e2b31813f9343350128592d26322dc1c7fce7cea
SHA512 be97d495de40a725e726cd261c5035e08d993678f3860e42e2258eb311a7a343b4a9210798ac2b19dfe95bbe81b0c3f7c6eb56044fe023620b95e8a7151d2fc3
SSDEEP 12288:xM1mOPwtq9VSrJFggIIvS5ejcqotM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WrC:xM1mOPSIwwcYqo6mctvE/BT76+1NCE
TLSH
T14185F119E6A551F9E5BBD13CC9924207E6713C959BB1C38F0391095B2E337E09E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4532	elevation_service.exe
5864	elevation_service.exe
2784	maintenanceservice.exe
5252	OSE.EXE
1412	PerceptionSimulationService.exe
3820	perfhost.exe
4336	ReFsDedupSvc.exe
3828	SensorDataService.exe
5792	ssh-agent.exe
5388	AgentService.exe
1816	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b499e66ce62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000314bcb524920dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048b665184920dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017dc7d114920dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d443a7104920dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005daeaf524920dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4416	2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	5388	AgentService.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: 33	1816	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1816	SearchIndexer.exe
Token: SeDebugPrivilege	4532	elevation_service.exe
Token: SeDebugPrivilege	5864	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 5396	1816	SearchIndexer.exe	100
PID 1816 wrote to memory of 5636	1816	SearchIndexer.exe	101
PID 1816 wrote to memory of 1084	1816	SearchIndexer.exe	102
PID 1816 wrote to memory of 784	1816	SearchIndexer.exe	103
PID 1816 wrote to memory of 3100	1816	SearchIndexer.exe	105
PID 1816 wrote to memory of 5036	1816	SearchIndexer.exe	106
PID 1816 wrote to memory of 5540	1816	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7445c7d18d3c5232e70c39e2101641f4_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5252

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1412

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3820

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5792

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5388

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6953463b654dd36331cd55fff9a3c158186338ff117fb172b1e6bf958548b430
MD5 f8480c66078e90ab3c6245a43a724cd3
SHA1 ad78688726e9faafb10dc2f9b6c74451a536f977
SHA512 a9335cd33be24025c0cb408ea09b2a669801bc6132342a3bc02110172e17e8c3c926b4b6cb77f7fafed78a0d36c5d26cd88001ff0c13d28c7888e893a6057927
SSDEEP 49152:lb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnf6mGvKVO+n1:73q60jBMXeN+1
TLSH
T18CD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 c1e9014034386e532c3b4aa9a968f01fc240b895aa9417cd53a0a0839bce4dd5
MD5 8b4e08f38ddb84358f27b05320372108
SHA1 02a47ffbab68503637d72d07684594464581607e
SHA512 bc1198abfa3d3fadceb8ba2a9c5c1d40944dcaf6fa5314db90bb13b68478a634a8a553f2fe4114f9e0f63b61aa381f464092ebc13ac8bac1520714b4023f9dc7
SSDEEP 12288:G1XLsswWkxy2lRq2czA4tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kXYfDtczA46mctvE/BT76+1NCE
TLSH
T1EF850224779504F9ED6B4278C9A2C112EA337C9547A4E7CB03E4892A5F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ba3d03d36dc9b78b65aec587bcf5f2bd03804c69a96e78d759734ce2fd76307f
MD5 2ff7b53ef109b7a07499998a797a9aac
SHA1 7116cba2855cba357663c9328e51116ca5dacf28
SHA512 674e66619f5e28bc24983a5bcfd26729bd27dd2824e794d1df4824670c7f5b68b387b3ceb57bea5a1237b57e73872ca69c1a0f11b0ffe24b79b751317424b84a
SSDEEP 12288:+XZNYVLeyUji0h90ZD0wxpGZIVutrHsHtM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:S0Le5ji0hmxqrMH6mctvE/BT76+1NCE
TLSH
T12D959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bdb2218a47725787a09fefc1deb787236ee745dea64bbcaa8119ce0193877f2c
MD5 2048682138b8b3e311d7030cc9fc8d8f
SHA1 7329a4fc32312ca82f7b2dbd913fa4bd90bb8ff4
SHA512 6a8903994a2e2e55b8191ae439ef69c6499abca6a153d32d9c90115f47cc33adbc55f52927cf31879ac03921e0ad4b174a2cee418d8551ba99094bcadbd75ab7
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWr6q8wyuh6mctvE/BT76+1NCE:7/ezSC6vUzPviHjyq6mGvKVO+n1
TLSH
T100755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 78dc81438d5b9067d78cb04a326485a1f7009b56b806e684ef4ee361fa4cbf49
MD5 bc02f2cfd8b936bf58d0757a3ed63f10
SHA1 7878160b700d5b5b10631f6f96674b7d53412470
SHA512 9bc4c23982e710c106299cb2435960f7ab7940784f71d46f9d9cc014549794a60f924e1adccfd3e0264714348ac6917563a963dad5130d946252ea133e6b3d9c
SSDEEP 12288:zVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im988tM6hct28uP18WR/FW2Gb8JTCMx:zVbqPb88hv/l+b86mctvE/BT76+1NCE
TLSH
T13855AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 e8e81ab68d58a152f9f2b5de64fb63f25f479c037e8141a3f7b92a86545516c3
MD5 336425db5ea371aacfb129fca2a1d3f7
SHA1 e037dbbf9927b5b63290e1c1fcad46f7162a9d67
SHA512 8f08e67a87c6c16ac5bf802262ea3aa014a050a175c814924eef49248e4ddee9ca9c80dc2357dbed07bb64e36dbf37ada41b2b625451407aaab6c8e3df94c4c9
SSDEEP 12288:dMbtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:dMb6mctvE/BT76+1NCE
TLSH
T107652382881B11D0EFFF07F06395E296E8516EF974DA1C81D322A91F9D30162FD4B9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 f00b4cc814d0f1e8a3f68cefb3445a85aa3883044e8d6a2ac55f29f01b0c74ae
MD5 34a24949a61038f4f9181e22b0bb3a4c
SHA1 6f0069c78755c78995be75772766402acf2433b7
SHA512 d0e478c518abe922069a387ba1697c32bdbf6afd488f8bee3fbaed8d7627eb6379e235f9cf3ca1100a1c7cf2fc407cf28ae493977afa78d557d6171332aa7320
SSDEEP 12288:LeBNUbTVO86UEtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:LJIUE6mctvE/BT76+1NCE
TLSH
T1E185CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 00a34ea5359bea3bd074fe20816b1b0ed251bf5ed1a84eaecd3f7aaae3b1dd95
MD5 2c2ad150ee5dbd39466d3d4da35e3013
SHA1 6b9a9a1a5254a0de02b0702228344be2ae3985d9
SHA512 aafa46d5c8b37b4290a15f767d8ae0bef590f78dfe0ae62b279fbae4262007b764f3065251094648271c54e0fa2814a9a1faf134d2a7cacc6cb70954eb8f7a07
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH4:jQvGAdlCEL8c/RRNw5CRXeN+1L
TLSH
T1A1267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 9c17c05b446b2367bffc65d3428f6f7b6d5671f209e39f757a26d769267393b5
MD5 751bb5c58a07ee2b2e1c0e0d56d99b0a
SHA1 fabcbfc9a81eb83a84fced3097a61eb3717d862a
SHA512 87724455097ab23b5ceed14eae1c0f78e3a54ce9d5a6047f83a960663b6b5b2726732040276cb040eb6bb98596f0d91d14c15e9b4e81585451b11076237c9271
SSDEEP 12288:/AwSfxL/2Dc3+DLLmt0LDQewsAj+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:IrewsAj+6mctvE/BT76+1NCE
TLSH
T1A485E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b9c2f48fe0046503661a361ff0193b6e3198f3872c844598df3107d620a3d38a
MD5 5083ebe52d7d20ae0aaaf153360afab5
SHA1 8a0795291f486233c01d7474b6b9e90253c63417
SHA512 fce0563f793fff8c6fc21b676066ab3111101588b1a887990673ff31da98ee469104d2887eec737c8e30d8c0818df4ba97153590d9a0b6f8d27fdf42a66ea30b
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHWXeN:hUEtQevvqc2W1cpV2RI320e
TLSH
T172474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d8e37ac0248e0b9ec67c2c734c5adab890d844cc026fc7aecc3f547b11eaac0a
MD5 b66f943dd574a025a45a5cdff827f1db
SHA1 fd600558c84e43d22eb022711355533480b484b3
SHA512 2d6ed38ab96412e1bc0fc50fbe87246c23417ddf46e920e7f8b101c1929f12236e64aa5691a367fe4a9d39a76e389e5a4b31ccaeec4e60a7723ce506c8d7ef19
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/ze6mGvKVO+n1:WoqtVjnmtXeN+1
TLSH
T1E4D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 63f2baa748e8bb100b158557e90f35bacd38b90fde926e8f694d7802d4293744
MD5 d8f15d174f08ce39447b4e868bb415ef
SHA1 05ac71f5a90e06007706da4bea70e5161a5f7d58
SHA512 adc5a7b6df1c4d3ecca5c5b0e01c3b151e2f53f9871f5af1fe7d814e9efb3884ab1e1bd621c0eec70c7806d64589674cd4f1eb45d9f3a0b7b7b232c8fbfbaf1e
SSDEEP 24576:lAhGL2IFoiwtA5l7S53N6mctvE/BT76+1NCE:lAM1Foiq5d6mGvKVO+n1
TLSH
T18F359D81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 95f7df355bd753c604359881390f64a87b82d1afdf10526fdb9832b15cc29266
MD5 a50f9aedf7ce0f772dcaac7683d2c996
SHA1 7933dd581793a6464ef7a33d76759abb43488293
SHA512 e96e69053f4cd842cc56ac940273f1d9ac5df904c4e9aa86d4c3725d569cc4db69ab75de0e708dcada4ffe962d7e95cb34352718a3825f1140f732c1c0309d42
SSDEEP 12288:Wmw5HEjsChNDBFgl0WDm+CBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:Pwu2OWK6mctvE/BT76+1NCE
TLSH
T18E75F14676A508F8E9A742788657C136F7F2BC513A25DB1F1360C61B6F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 1a0084f06feb7fd719102ddf633208c57c3d5540dbc94e8fe16564ad502d7279
MD5 df544a268aa371db8fbb3c33ba7ad8ad
SHA1 907ab3db71d523c9e478f69d92b81f116bc9e636
SHA512 dc9d90b9216d81684dc61442582916fdadfcb28891703a055353fc7d70d3f0e13cd9d9ba1ec645e16b2b2ce69dd42b9c71d48966fb8d25170d271389969ba4c9
SSDEEP 12288:gMZ1IyutM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:HZuP6mctvE/BT76+1NCE
TLSH
T1C4651286226520F4E5E702B8C9E19245E77178E6377603CF5221466F6F33AD26D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 03780a11d1ca8906cbe13646f697a57136d48ecd2c62428c32468c0f17323abf
MD5 8e7376770c526cb6f4c91d41f9f39559
SHA1 2da05b1d3accdeddc4f85be63c5b17851237dd03
SHA512 b62c4d1875a5392e3fcdb688a86ae57470385e48e04f40f39c92fd4740d163a06e9b95cd8b3471921884b4aeec604a20c4b36ce1268a2c313e8faa589372c2a7
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uq:qQRQyi36YOcPhLvw2gAf+PN3gXeN+1
TLSH
T1C3667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6b574dc572e3aa553f992bdaa30001b3e3e0422f5d7f0bf0101ae4cf485bcab4
MD5 57458b791249bc8db9e09cd0a50e24f3
SHA1 c193f93c1364e41dcb6a8d2a19d3f72634b6a7d8
SHA512 9058cce37e094711306da7976a03316eec441e7cac7130ea00dd0bcceffe4410d52a654349c80aa8bd709288cbfb27da854c41fdf94903abb948891638a5c21f
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uq:xQRQyi36YOcPhLvw2gAf+PN3gXeN+1
TLSH
T14C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 350b82d7d296a83eedfc161e0efd0f26bed96fff74f75fb84368999e676c7196
MD5 37382aeb37cfb0c5bc28cace52f3b329
SHA1 2bf15511de97b9e00d30cccc42a281256321eb6e
SHA512 0415b34b8abe634fbef255b3194743d38384e2163ec3107adbcbc45141856f088c9690b9f20d5dea89c01e039956a05b478863bd234d2ee3f148310c77a58d8e
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0f6mctvE/BT76+13:p68Qg55nhceWu7PNU3/O6mGvKVO+n1
TLSH
T121B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 85b1d7af2f2a8243054f4f183ae47d88d17c4617f106f27c21d9ec21c38d46b4
MD5 ae1e6e9c9ea42ddcc1cba1bcf4012744
SHA1 85178ab4898215ec0a38ef468fbc973824756b42
SHA512 54ac0761611cfdc7fc94624bbc9896d12a94dcebad7070ea96e88bd41cee66328657d203d1b590e6d675694de13d68a6a8cc420209391b96152a6e672e028956
SSDEEP 49152:w3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99Y:9y5112gYy5azzVva69nLKnhZbXeN+1
TLSH
T1E1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8c7da0fdf0a7bfee2413879a126fe433c1c790c026b0bfd432dbbc0f34a834b7
MD5 88d0d77818c8a89f8a1c27c1dda6082d
SHA1 e483b850a259ba5cfdc636e4cc0e281d0a1d4389
SHA512 bc300b074d3bd1d665cf46f92908365a650feb00c1718fad97257f6abbe70c08d212adcc448453314ead1cab37d4693c3e76c4bde4879f50fdbba9d14c4a74d6
SSDEEP 49152:ZB+taZ3usBWOBr4tEG20bqx0z+n217aau1glI6mGvKVO+n1:Pu6JmUxd2dIXeN+1
TLSH
T116D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4f09fdd228ebdb97b16483bf3894d7c0377fe51e0fdc7d12306bee898b488622
MD5 b10a9fc27be8a0901c15e249058847c3
SHA1 6927d3bde272728466ecb7bd8c42dd06e4a17ab6
SHA512 78c67246e035c06d845e1d00cfe85ffa8b77363737ec948e9a460dcb31344f5d6267f614d344d6adedcfcd53f5da8b6a0d302dce460e521440c0bb4834e73971
SSDEEP 49152:O1hpsNoJpF1A6BU44CwH7R4xk6mGvKVO+n1:OmifPkRtXeN+1
TLSH
T1AEB5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0a8cfa492c3f84713494408c1da2e16b6ca03a4b46538468c04c386d052501cf
MD5 a0319c20a0a4400c84045a5b37265ce2
SHA1 8156f09141231352d2a53d69560b27ed9bfe8b77
SHA512 9522612ea323fb1a029e4ccf9ee14660deee8f564cbfc4057733b1d50b1dfca21b59c6b60d2c8cc9c128dfd24f404088b604f95b1dd05dd1305dea37b3a716e7
SSDEEP 49152:sSuZQIY0Be2KNRVtOnks6NMHqP6mGvKVO+n1:O5dKvi61PXeN+1
TLSH
T137C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4a87e6385180c7548cdea8d8675a6b2d405abaa212882b35f17945394beac78d
MD5 c1e9ea62b6620ff95f036c9c808ee797
SHA1 96d7d8d2c77ec08f3d94ec3c59f5364b38017dc8
SHA512 379e993b64765934d8fc4a288d672da60a20b6bdee1715366d189cc2de501da237f96e502cde1029c6fd439ff9420101f78fa11c0b64e41cbcdacc867dc61a13
SSDEEP 49152:ChtSn8EApI0figXgiDn0AP5w46mGvKVO+n1:jX2iyphpXeN+1
TLSH
T11F95BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 0c6563e7e7d5d606c78b6dfda8c31bdeb7fb454f7bf60b7aa934e5dfcde34fce
MD5 293ab71f3207571ab6031a53af60e762
SHA1 b7064335aedacc341a30c711ee83eeb6a338b25f
SHA512 4da895e09f29c99b6574803fdafc770305d6b9bf31ff271ed4d4c2ac526854362a445f27f208d82f1d461d3ee396809213faf0c9e39be1357b4f8f8af3c52e3e
SSDEEP 12288:MDtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:MD6mctvE/BT76+1NCE
TLSH
T144652382981B01D4D9DF07F19395E296E8502EFE74DB1881F326851FAE305A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 1c4c4bccd1576918fae15149e46d11790d793b15fbc13e3dc35dd723837616eb
MD5 9d5c6a3e7645babf55706a6126b1e0b3
SHA1 7d89237516893656683d6cf7f78f9fe42433de7b
SHA512 c18ec8f66a80b056c59e0dde818a21a435e0058b0163dc2aa4fb47ef93eb5f518f5af253f4e71b700c719fe680d21b7e308faaa011dc843766d4f012dd5bde85
SSDEEP 12288:VCtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:VC6mctvE/BT76+1NCE
TLSH
T102652382981B01D5D9DF06F15395E29AE8502FFE74DB1881F326841FAE305A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3a31bb80b8637075613478422393e089d3ae86a01202498a632af6a0ec0306b0
MD5 380eeed33dad8d4193a08506d57cac5a
SHA1 28d281ac98ac7f51cd9d896935faefde52dd478d
SHA512 5c726bcf215aa6a7e3b9376aee1b091a446d46151df5dbf8cce9ff0ec4e193961deb76fbced8d2f379ad7a6ecc6c08ccf7629b736cdfeab4704a3063bc4fed2f
SSDEEP 12288:SMtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:SM6mctvE/BT76+1NCE
TLSH
T16A652382981B01C5D9DF06F19395E296E8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 6fa54e94d53dc4295537cfdcd11c7f60fbecd4f65a620f8fd5448ef12bbfb860
MD5 9b6835814d18ebb17f632b6ea350d465
SHA1 716459521f9a1286917206f89c4b087a7cf46f47
SHA512 10003f445222ef744589031d54e65cacc57e2cdafa83194d547c96c1b515d17ab98b727100519defaac591d7f10909720daa22edfba03ffdf40148899f7f9ab7
SSDEEP 12288:+VttM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:u6mctvE/BT76+1NCE
TLSH
T109652382692B01C0D8EB43F0C6A2D296E5B07DF975A719CBE311491F5E303917D2AFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2d2b5f92221a8bdd40ad03aacdfaf42192d737ea2977bb7f9c79f5bba42a6ba8
MD5 7c38f0bc5a84db3aae1320e3f57c5bc4
SHA1 b5a8f32252a71a2d67c847459badc03dcfba909e
SHA512 3bdcd40ea98b4450e8528df29ee4b97858dc2467085f86ed3d2ba6e48f743cb163f1a6e36d43516c295c7eff978e1d35fbd0ada4337771a2016dc8f747c19cae
SSDEEP 12288:qltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ql6mctvE/BT76+1NCE
TLSH
T1B2652382981B01C5D9DF06F19395E2D6E8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 eda3db09c94698ca83ff985979b6d6da3fd165577e0ae6ca87d5c018abaad2d2
MD5 3521fafb05aa31578632400815cf10f7
SHA1 a925985c7c2840daa98c2a4fcb962ebf9e88d109
SHA512 8f05c7edf9f8f827e09613fe9a9b8960417ca3099870e442915f34433958c71ea28b8b4e6872e8584b19a923c791e701ab04b50721332a525f33ee624c6e3b93
SSDEEP 12288:wGtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:wG6mctvE/BT76+1NCE
TLSH
T119652382981B01D5D9EF07F05395E29AE8502EFE74DB1881F326841FAE305627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e9c7d9ff1f36b34610bcc82362d79a627ed60d024cff14f7d8148d9e29125a8b
MD5 675938b672063637b9ac4a6ffb1ab34d
SHA1 91bbb03dd5430590fdb7dba7f6c2e19b780e268c
SHA512 18a1b732e5dbedee21ace1a70af759c45f013c9c8491c0cbf2b104a3164e9709ad7ee44b6dd8b4604bdafcb586aeb692287fc8153f8287c82c7ac9251eb1e60d
SSDEEP 12288:IatM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ia6mctvE/BT76+1NCE
TLSH
T1E2652382981B01C5D9EF06F15395E29AE8502EFE74DB1881F326841FAE705627D0BDFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 6213f7cdf3e6c0a3a61b51d2c426f3d4ba54a3d0ebefc355a20db47aa7b662ea
MD5 28f15849bad97e63034692e6668715e9
SHA1 6f80abbb56f46954ba7dc70ee63e187d1d202990
SHA512 0908ecb47a29ec00ea1c06198196483099a75fdb9f4458f66e138ad789d4fa23880727ffe5f45eb40777769a8fd58e51631878fa188c1d3465cad700b4b9173e
SSDEEP 12288:ciZwbrzzFEoS2cPvyitM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:/ZM/zFVSOi6mctvE/BT76+1NCE
TLSH
T132850295B35108F4ECA7427EC9558506D6B27CAA16B0C64F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 45ed89a139b855508856c68b37423c861baa6fc7ea33429973f9b5bbf989d131
MD5 a47ee444d7313806d46ebd543c8d1807
SHA1 042fd0b18e967c227ef5149e37a212aec4543d6a
SHA512 e0eba769d6e32960dabe28ef38f5ed1d904beceafbb77e0dbf9ab514b850eb8fec720cf0c0ef9d1cd1d66e55686b9225ba89c54cb3848c5306e5c2d5deef54d4
SSDEEP 12288:I/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:I/6mctvE/BT76+1NCE
TLSH
T12D652382981B01D4E9EF06F15355E29AE8502EFE74DB18C1E326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 5a5bd41da8f9cb194617cf0d4b3e317dbe88fe714caadc53816954e0cf6b5d0a
MD5 8b12489849a600653a1cbe838924da80
SHA1 064a8e0fe5ff8916d45da434e60f7caecb1e9569
SHA512 45c6183d06d45a3f765bf678f25b1c1d57b5830b33ce88749cb8907ba44f260925db6ecbabbfbf3b926333f8144dffe4a818307e0187ea980f41db2c128f0abd
SSDEEP 12288:YLtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:YL6mctvE/BT76+1NCE
TLSH
T18F652382981B01D4D9EF06F05395E29AE8506FFE74DB1881F326851FAE305627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 a466512c31025606281c2777efd7f98812b1742bdfe6c523169fa0c730e524a4
MD5 19caebd427f5c672ba18d2378dcb5a35
SHA1 a996ff3f91a54f8b09d62d1ede19acb7ae4ce010
SHA512 6f6344b3e40a8d1c10169eb0e6085a3edc3e0ac821b51a71f123d3d0efcdc95c274c9dd1a3a23b7d68176af7968cf59003f36019412190901ea740dd001162e8
SSDEEP 12288:KyPz5L8utM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Xzyu6mctvE/BT76+1NCE
TLSH
T1EA751143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 7ec64851cb711ae8ead3b9ad90dc4e75640b12b1b9c53a13a959b455b145ef31
MD5 abc81f8e69b1290d5fcc409503e07348
SHA1 bf6a01a5636b4415d255028160a4daabed207227
SHA512 f235117dbc941e215788da7a52f8531894dda546f90ec56089e098e542051fa583df324c3a3963e04a1ca5e3c9fff9f27f8ccd20f19228ae1478b6d78ac365cc
SSDEEP 12288:Q/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Q/6mctvE/BT76+1NCE
TLSH
T1E1652382981B01C4E9EF06F15355E2DAE8502EFE74DB1881F326851FAE305627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 61824f69c7db8caad481cf5fe7a2dd4df7ed1262d004c91099604eeefbd697a4
MD5 86aa002a87191bd9b2bd77d9aecf0a8e
SHA1 93ad8d9ac8a0a8f2ea711bea4bc2421257e33aa0
SHA512 fa462c4d88b7dac763ac70b15b420ac1d9b4ca83e0cb2114ee2af7962ef9d1e592f6d2ee74e19da58cdab06fe171d62c53b77ce4cfdeedbebc33721d05018b3a
SSDEEP 12288:f/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:f/6mctvE/BT76+1NCE
TLSH
T1DB652382981B01D4E9EF06F15355E29AE8502EFE74DB18C1E326851FAE305627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 ebc92066fbe6a6899d1bca9e197abda86eca918eea69ea13bf7a42b394efc255
MD5 d8b2a4fc3e95eb3f7a5a743c0ef83026
SHA1 f18155dbdcb4a91a6fef61b91d8b6525a0d3c98c
SHA512 7f992a3d4a9e9a669966ed61f60e71c75f7ad5984bf8da140660ab75d4b312eb3c2421dcf84614f3096038c15db9587957888afb4b2abd2871fa1087e4a5437e
SSDEEP 12288:4yPz5L8utM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Zzyu6mctvE/BT76+1NCE
TLSH
T121751143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 18d08e697be0077909557cbb3b1693a270e286211712728172583d5f280ec7cc
MD5 8327bde1abf84c103d1efdd37295c12f
SHA1 8828ff7cf4e0919c3dc5241a6581102a91a99e4a
SHA512 5704e00b98ef2334d8dabe398d129025067cc9d40b2c13af0c94f1107abd771d5dc5593b9b76b41ed0d63175e8d9d3e3b30825ded763b64bfcb1eb1a792c2327
SSDEEP 12288:+Cd9NWYoaLHF3z0z04PDvhctM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:vT0aLl3z0zDc6mctvE/BT76+1NCE
TLSH
T197850295B35118F8ECA7427EC9558506D6B27CAA1770C64F03B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 91936fe15a3afc938a32aaf7640851656047fe9981f68c02e2ead457938ee1fb
MD5 b0f163deec74e1bd3ebe5d8960940a8d
SHA1 3915fef5e207bcbe35969aef21dd7a03bb8e9bd3
SHA512 77ac3d14a41208771df052675537d81e0f9a09e102cf95b049ba3eab308bd1a1c4af335e364f9c37f0a8f77249a0a3dca27fbd2474352fe0ce00a3191393bef0
SSDEEP 12288:ni4e7PRdTfgwCHKy7GLbbdIvZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:n3Id9CHKy7GZA6mctvE/BT76+1NCE
TLSH
T17895CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 6aee97cba8ec1f4277cf4cc6384be66ba8ca250669c76638557244d124ddc32d
MD5 81820bf0db96c3b4843c0441332ffebc
SHA1 a8a2d800eadd876497c4442f5cf08e334da26800
SHA512 5b3e2c4734573a70d3ac0b51f96b0246002514da9a15a1a709b53cd611cb4ce774d5017bae3b0172f3c71df291d0c62bfe27a518d57b0326eaacf03993279129
SSDEEP 12288:fstM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:fs6mctvE/BT76+1NCE
TLSH
T1DE652382981B01C5E9DF07F19255E2D6E8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 92e1c78463a1de694ae87123c15f89e972b5ebc63256d49d747dcbaa056986b0
MD5 6fbfe2632b0568d3a8f52c8a7bdc4769
SHA1 273ab0e80b443db062774a798b03b0f57c09d038
SHA512 c26d5c36c5fdccb05b91d55ad02302290f1b29ccb0c7fbe3fddd2241dffc5169e996172bb8346b5aa24533edcf58d45ffd87fb9b2c05d36a7f9fd6bd47996a47
SSDEEP 12288:YOtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:YO6mctvE/BT76+1NCE
TLSH
T1E9652382981B01D5E9EF07F15295E296E8502FFE74DB1881F326841FAE305627D0BDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2092725aae5de61be094af543e71e5168500c6e0b3531a111caaaeffebf96ae6
MD5 89ff39117ca56f4b1f67c4f53463d26a
SHA1 ffd31d5eaf115d4dbc8fe9bd1ac16236c94f0238
SHA512 8d8ddba8946f738ba45543980320cc9bb03e90be729116a7968aa71b2788a4ae5baf93719d07b57e78fded605ee7ff9b5e83f0d4804e68c75530b85f84a438ef
SSDEEP 12288:BZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:BZ6mctvE/BT76+1NCE
TLSH
T193652382981B01D4D9EF06F15395E29AE8502EFE74DB1881F326851FAE305627D0FDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 4ba6daa2518b476308a90d653053bfc8551eb10adc64128ae5ff212477ed649b
MD5 0937b1947818257899a5646b4f490fb9
SHA1 f5678620f108fe7ab3023dfab7ccac4039ce0b56
SHA512 4f285db80b3ec315d58f482d090aac5e23e8cef4e50e50432f9ba4037ca8d4799423d1f0893b43574d16435347d69f4fcfa5a345b58cf147c4564f65992ba830
SSDEEP 12288:i/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:i/6mctvE/BT76+1NCE
TLSH
T1DC652382981B01D4E9EF06F15355E29AE8502EFE74DB1881F326851FAE305627D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 a26899cb8f80638ced06f76173d3c61b428f6aa65f66a2b2014dea1cb566f148
MD5 885c469993036eb72676805e91ec2332
SHA1 c8f34caae67e16e65a4d7d9a651030f783549bfd
SHA512 02d8a13aef5c728699efb804c6b159d9d8a281b8f2e89e94a1465a4a497dec30151b027ff7da0c81093c5f08ac1a7fa2a0a35164704d57716f964adc8459065f
SSDEEP 12288:RstM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Rs6mctvE/BT76+1NCE
TLSH
T14C652382981B01D5D9DF07F19295E2D6E8502EFE74DB1881F326841FAE305A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 141e3455a8affbc160773c162da9506d3d2afe4f3bbe43eb5da2c74d9db23eda
MD5 868b76c0fab4acadc581d8691be4cf6e
SHA1 e2895c862456d14713afa3b5ad55c63cd3409be0
SHA512 ba25fa5b8d3d70a1f7f5fd03726bf6e68f89117fc57f9079b6fc840f43dfc8ae0059524e94c06cc49e452e7cf33705d0d6f745678497f0987da9596739faf251
SSDEEP 12288:hXtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:hX6mctvE/BT76+1NCE
TLSH
T127652382981B01D4D9EF07F19395E296E8502FFE74DB1881F326851FAE305627D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 1b7808ccf5402a44bfa11d0168641b90b3e9211559bf9ce83340f49a7282cd57
MD5 b38cf6f9ce1a97219b5c5b4456a71a86
SHA1 0f6789088c11e05dfab236f41c1537afd5877955
SHA512 f88100dc376929049bfd94d862921288b87decd550ea28e6da8bbd64430e45cd612764ab99f91c716975db3a2b2c7f7020ce97dfbec20e5d6356d3364de203a2
SSDEEP 12288:kltM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kl6mctvE/BT76+1NCE
TLSH
T123652382981B01C4E9DF06F19355E2D6E8502EFE74DB1881F366841FAE305A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 1111447e47c19dce301e827df9d33105aaa76a871a423747edf17fdbbf6ad403
MD5 5fddd1022771e477d41eb8208dbbb864
SHA1 0ddcc4deffe557372bbfb998c0ea450b21ba83b5
SHA512 aa588516c0dc32ee41fe2e6370433a4f9fe1fb9463f1c9ef2ccc42dd86731cc0e36cb34364c2bc22006c120c13a32667837a5a9ac31e9c805b3bac97d98ee7ac
SSDEEP 12288:h0tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:h06mctvE/BT76+1NCE
TLSH
T1C9652382981B01D4D9EF07F19395E296E8502FFE74DB1881F326851FAE305627D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 06b9d066fd7aac652f385c7208d7bba2c1dafacf006f716cdf2f277ea8bc5a28
MD5 c9db9dd5c25c962c239bf52294808b6f
SHA1 7e122e684615ccd208d0d94d1dc011df3fb5c213
SHA512 1dd83c0571dbe4651c2ffdc90c9eeff3a543b097ea6948bf67814058d97b0aa3bcc844c6b7bb3d9592fcd94521e25f783496161f3d520e5c9dc4bcc70c31aa5b
SSDEEP 24576:4fwvik9RX6wkyAI76mctvE/BT76+1NCE:aMnYI76mGvKVO+n1
TLSH
T19295D129EBDC04E5E1B7927C89B3420AF6B178691B31C6CF125A536E0E33ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5a3705a42a081b4309681f734abf12063a4f5aed87f0af98d1972b84b7a9cfe1
MD5 0c53e8b0461ab5d5a9fd4983d30a25fb
SHA1 fb41cfe63bda8213eb7083a81cf62a6b4e017925
SHA512 2de95884161637b8453d0bf3abb43614a78a2f2446a2ef44cda59e2dbdf777c3c68b70a2ec70d3d0aa60bca071585f2406b4913ab31afbcf56c8daa407308c47
SSDEEP 49152:9YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Y6mGvKVO+n1:7ySzPAXeN+1
TLSH
T137067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f211036dc924cd57c70ea67ff7a88df520efb196ed880419db7626166f29a6c5
MD5 e616e30dca7379f62dbbd71b5cd91844
SHA1 db6643f5042d5d15142d02ee234b66ff9cdd9d95
SHA512 cb17c066b338635e8e30501a0fd83f91f3d2c214b1a2607da9d39caed623fe73e5800400ef43cf647700be892f06bfa9eaa09ad4d21218ec7323cf3ed6ec3f43
SSDEEP 24576:U47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYS6mctvE/BT76+1NCE:U47JUQj4irIhCnDHUPfF/I6mGvKVO+n1
TLSH
T11265AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 d5cfa018a619519af7b0402cad4e7dec292d38d1576d743abbeae90657f10ea3
MD5 9b01e7a56ca3213a544b5bfb5b24600a
SHA1 56d703fac42876a1aa09da418c0f3662451106c6
SHA512 36b390200276ab3ca79de8c2b47a3211b1d608b65c034a8b831478f30ff4258fe35d78117df4dc429ca55809df52f994fb8bed3ffc445c2f91a599146c2de013
SSDEEP 12288:n1sfPtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:cP6mctvE/BT76+1NCE
TLSH
T13275F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F31690ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 9a176cd913aa21afe7e62080f5d6726fdc826dd02a0f53d16c3abda9ad565316
MD5 7b5103665e3acc8fc11d74ce2dcbbd83
SHA1 27913679d5e8ab15f896306968584c02fc5d045f
SHA512 760d719488618b1096aa9d28eb2ed1b488f3ca480cc6593286dfd57621c58f568757a23350050831377a9fc30d0df00f845d554a04717b0477dba4531134af51
SSDEEP 12288:Sn4d8U3fuiPwF7Ee0YKsdhXmEfLOp0Roq4DYI5PXY8:Sn4KUPnPW7lHLD40RoNDYIZh
TLSH
T117451741762AC79BC6A940321E36D6CCA7707D11FE059F0773C8873F9476668BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5fcf837bc6b7283f117b543e5f2d88f7a6ca2034fb7899ed240b566c7410ee45
MD5 20552b32a59792fab5387cc76691131f
SHA1 e90773cf0bc5a39c76427efc4b336ba95f61d3cb
SHA512 fc0ac61bcaead85d1e5feb87f1991e57e1d81b6eaed87052b4fa037dfa17b70a3dd108321b4ef1aaf4c4c06cc5015c141418c0457debc4042381082ff120d33b
SSDEEP 12288:H/vevvilXB+A0Bcoz0AaUmH5SCYRg0eQEjhOZPYRr6S9SunSj1ivl:H/GHYx96XRq+sg+hUM
TLSH
T155554B01A5ABE35FC8FE50374732C68DAB746C12BB452B0173444A2C98B767EB5F26D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 e021b67abee73c17f90194f2106e7e418e5d4f49fd2bc761f03a2eea9ff01296
MD5 ee911d277a9cafd805405a4145bc4d37
SHA1 136a284c79a9a95dd61cba763e77a71e2d4c18fb
SHA512 8d2354a484195d5c3436a68fc57c4ca9886f6aa9b3b751a92549da5913b07237255eb5d811d1217daefc3e74ed9d772223eb5c4c0f63416636573912b568db48
SSDEEP 12288:2v7ntM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Mn6mctvE/BT76+1NCE
TLSH
T150652382991F0184E9FF06F0529AD265E8157EF93B9608C3F212851FAD305D1BD3BE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b6c30b326828348af95c365c0efe28d02b8fd127abfd0e6db9f53cfaab0c0117
MD5 523791675b6a455339ddf83c228e34f6
SHA1 5e9d258e1d206398d411623d985c5493f319f7a8
SHA512 b3ec085273ac6dca4fc4a4b0307f1bf9bf4489554a7709d87e83e90dc47a54f370421be7bf53065d40be65ab5ab02a2618b227e10c2aad0f950a3cd97094e761
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYh6mctvE/BT76+1NCE:Qgb4mBIBhGFS6mGvKVO+n1
TLSH
T1B1659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 095d2c3b5f990bfe3210da13282b99795974d9defdb92301be656c9332db3395
MD5 f066698c282dc6c5724e9a18bac2fbdb
SHA1 479375c06a56f426508e46a0f6a2a19ef08fc436
SHA512 2b95949f482e5bc98f1b29437e02d7bee475cc85ab5cce74a6dc8251148e8e891aa52e12964259b8000095c14e69b96f9d24753dc08d47f2b8b54c3c8b08d4b2
SSDEEP 24576:CG88u8FpJqH1jzria7/mi6mctvE/BT76+1NCE:Z7ZFPqV2a7/56mGvKVO+n1
TLSH
T17595F16576E101F0D47BD1388A864263F6B1B8251364EFDF07A88A561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 fbcbdf7047a423b8c075ef142a8211f18c1f1ff5e98740483261c6c98bbc611d
MD5 76133962dedc27dc8f1ccdf2a772813b
SHA1 b55aeb3b1072659d96eb98576cd5f827b5986166
SHA512 cb74b7eff5f96106aa32a062152606787e2b12974940a8faa0a9b63a7cd77721e324c45b2af924bb78b8bec7b21a941f6e0c80dae8c7cf024f72ad82c525ebe2
SSDEEP 12288:aHvUrBFrEjwaQ2tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:aPUr+NQ26mctvE/BT76+1NCE
TLSH
T10875F21F65AD18E4E67AA17C85828319F77178A2171292CF02A1813F5F33DE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c523f57b26c9b819375960c6ba9e313fb02d8d5340f1d37b8d5f05f53e80b723
MD5 bc951cdb6ba9e45ddca06c7a91b07235
SHA1 86e30483b0909a521b710cbeed5c25e2886ba4fb
SHA512 659d443c092f4b734eef533f532246bb7195950fa7482303655ba341a7e17893738674b9f4c640d2d50905f6dce874a2a6e9e1e5e3b8b531c879c68e9e71c3ea
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjG6mGvKVO+n1:bG05lO43bzXeN+1
TLSH
T1A9D5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a9fe7bbbcb3549ebc19a4d1ff94e15dce717144070b032bf7ff78b999e3a2ec7
MD5 3c50bfb9bca84f5684775887d66215fa
SHA1 16a8c92ae56ed95b99ec09373713470d0d391089
SHA512 d09fbb85335a5ed73772533b392363c307b9986306f336cb05889930ab47a18fc06421ad35d127d0b726b793cb3cc86fab7f7ef90edf442ebefef6fe51499b64
SSDEEP 24576:4fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnY6mctvE/BT76+1NCE:Aa5POZ39Jt2pasx2+mO6mGvKVO+n1
TLSH
T14365BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d90e5a8d57bd42cbb5060f6152d56e46f88f509254806187cf44f4bfd29f6d39
MD5 5d5a2ee659da8db7b106c72be1cedad5
SHA1 418ae1d858dcf60c4a0bf14fcc51ed64258c5fb6
SHA512 1869467918e86dab10c1012bd1115eef75dd8d2d1d93c9b2523d4e6a0b19b4b0f85f87339610d054dc09dfd2b3b111c6aeb50b516cdf19cf19fe659ef783f901
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7Fkq6mctvE/BT76+1NCE:DNc/zEOVHFZ6mGvKVO+n1
TLSH
T144858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a90affee7329da0ab21ff0351e48577d7faded57c92845b3eb7fecb9390e96a6
MD5 58d8775357dffac5a343a74406bc5425
SHA1 4724c42ac70b7b6eabd1f3549e3ecc6254597880
SHA512 1b2309d442af24164d020390c1bf37f642d34bafdd916735cb5f4117d140adc3ddfe887580ee77c780d108f57593f947964540ee1ae65c6d101cc6384b86aeb4
SSDEEP 24576:9tkNvNnaFeYhJNtmZBm06mctvE/BT76+1NCE:9tMwBtOm06mGvKVO+n1
TLSH
T14D55AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 8b06991f417f91702f862b80658df24bed75e9ef6b281650c72758a15d650cb8
MD5 7bb87532dfd58e03f0f2c97c410be8a5
SHA1 9534fd76229e3bb40516bcd68e5c7c4f349b00b7
SHA512 d10b5c5ffa932685fd3a8114a216b7c925ce6e6fc178608aaeb106bb4b46bf594f381632ca3fc40b2abd9813d89830a30f8d1c4873997b41285e2a04923df156
SSDEEP 12288:sQcMxWDXN1Dp/fshBItT1IQgAjtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:WD3FHshBIYQgAj6mctvE/BT76+1NCE
TLSH
T18885E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB0294C1BA5F67EE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1412-69-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1412-62-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1412-60-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1412-280-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1816-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1816-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1816-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1816-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2784-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2784-46-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2784-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2784-73-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2784-71-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3820-76-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/3820-77-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/3820-82-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/3820-295-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/3828-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3828-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3828-313-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3828-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3828-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4336-88-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4336-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4336-94-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4336-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4336-371-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4336-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4416-0-0x0000000140000000-0x00000001401D1000-memory.dmp

Download

memory/4416-1-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4416-317-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4416-86-0x0000000140000000-0x00000001401D1000-memory.dmp

Download

memory/4416-9-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4416-320-0x0000000140000000-0x00000001401D1000-memory.dmp

Download

memory/4532-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4532-23-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4532-15-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4532-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4532-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5252-56-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5252-233-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5252-49-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5252-50-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5388-126-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5388-132-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5388-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5388-137-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5388-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5792-112-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5792-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5792-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5792-312-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5864-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5864-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5864-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5864-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download