325e167653efc56fe6acda06f499e62af0efed0d7772ea219deea483db995f8f

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
Size 1.3MB
Sample260802-xpgdgawsbv
SHA256 325e167653efc56fe6acda06f499e62af0efed0d7772ea219deea483db995f8f
MD5 37ec582734921e4bc72c6641c27fc61f
SHA1 b78f14663b2bdf3ff413281f3b7b300c44da6e7c
SHA512 b2c555f1756806a8af287b99b77828b32caaa13fd4bb9aced4691ba8fab55efcaa3ae45538fec43943d292f7afd28dd187d007b96d4484508d6554891853c18f
SSDEEP 12288:sHDmD+0wJ1BwM+oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:sHDfaM+osqjnhMgeiCl7G0nehbGZpbD
TLSH
T17455F103B26C3DEDD0668134867195A6AB32FC311750969F53E17B662E33193BD3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5992	elevation_service.exe
432	elevation_service.exe
3432	maintenanceservice.exe
4656	OSE.EXE
4876	PerceptionSimulationService.exe
4692	perfhost.exe
4040	ReFsDedupSvc.exe
4696	SensorDataService.exe
4288	ssh-agent.exe
4800	AgentService.exe
4888	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9bab2360209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058cfaa63b122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca158f65b122dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000922f51a3b122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f2d26a3b122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000768d4aa3b122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
5992	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4864	2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4800	AgentService.exe
Token: 33	4888	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4888	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4888	SearchIndexer.exe
Token: SeDebugPrivilege	5992	elevation_service.exe
Token: SeDebugPrivilege	432	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3892	4888	SearchIndexer.exe	99
PID 4888 wrote to memory of 2724	4888	SearchIndexer.exe	100
PID 4888 wrote to memory of 5032	4888	SearchIndexer.exe	102
PID 4888 wrote to memory of 2744	4888	SearchIndexer.exe	103
PID 4888 wrote to memory of 5376	4888	SearchIndexer.exe	105
PID 4888 wrote to memory of 1860	4888	SearchIndexer.exe	106
PID 4888 wrote to memory of 3244	4888	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_37ec582734921e4bc72c6641c27fc61f_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3432

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4692

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4288

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1ca965472eb947c1e949d8307a163a79c9a57c18926ef17c7409be2afe732547
MD5 b90d5f71bcd94cb5b76c3e1c7429b8a7
SHA1 515be59153fdeb0f1c15b25f7256f4e538e5d687
SHA512 958b91c15221bdff7b2307bd5eecb37ef7ced8a70cc4619b16eeda64f3c4e0763fce41f53d5615822b7dc315a75e24f3fa583d6b6b11b6dcb1923e6b394ba830
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxndDmg27RnWGj:p3q6HjBCD527BWG
TLSH
T171D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3bc17062db7b2331c181d578d09b4c356e6dcf2366b8987165a22b8a2090d53a
MD5 f9fd056af6739258a7fe8ec8a3c9edd5
SHA1 a5d1ed0ed4b584637e451fec79c653344b89a4d4
SHA512 b5a32037ccfc654ddaa65446c4540f5fd2471a7203327bbf8373b2427fb97c91a4e35463164fc8ff9487f82903fae3378f023a1366d791d858847362bdf4cfe3
SSDEEP 24576:yXYfDtczAKsqjnhMgeiCl7G0nehbGZpbD:Ztc/Dmg27RnWGj
TLSH
T16F650129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 3a6c80e794ef6c29fc534e3f0be00a27de6746af912d82e40857f51694869bb0
MD5 0040e32721826a2565449f92702d3346
SHA1 4cf6b1c2f657200ef7d522a9a48db5bbecca2fc3
SHA512 b3465f00d9e154787ef58b8d810701c3e1a8091261bf691bebf86db7313c38e53686e392075a4947fa574a3bbcd2ad9028f2fa42004584b765a8be61d3962db4
SSDEEP 24576:E0Le5ji0hmx5rMhsqjnhMgeiCl7G0nehbGZpbD:EPji0AX0Dmg27RnWGj
TLSH
T1CD859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 343dab3ffc891d4875c10c3755ae78c425447a6400c3647d0d5ef8aa34a1ffbc
MD5 a51d044b447ed36053d8a8127b084c09
SHA1 f8aa7295841fee1e499874f947b88bb3aa0a4c92
SHA512 612b357fc22f86c91298176e15fc00eacf4808cd852d69f1388dc97cb631d846cbc6f7c5e6fd407f29af7d3f5277dd6646d9eea15e900c8819cc70140609d18d
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWE6q8wyu7sqjnhMgeiCl7G0nehbGZpbD:l/ezSC6vUzPvxHjyADmg27RnWGj
TLSH
T13F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8ce3f79cc254bb8be577235cc424e8e8c0619dd1bd38c84f05aef635e7231fa4
MD5 8ef35aa9799fc672a157dbb45bec635c
SHA1 e2e7b411e09f176388f93fc9f1fc50fe89327991
SHA512 a7723c98416f5ebfdfff81a273ac7eb6079789c2c4facad4a49e36fe602ede3bad9573c40bd53285c337601ab45526f86d4764a8bc971df21039dce57f3b2b30
SSDEEP 24576:vVbqPb88hv/l+6esqjnhMgeiCl7G0nehbGZpbD:vVO88hXl+xDmg27RnWGj
TLSH
T196559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 d64ad61d58b5c997f41c8146b84baa85c4ca50f6c10103fc2910c91a4df7b75f
MD5 18333a5e4c4cde5f3b0f2e23280f0bf7
SHA1 4c9cd2b0cc57018338834dba717b50cb4cc8d8a9
SHA512 8810baa9f505e3eb99122dd5e485567459b033b34d3e9d0de90089d206023e3add4de0945fc94e991ef659c7b01c5fc70d2383dca4dfe8af0033f1027984b9d9
SSDEEP 12288:Y5FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y5FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1204523BE824C11CAEA7608B5C3E9F51EAC137E5698200C436A637DFDE6F5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b18923679c706663fa70f5ede11c033888aed735bbcfbcfb601367632f312f3e
MD5 ff3d067bc5b2cae75e4fcf6240221a44
SHA1 0875eb11f47c8f7cd5992366c9ecee48f169e61d
SHA512 221b391ab47b1e40aee03ae0afd374a0bf4cfeab3082f9dfe6ba8b36f5b56227c4acfb67c440ec66ee6b84ba9339698df88726f62830eb6baa5e320522543209
SSDEEP 12288:GeBNUbTVO86UmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:GJIUmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e39ae3cc61497171bac57041d70ced657687bbb95db54215de2bef7b71608a8c
MD5 c5f62fb146c45ca3de03119a3f18050c
SHA1 58a64b685ac1771f1fcb2fdfc6f270c1bbd5f8cd
SHA512 95d36dc506748f320749c267ec710eef4abe0f202850b435e5ce49174229e9b29bff68780cd94fe47a8b0ec4ba58e3515fc9ddc2334887c56aea7bf700f71165
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:UQvGAdlCEL8c/yRNw5CfD527BWG
TLSH
T1A8266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 59c97987d5375dc91593b90b2d27ad3f4112d1bb4850d3923550820fe92a035d
MD5 b40e9dcbbbcfd8f28232a016138db44a
SHA1 782580937c4cfb503c567cc85c489bf021174406
SHA512 be643476820cda403072574c4f495f288514b43254af990f4ec91e1d7cee82887ceaa531e28fedb713e0c8d3b313314b6aa2d486b91af5817d36d2e58e7caf64
SSDEEP 12288:FAwSfxL/2Dc3XDLLmt0LDQewsAj4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:mmewsAj4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12065E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 99ab9cf46625d2bdaf492c82e9a25d10dba492d7da506cbe8a4fe5b431317f22
MD5 f0e35794b5d1a88676157b5060d2272f
SHA1 faeb3e692dde9b11fbf61d3437acc3402a7da409
SHA512 f06978b346fb324382038acf68193aa52b24635803dac3648063d9989f9becb663feda652dbcbc5ba099e80c18da17de0ffcfd55e4de1b1ef162e45a47443e7c
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHsVQBWG:fUEtQevvqc2W1cpV2EI32zB
TLSH
T1D8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1e8bea1e43d3a7e534f472d598c6cb9e12b7e69a50db5caebf99caefbce8ea9f
MD5 bbd12e0166f7908baacf81951238a080
SHA1 b95372a35da997da6b7982d4eda5ba64e12134d1
SHA512 4a6b990ee8853c523aafeaea86ff4101fd5ceed9659afb4179be25bc56d549f46ad86f6031817fe45440833974e7226d1248e43b48c0d976d92849d19b226c8e
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zEDmg27RnWGj:OoqtVjnmrD527BWG
TLSH
T108D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 73985e614e1aa6407855df1bc4625c8e4dc642bd8effb31c1bde078d3d788dfb
MD5 20ea890fe8ec460a553a7c67be9556fe
SHA1 c60d9e2284f969969bef75a6ea181607bbae9f67
SHA512 2b06967793816bf8f317e7f6bb79a45f2753d2d12385df542a94e48e49dce09f54e6039829b1498cd4129731a3c194ceb15e429fc38b8d317cfc937778780538
SSDEEP 24576:VAhGLJIFoiwtA5l7S533sqjnhMgeiCl7G0nehbGZpbD:VAMyFoiq5bDmg27RnWGj
TLSH
T185359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 6d68b44ed8bd763dbf681a7c5098353a0f030f24f72248f25cdcaa367c7b8473
MD5 577acb9169e4989ec42fbdfbc8d7cb3b
SHA1 d3222610520e5d2d945e0576d2c38199a5c6cd5b
SHA512 2aa65f201abbce21bd5add7b85ffe9aebdb7919a6b18a34fdd72f11eb78386929158d52ccc61e347dfbaa51dc8e528dda2dd16f867ad6a3d39d257d0fa5e85be
SSDEEP 12288:Umw5HEjsChN8BFgl0WDm+CbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:RwuxOWEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12255F15A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33260AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 2dc22e5ecfb2ca4aa59468fa7007829c23a9b1e5a920337c592e62599f9f7691
MD5 760ce6a286b5d50326a45f06fb645574
SHA1 fb321ec037601509a81dc4e855190183e8ac34a0
SHA512 e4b9fba9734b24fd36032b654f3de355a73404d37cb6ff6cdfe778690878800b3a202cb28b2a833fffca1b7ead6bbd88ceca5a9bfea0ad02ddbae59c37b38f83
SSDEEP 12288:tZZ1IyoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TZuJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044512AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b0ef3c149ae2d8e58986c2bd58163836ab27c1b5b3fcab532729f1c0a01a5bd6
MD5 a718823d429d70001acc91e1e42f7dc8
SHA1 9604d7e2d76d81eac4d403ef185953e4e5809ca6
SHA512 ba4a9bfaa0afda0bb45551c144a5b90b37a7dc14aa816438345939012d822403693f6eec9d5b58ffa81ec30ad881cc8f63ccb9c5468765f02c875121a75b1502
SSDEEP 98304:7QRQyi36YOcPQLvw2gAf+PN32D527BWG:KQyiKayX+PNGVQBWG
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 66d2ed7a4a01a33504362d7dd6a7fca883f076cfc75624979de3add5c4c996ec
MD5 4553523e98397d1c35c26f215e3dbf0b
SHA1 a2a639365747df42110c09a1c3abe345113c8a1a
SHA512 c11e66e6fc351fd22da651531ce093e3bdceb009e3614ade7b921c0ead282b6863abc4085b709c180b6d2113915177c71d47c494455440ca9db59712213ba259
SSDEEP 98304:0QRQyi36YOcPQLvw2gAf+PN32D527BWG:bQyiKayX+PNGVQBWG
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0454b3deb5fce80ffe9366a138e7c695744449d380bb7d4d77eb32bdc88b75a1
MD5 05ea1710ed1bc712ac741264d2caaf09
SHA1 ed4dbefcc9784abc2554ec7d88abdda5dada421b
SHA512 f85f222eec542f4539d45af6164b0bb73ff6da33286bc5d163de528fcb1d8e50bb49720d1b6ac260d1cd68c575be4366825e68f9cb8c783ea0b67ecde8ec9f81
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ZsqjnhMgeiCl7Ge:c68Qg55nhheWu7PNU3/0Dmg27RnWGj
TLSH
T175B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a9eb068df3ab63336a23a7a21ab135093345d7631d17dca2726228452d847218
MD5 014bff0969198c5c0a3b174e715f193f
SHA1 e387b39990b8d12ba3f84c35eb82ee8e14310734
SHA512 7d90aece89ad247ca595a4f4c35461b7d21ff5c3d1855456f5d7d906613555ee12917d2ed8a13212ec2d1d189e7f7f7ed03fe1aad3070919aaf0ff7059d9cdeb
SSDEEP 98304:Yy5112gYy5azzVvL69nLKnhZ5D527BWG:xLIHmWhTVQBWG
TLSH
T10B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5f7acea66bca2473aa5ac096880bce3e006e89d9f7d7f305e1473509db6a2d20
MD5 24cb9717c89f05a8fea1ef4649a3ca2f
SHA1 fe9716cfd785e407c26032099c2a4342002d7f6d
SHA512 3c446e20cca5b958b533b3c15d37b6c2f237c0867b529bc0cf73e48abdc5c8690dac8209b85d7b4a62ed6a7af03e1063beb629138499de736700b77fd7f784dc
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gluDmg27RnWGj:Yu6JmVxd2duD527BWG
TLSH
T1B4D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6a15032773e497f1f0b0497575612996732642f33315641b2f159fd7465926e0
MD5 1327f0e83fd9be9aa232c89117b1b045
SHA1 15461d83a238e1654220f0bcfd00a44e740236ac
SHA512 de3db29a378489bfe2bb4c09f572d4aba2cc72a5853289b5dd115c7d9555c2d1d1bc2a28292a418b8fbe7618c8f392100256be4f9242ffefc74fdc131a7b7bf5
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xKDmg27RnWGj:FmifPbRrD527BWG
TLSH
T1B8B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 48a51f71f54a0a11dbacfa01aea86329492d51879ded192b7338f939a5d80a46
MD5 bc1953e736e1f168f526630f39c1c117
SHA1 43907992c9848abea73eec146730fcc4130effe4
SHA512 e28fe43297798712440b32576c1c0f0ea98e795a027cf5cca4f430a8a8f2309e19a8472437ac15eaf20ae276e3790280f43d4a4b08207c7066f6fcd7450b3db3
SSDEEP 49152:SSuZQIY0Be2KRRVtOnks6NMHqNDmg27RnWGj:M5dKTi61ND527BWG
TLSH
T18FC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 acf0a4af62dc14371123c481a93aceb7ab67b8d23acb4d908b530fd82e4a1495
MD5 620f98bfd374fdb64b374509247ee092
SHA1 7fb7f66e7a6472e7a3f05493075f3bb7597d3b6d
SHA512 024948cc65e0770fd5360525f4c8290cdd6c3fac932966e8ed19e1dc4a486d9cdea81d2fb3cd68ada7ae8aa06b700ab81b052e745cde68b89e715714caf6a0b4
SSDEEP 49152:rhtSn8EApI0figngiDn0AP5weDmg27RnWGj:qX2iyphHD527BWG
TLSH
T16495BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 82a05806955005444cdbec34484073b7a222104e3df2f21dfd3a2c492f231442
MD5 b43579b8867898be42363d4e21b5b7e7
SHA1 060623dd2236dfa6768b2b45b4ff73e5590863a6
SHA512 680dd378b81485c6773e3b5a6d19cf109fc6d948ab5965f0a023fceb3dd6382592ae00773a8ea6c666f981a04f3b8e9ead8d42486f56909741a13d47ce7c9129
SSDEEP 12288:HNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BE915C01CBE92248B5C3E5F15DAC173E57E92004837B9778BAFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 173f9d19e8571e3e20c1787ac8398c6c0607293941b54b531f7c8b8d636cac63
MD5 9e5eb14cf448b7bab7a5fec83914d3fd
SHA1 b86f94cbf926d0a65397c84d8d59f588e9ae1693
SHA512 d6e80e23e6d73afc54c9de642d2741e513afbe2977344b0559b2731fea01fbfcbee5c4879c818691b5dce9b1f3b412978cefcebdd59274e857db69ddbc657d0a
SSDEEP 12288:n8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:n8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C74523BE915C01CBE92648B5C3E5F15DAC173E57E92004837A97B8BAF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 b7d7f9960a6a2ef20ac5ca7fa0f151e28b3f68009434a930e86c0f0543647706
MD5 ded92d3cd1e716965c39f0a1e7ddd0dd
SHA1 f569a145e8d9a5c92e0f8b0ca24f8ce66cd1298e
SHA512 2c73f78a35a35882a4ab49af6b7bd11351d144ea58607f387e9ae4bfcd102065561cfce961f7b6a110904853398c182fed0c8748ca1f51f5e64dd159b6430f6b
SSDEEP 12288:NuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BE915C01CBE92248B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 bcfe1cae5fa88eff885e64dbad9398544e540ffbfdc9502638cd07d25eb6df4f
MD5 2cd30e5d4a80d079518890af8a78fb35
SHA1 f32a06dea3adb673d7261be40f1756d6121c58c6
SHA512 bfb3205d6ef3dd13e9457de7cc1f9b726baa318b316781efa65eaa854aa954347bf66838fd8c42410f77bd2e03dd7ab8b79ab7c58541ebaea889603ac3ed4123
SSDEEP 12288:NVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F45236E535C01C6D83285B5C3E5E11DE8237D96EB3005DB6B532CBE9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 6c63c699cb90c6f07148c7e7e22eb962e18bdb9fdbe5c80c6a91466a19f4c9e0
MD5 9fd75147e56db04cfd5f52f11053d837
SHA1 d17b554782e0391c9fdf52e189525106822f3d45
SHA512 579b4ba226228ce3914d807b0f63471bfdc7445998ceaf424a8b42a5142d0e8b82fd466bc2ccbe591d379a332379e9eefb420fb12c504ebabf1bb6a6c8050a81
SSDEEP 12288:xPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E24523BE915C01CBE92648B5C3E5F15DAC173E57E92004837A9778BDFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 90556bdd69f5854507e7a5a3827ac085e7c6f30487e7a74fcf7af0e84707ef63
MD5 7331b4eee59cca12c367932cd334187c
SHA1 0767ececf77eda7ece5407d1cf6a18ce1b5ba433
SHA512 ea05dffdd4dfc26854a22b0ec76e79626f01bc589c686430c9aabb4fdc9627d8551b73ab37d11e37d4f139e3d6956c1bf51b013012fe04b262121804160eb45f
SSDEEP 12288:egXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:egsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BE915C01CBE92644B5C3E5F15DAC073E5BE92004837A97B8BAF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 03a22ef0eddb8b58179f74c4cf2b68dfbbed56186d86e5bfba782cc0c5282d01
MD5 d7b3c4bd93753b9247f229c4f01ce5b4
SHA1 ac205074e424cc5d4d23c455a2271e92c924f5e5
SHA512 e9ce5cd3b66932400ef91f68c5ad4ff0866cdb866a3a5fb3ab86a22f80e8260d359da2e21552117482615f5ea37d91002a0c41a0d0cb883b7c24950d6aae3268
SSDEEP 12288:fUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BE915C01CBE92644B5C3E5F11DAC173E5BE92004837A67B8BAF7F24684B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4e8d48987de805cbc0d33f3c246906c7ba89f508929ca0552b3508fa3396dd3d
MD5 15c4bd7ab96a1709f5088a390edb11d5
SHA1 2f9c6fe92c279e3d3e3266129cbcb38919b8c402
SHA512 bb325193e0fa402770e018cdf12e870ed78831e19fba4dd4ec11940d4f6d7700c6fd8c64120263533481bc5075b51d88667fb8afe013f7cfb947df59ef5de149
SSDEEP 24576:rZMhzFVSOcsqjnhMgeiCl7G0nehbGZpbD:rZMhzfMDmg27RnWGj
TLSH
T1A36501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 37470eeaa70e9b9ec15aefd5a507f8ab1abb4e3ef03b5ffc889d511dba0ad51d
MD5 f2d8bb3b8505a13d22b30f034be904bd
SHA1 47a5b8950ce64bcd09f9f11e40a9ab2682d4a7f9
SHA512 3d308507003c3393ad717e320787045c11b9a7bf0667db6d7765c0aede273bf57d430dbf39de0d3d1f2e376a5f7a00402544976a28de20912c721b92a3bb35fc
SSDEEP 12288:+5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BE915C01CAE92604B5C3E5F15DAC173E5BE9200483BA5B78BDF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 5a5cda2cdb9417042e707f8b1200edd94ad7344b8144a14db17583e05f1847af
MD5 827962c7ea41edaf0ac53831c55a57f5
SHA1 6667ef7a8e765303f38fad6c45cada8fcc431140
SHA512 49d397d0408c832ad6f5747c79b8b61042b751d7a4a268b2fedd972e1938b2c89df2c7aba0f224e04882c69ddf9c99feab755ecaf57e51c41d125f1d80d1bdaf
SSDEEP 12288:o1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:o1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BE915C01CBE92644B5C3E5F15DAC173E5BE92004837A5BB8BEF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 02c83b7589945bc2894fddf505ac50c24bdeaedb4695fdbbdb9fc0c854c72251
MD5 91727bb6ab9b8bbf37d04651c69f0f96
SHA1 880cdad4c6f1f8c560fe941ce4a326849bad7c5e
SHA512 76859f8b69c2069d3bd361c69c5c39dd826066bf59845c05a81452f2ddb9de06167b316fedd6ffb929c803490239af73b8f2aafb4fd0dc8d82e24918c12d8bad
SSDEEP 12288:QyPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hzyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF55025B73A530F9D1368138C5A29A06F7337C3647204A9F17A156BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 668ecfd73c347d8f7511cc07b2b3f9c5f0d291ae18fc5af500d0f429533dd313
MD5 cc5c7e715d52ae52359d04ddeb632766
SHA1 937ea389ce2cc45947f5c0aa3d081fd70821b8db
SHA512 a0c7160988f72b7cc6e29336a0a5b014fbc9b2d7ce5b0f349bfc190cdaf4acf2c80d9b7335b878b34fd699b0f9d6a76dafa205abaf1dd056496e85dff77fcf89
SSDEEP 12288:i5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BE915C01CAE92608B5C3E5F15DAC173E5BE9200483BA5778BDFBF24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 9c2500aab32f7f600f8b16c265b8d33a672739be76fea0c9ece75e70800b585a
MD5 84e9581ac69a23eff00a1c61a437749b
SHA1 0967479b44e67eea0a2aa3f03dec35a2fbf4d212
SHA512 72228d45823806a420742b3f32947dd8c121161bdb18b0ad70538ff2c7002f15751ccb3cd882f6efa2f3c22973ab3fdad96ff4f1a70662e5c177db1123d10a48
SSDEEP 12288:Q5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BE915C01CAE92608B5C3E5F15DAC173E5BE9200483BA5778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 973874d4d8abd8c4488e957d83fc286be93136e2248fba168f990b2d6b6bb369
MD5 1c2a4524579bc9c4eaedc7bec9f11122
SHA1 44dd1586677352359569878069a9e617e3c23646
SHA512 1da0545cd4fd93a501e697ea1145c57bd8f23ec23259fcaa618cdcea4960f6ee574a09091499675bb0b44e8fc59a1127ff967cfb6906b6d52c330a78764bcacc
SSDEEP 12288:ryPz5L8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GzyosqjnhMgeiCl7G0nehbGZpbD
TLSH
T13155025B73A530F9D1368138C5A29A06F7337C3647204A9F17A156BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 207141d3437988cf319b10a7ee0ef9ee88a60f5d30d52410c909910fbe14a7a1
MD5 c6884bdf757dd25eaaa650a0b401d8cb
SHA1 157b184dbf1672b9f1c92326471f2d615e18b605
SHA512 36e3a4c839294612e6311dd1c33d80e52cf7dc04a6bf01edaf423c9756b0ad15900be4aac86059c58438d7c0908ad1131caf9354e7071f037e9fbc4e71c67f1c
SSDEEP 24576:yTCaLl3z0zD+sqjnhMgeiCl7G0nehbGZpbD:yTZLljvDmg27RnWGj
TLSH
T1066501A9B35018F8EC67813EC965C90AD5B37C5A0B70C61F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 8e48b9ad1376ea97d1cb448678563ecf6b4a62ab524836674b6b84a533f9ecb3
MD5 589373d995e032c69061ac29adc5a786
SHA1 c762ab4ebaa8027fa8fb5290e1f3dc77f4c90037
SHA512 50c784fcf45a53689c4e7e73320734e8e459290a7547bf031ac3091eb7d4b4972736d28ec8e48b43d16b8eefe0f899d8710dd8c3a6900d9c198afbe1a8c0ac19
SSDEEP 24576:h3jd9CHKy7GZSsqjnhMgeiCl7G0nehbGZpbD:Rjd9CHKyaMDmg27RnWGj
TLSH
T12F75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 0ab5c18306183d17ab57e4bb243b3608bac8170bcaeccc285b3c54049c56f138
MD5 e5a3a7b2756cd43a1794728800ba9f78
SHA1 c81c5f0d16d2106c98ff99c9cd0e0d71519d8c9e
SHA512 257c9b66af5196cbdbbee27dde16b83cb4b4b40a9926f05e0132d1791293a202bc5ee2172c732a6c636b10e5e5b3110bc82325e7b2513975a12b240dff7ab182
SSDEEP 12288:QOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BE915C01CBE92648B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 c5977ecdd99bf4fc2516e125d9ef4bf5ab815168060f873a8ccef94bfd70ca84
MD5 99e5f5fb14a6746a7cfdecd75b72c254
SHA1 51b341bbfeba60f669a6353182cd8855d48379cd
SHA512 9c722ecaa2e37f8931120933c0f95d26e7b44884cd811f9c09ac31e4da8865da18210af7be90b8269fece6eff21440dd5513e91c8adaec479350c8aaa66f393e
SSDEEP 12288:DIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1144523BE925C01CBE92644F5C3E5E11DAC073E57E92008937B9778BAE7F64684B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 bd02b6b45a235c0adc0dd5105a26411d5675e845b6b1f62ce451d0783a49cfac
MD5 6f5448160fddb7249af2978eb756ebd1
SHA1 0424636214c5c5cc3d1e2b2741e5cd04fa92ba2d
SHA512 b274d24d7cb0521aeb5a3c43c94edf9982041ba4bc497e1e11ee3e2b84628718c8c4f280b1991768779dd0e8ee44c7811810e2b910833446c0bc1fda08a66046
SSDEEP 12288:2zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BE915C01CAE92244B5C3E5F15DAC173E57E92004837A9778BDFBF24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 b515f6a5e2fef20f8e034881a7969a7a857aee7111bf30d9fdcf5886e0ec80e1
MD5 bdddfbf8f8ab3fb321e8bfa4addd4224
SHA1 8c0c371bdacc4a067c612f46bf87a459ad60e7f4
SHA512 8e0a353dd32ac22c06c2a9d774444d12b96ac0081b6a8a09d005ece0cdde205c80a95ee9ef795f50069779eb9507bf3d953322f3fee810c8817836b6f3f95a52
SSDEEP 12288:x5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B54523BE915C01CAE92604B5C3E5F15DAC173E57E9200483BA5778BDFBF24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 4b40de51831b731ec5a128a5bbccec57c1d89f1e33933fd344d055d658f030a3
MD5 43c573911890b8e894eba053610047f1
SHA1 c306a20fdb07f2763a61ef2b8ae7d48ba2fb9385
SHA512 7d4254bc7dca297382800f89307ecf6dfdd487432c1bc70f27344876c6369cb09f4a87fddef708f89b39abf97edfa22f52f35dba00aafc57bc53992b20b84160
SSDEEP 12288:5OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1094523BE915C01CBE92648B5C3E5F15DAC173E57E92008837A9778BDFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 8eb9e3866f2d7f823eba285cc517f24c316e3f0352775ce149630d0569ffe4d5
MD5 897931a311f2315f204fde78a921ab2a
SHA1 97c39bc0ca701cf8c00a53a5351437494c75710a
SHA512 e12075ee53a928a62d2f457271da64f2fa4d06453c85302a4bb6bde899e69f962f01d6d55518beb8de682adddbdac121698dd2e2948fd30b2e6e6055ba45e1df
SSDEEP 12288:sxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D14523BE915C01CBE92648F5C3E5E11DAC173E5BE92004837A5778BEFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 a0d98159bafc6ffdcc580affc2816dae89c0941997ed8b3a0312256263cd0511
MD5 f352896ca63ab3ed08bdce45c951e67c
SHA1 bf346a5aa3ddcf14d7f4cc298b3e9c656b8b3a1b
SHA512 4fd51b6011d6bd372c5f5bf1b7db8ea3d90c190575dbeba35c0804d4909a9fb66db6415c40c94e0b07a3cd4bbe333cbcecfb9c0c493f508df52d148503e9fdd4
SSDEEP 12288:pPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BE915C01CBE92648B5C3E5F15DAC173E5BE92004837A9778BDFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.1MB
SHA256 bbc5f7c11f4e84ccfcca2b5bcac4da110f361ce671021b579cb068c5bc2d4eef
MD5 4ba3cb4351e7b218b9abc4bd05301c56
SHA1 b380c5e9eba27669782650376a674e8337159b38
SHA512 9672faaeab460b605a540328dc4a271e02d7e3bd2f8604af362630c080bd6cd09e6f26485b08a2dad840e6f69eb502a984aaaa88929c86005eced60eb0c84009
SSDEEP 12288:FWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BE915C01CAE92648F5C3E5E11DAC173E57E9200483BB5778BEFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.1MB
SHA256 9edb3a958a5ec6dc60dfb028a0145accedd5c406e352617e59fb5e4a9b6f00c6
MD5 38659153dd776d50b0edce24a3570474
SHA1 f41f85239a0215f0aec33d69ef08f8598b0c8ea6
SHA512 fe7f9bc99698ed2898d72547f03827c23190c75b9c970fe9208742ac7314cf9d659c019eb5e96c25fed1c743f793b9c3e389e8a70cf8b7a2b13c2c86622851cf
SSDEEP 12288:lPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B4523BE915C01CBE92248B5C3E5F15DAC173E5BE92004837A9778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d38ec18575706d6426fe6f343a4555fc382ef132c1774ecceead8fe7526a90a1
MD5 8eef64361f76d17925a62f88a0c08774
SHA1 1f1b9d5fce613ff86f1001bb5324ef5f26875445
SHA512 4528b2dcb646aa6605cc5a779745d896d64d5187aff424e56e1b801481c4776bc9e8b3bbb1474873420daef5b56d21a549c680d20fec329677d7ba396c2d3ce3
SSDEEP 24576:BfwvFk9RX6wkyAIlsqjnhMgeiCl7G0nehbGZpbD:qMnYIZDmg27RnWGj
TLSH
T11B75D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e987d4d68341ac907ef55503ae237a3ddfcf33c1721a5c3ce55c2c39789557ae
MD5 c48fa57c55357cac80e99c01ed59f23c
SHA1 574076caa506af9d454c656581a8046eef08e2d6
SHA512 a49a7bddff4c271aaa70895b5c0e9ba08ad8aaf19c9607df525799fe5b77418c7220f34cfc8f268b661d289488ca6bee5463bd6ed969a52f5ffbfa5001d434f7
SSDEEP 49152:bYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+Dmg27RnWGj:/ySzPWD527BWG
TLSH
T1FE066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 519965ed08be5cdbde7c335f789231d07da6777218bbb775ab7460334868da6d
MD5 46341047ab421830ec8bfaf4817ebbe1
SHA1 a97b880536bab28b59a9997b285ee1a495e4e022
SHA512 07256b3d9431fb293f100812c5d466764fb1f94638eda68571cbd7802c8fe3ab40f051c2446f4be22fbf22431a68c8f08c018487faf9b9a66352c0f53a27857d
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYMsqjnhMgeiCl7G0nehbGZpbD:h47JUQj1irIhCnDHUPfF/uDmg27RnWGj
TLSH
T18765AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 9a180225b7ce984198b40f8365c34bb2a9b7efa45a6efc723bdf085c095cb86a
MD5 41853a3d288778c2ac75e114f0e9f48e
SHA1 a0b5612523c504aa723ecc40edd2f697d831614f
SHA512 3eabd3625333aaf18314e9322c739158a7f2728d691115a6b7009f8336e510281d8ef75caed296f94916993073e092e7c6d85862f3553c773f46be31c13ac759
SSDEEP 12288:0ysfJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12155015AD29802D8C06E5179C3969605F7333C2687E093CB67D1F87E1F766908EFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e96766e66c4055dfbc506afa5fdda99a2aadbbf9436ebbb2458cbaca2b30ef97
MD5 b12ea68206a2f62365ffeea42bf1a9b2
SHA1 0e43242a76a814ad41c73510dcc08eb284d1080f
SHA512 7aa7d5ee3599cf6ea7fbee223c762952989fff3ce2fbbaa3fa1708180c670d16113f0354e165a5ff57cde3da9b099d216fbbe8cbaa176101b63bf6298b76582c
SSDEEP 12288:tMk7U3f1vPls++XkOhtvoyH7JRTTPYD7RvhLAT:tMSUPhPlsWOhtLbJp0D7jA
TLSH
T191352951726BC75FC6A944325E32D5CCAB703C51EE046F0373C98B3F9576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 b70698544eaee1cfd9bb47f19712c118021f881e3e7c7fd264d31b65ba269de9
MD5 b89ac570e55214bffca84fbb75ac5b46
SHA1 2574fc47a480451451225418e5f5320b6b774c31
SHA512 6b89229be20a126e1473aeb1625a5108673b28f7e1344109fc006585110e46b9f7cf329d3b2081c206195a30f347d1f86ec6fb1d8f68a5f7e3fee3f8f587e621
SSDEEP 12288:frxzxHYDFj+kenmnP3I0nHeQqOrRsnLnmZB:fVzxHQFj+KReLnO
TLSH
T13965E9816137A39FC1FB6032032A5B4CA764EC16B7496F27B3C84539D86A725B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 061da2a49e62cc5ec61cca23b9f92d4a2eaa8204dfd982ea3eea81a69f8c8a80
MD5 ddfe862ad15bf19bce9015a0f6f75383
SHA1 8ac5a7d63dc68d42c0dab140abf973b8feee25c5
SHA512 aad5724ccbc3dca8456375b323c892a38201de327a612e9f4409ce24bee283eff966dceb6fc28709278b161c6187852ea2178e5c38c76053c4fc6476a20e03d7
SSDEEP 12288:C07BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F45237AC34C118AF93605B482EAE12D681B7E669F2004C3BA5778FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b6bf58337930b0e108e5791735586411c567a574fe6f7c693bf6ae434069bb6a
MD5 2ba02adf067f9610a3c9e95b37c322ca
SHA1 88f26b1b6cd86278271c70b29e17d4f14f70f07a
SHA512 6a79033f028d457585565b79202b607b1bca19e087ea0640f7c5922313361c1d7b31caf9853e2a04088d54dc0b5014cd8c39bd745596cacf963e4146c9dbdecc
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bY7sqjnhMgeiCl7G0nehbGZpbD:vgb4mBIBhGF4Dmg27RnWGj
TLSH
T122659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 77aa4da1e8d94da48f7bb9141dcd9d090a22adc2df5840ee895e39bc35e236f9
MD5 0b39876ba2ac408cb5a9e6db16e7c720
SHA1 af9ead4f65b071b126663e92a48213ca66243d3c
SHA512 1002fcaeb397dbc594d204eb26f7b449061b9f2fcceabb32e19fa357aba768c308af49c7bb94b3ba0932d6ee7775a61f0fc1ea7f476e4126a3db26f7ce7156e5
SSDEEP 24576:BG88u8FpJqH1Wzria7/mcsqjnhMgeiCl7G0nehbGZpbD:E7ZFPqVha7/XDmg27RnWGj
TLSH
T1BE85F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1f2ea5291738a7a2cec5451bde3b4bbd861aa1156ee924d01c756070d8c29a0f
MD5 6b0179f32cc7941e20455db9426f3e3f
SHA1 d36d0053f40b334bc54d0a2c44055aa771f60f3e
SHA512 1fa7ddc07482b528f9c3ad57e203203933c7835bc47a594cf54a399774551d4aefe7e847bf4ce48c7438b59d51101f55cdfb197aa6ceb3c4c9b2bc389b91619c
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcDmg27RnWGj:hG05lO43bhD527BWG
TLSH
T1E2D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a7d226be69d2c7b799cb22df6a7e89124eb3b58f92d6ece80f350249d74ceac3
MD5 244288e97e6499174a0b4ef020f6dd48
SHA1 3fa6c0548bb2e0502d86e26dbeca25bcb37195e2
SHA512 7f83cc47ada2d034a51b0a7ea17703314eabc75770f695f358aa93e22e4ee07cb9e08686b9b9bde2bac403381f034fc15062b781c31e31a35727f76efbf020f0
SSDEEP 24576:Efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqsqjnhMgeiCl7G0nehbGZpbD:ca5POZ3+Jt2pasx2+m0Dmg27RnWGj
TLSH
T1D865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7cdbd8e0101e33c8d20c5ab7df2acc79e06089c4cb10f1fd09deae76fbf22b93
MD5 6b0e8a87d623b3e8a9ba05ad3f927495
SHA1 36b27b274599464334a61f41245aadec2026b648
SHA512 eaa4784f4eeac9b3c40f01be55e0ecbe34021108e46db7a64cb1520d744e5d4b07e07f88e0bc3681c49ef8ff5a1500d5a0c759813ad7c0bcb7862d038a5ad7b7
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkksqjnhMgeiCl7G0nehbGZpbD:aNc/zEOVHF3Dmg27RnWGj
TLSH
T1E6857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 14e33094406c2e46c0f8a9372c745267786bb8918fd3873a64eae38f2d68b69d
MD5 e5431e4e7e28a85b6d3b8b293988fb56
SHA1 7245c3fb32130cd5a94722e067f756b56f8529fd
SHA512 84752b2374c98a243ee6c980e7f58a2c7596c07a26dd05356dcdb6979ff413de9e7098130e63a71552b1e695b2f9f3fd35f330f3484c7aa2bd891f736ae3fa16
SSDEEP 24576:b8kNvNnaFeYhJNtmZBmWsqjnhMgeiCl7G0nehbGZpbD:b8MwBtOmaDmg27RnWGj
TLSH
T18A55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 0c357d887c2cd2e774140b9d71dd8dee1985d2be6b9d0b14541802199a47fce2
MD5 e3d6c107aa8e91e4e75dffddbc5f6816
SHA1 d62795c535fcd263dfcf9768f122e175e7511d39
SHA512 c4ed533da57c4b59ba4798ea2fcb35ad488cd841d611e2c0f68b86f0132e3ed0e7ee18687b45d4b10e363adc0afe0ed0b3176ab43ad330c463def28a3bcc01aa
SSDEEP 12288:VHvUrBFrEjwaQQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:VPUr+NQQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD55F12F22AC18E5E676A17DC682C60DF6727862171192CF02E1817E5F73DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 44439b15bfcc9ecf2d55b03ec2029a750e42161d57d7afd9dfdf5b7cc65ddb67
MD5 7861b88c70731d0dac4342e1380d9086
SHA1 40fcf241d59b91602be7daf32ccd243e84955eda
SHA512 4785e71c93aa3754b70d6c715820c368831a6b540e61255428ae9b79c2a31164d293051c6c9a5e3d0911f1c6e64236a63a8180a9c8c8ce9f60620b25203f46ba
SSDEEP 24576:HD3FHshBIYQgAtsqjnhMgeiCl7G0nehbGZpbD:HDVHeBIAARDmg27RnWGj
TLSH
T16F75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/432-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/432-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/432-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/432-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2744-382-0x0000028C63630000-0x0000028C637FA000-memory.dmp

Download

memory/3432-39-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/3432-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3432-53-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/3432-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3432-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3432-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4040-97-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4040-91-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4040-383-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4040-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4040-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4040-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4288-122-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4288-114-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4288-116-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4288-369-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4656-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4656-55-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4656-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4656-278-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4692-310-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/4692-80-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/4692-85-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/4692-79-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/4696-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4696-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4696-109-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4696-367-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4696-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4696-103-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4800-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4800-128-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4800-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4800-139-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4800-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4864-0-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4864-7-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4864-6-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/4864-8-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4864-316-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/4864-312-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/4864-78-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/4876-74-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4876-296-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4876-66-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4876-68-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4888-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4888-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4888-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4888-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5992-22-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5992-21-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5992-14-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5992-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5992-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download