f2d8add45f82018e479fe0c6b917f976f6591c79b08e91982947112a79b9f133

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
Size 1.6MB
Sample260804-gr1bcssejc
SHA256 f2d8add45f82018e479fe0c6b917f976f6591c79b08e91982947112a79b9f133
MD5 a29faa49373278d94d2b24b47fcfb39e
SHA1 2a9b1477b4ecfb6a6b3b1aadd802899057fc38d7
SHA512 fc7925cdf649e0e84edd50c08297505415c1fe5f35314a966024dbad1bf9bdd69fd7e5cc5115aa57c48642d0b76269af5f3718859eb3d3d8559e3dc3a3a9ff81
SSDEEP 24576:bHDqNM+2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:L5+5b5+Pl6bJTIZ5jdgpQ
TLSH
T14975F103A26D7CDDD066C23589B58691EB31FC315B50A69F43F57B262E322C3BD2A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2056	elevation_service.exe
4632	elevation_service.exe
2548	maintenanceservice.exe
5980	OSE.EXE
4496	PerceptionSimulationService.exe
5940	perfhost.exe
2552	ReFsDedupSvc.exe
1556	SensorDataService.exe
1740	ssh-agent.exe
3432	AgentService.exe
3696	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e1b72bb9c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000987f08f7d623dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f79ebdf6d623dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ceadf135d723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d6c5ef9d623dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000004105f8d623dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2056	elevation_service.exe
2056	elevation_service.exe
2056	elevation_service.exe
2056	elevation_service.exe
2056	elevation_service.exe
2056	elevation_service.exe
2056	elevation_service.exe
4632	elevation_service.exe
4632	elevation_service.exe
4632	elevation_service.exe
4632	elevation_service.exe
4632	elevation_service.exe
4632	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4900	2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
Token: SeBackupPrivilege	2552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2552	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3432	AgentService.exe
Token: 33	3696	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3696	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3696	SearchIndexer.exe
Token: SeDebugPrivilege	2056	elevation_service.exe
Token: SeDebugPrivilege	4632	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 3528	3696	SearchIndexer.exe	100
PID 3696 wrote to memory of 4680	3696	SearchIndexer.exe	101
PID 3696 wrote to memory of 4104	3696	SearchIndexer.exe	102
PID 3696 wrote to memory of 5952	3696	SearchIndexer.exe	103
PID 3696 wrote to memory of 3532	3696	SearchIndexer.exe	107
PID 3696 wrote to memory of 6016	3696	SearchIndexer.exe	108
PID 3696 wrote to memory of 1628	3696	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a29faa49373278d94d2b24b47fcfb39e_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2548

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5980

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4496

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5940

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1556

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1740

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1f20776bcfaae714dc0e92389e0d5a619f3268b626928d159e5ea39913d7a721
MD5 7d301b31f1f14ed5539f8af8cc946d41
SHA1 28f3cff9155508a0341065beda5973d8aba4cf6a
SHA512 c0bd2ed35c95ae25d18a9c39da152f7d78cc3b7c852d7c2b2ad0b4ac23a2dd4595d7a8c3fc88b1c05201962b84ce2ad5812a93019a5ab62a344cc0d904021a6d
SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnSb5+Pl6bJTIZ5jdgp0:O3q6mjBxslgJTIZ5Bgp
TLSH
T17DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 3a4f60fb12404704580db7320e9b37ca010f595cba06e071059c526ea05c8f5b
MD5 e50bf39675652d805065c5453800e905
SHA1 334193c0821bda7a791a6c2f33549bc59c08c1f1
SHA512 b2a88c7474e00994ebe17377a58fa50b084ce39273ac96e6a650e1e512dd6b5e6bd365bdfa2ea5018044064b3c453357356299a8d08a9c76eb365bf159901f99
SSDEEP 24576:9XYfDtczAemb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:otcgb5+Pl6bJTIZ5jdgpX
TLSH
T1BB85F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 e66c82bbaca959e201ae921f57cc1e9126ee8edaf01b00f7499e4e22a0e403c4
MD5 60f696ca013b7d11c35d3c06d4f274a2
SHA1 763e4149286bf87bbbe6dbc05c9e2251635b5bfc
SHA512 66f78b57c63ccef9250e3945b54e2d53d1718c38862fa859a466b7ca7740a9bc6020389143ffb540a6a14e9229c4087321e810c63b6cdc14c41e8303f10a36fe
SSDEEP 24576:40Le5ji0hmxyrMTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:4Pji0AITb5+Pl6bJTIZ5jdgpB
TLSH
T1FB95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc65e109d1644aedaf098b7228fdb8825fc4d19b668a8db088dddca2fa059f12
MD5 e84ce8e172ede6c71d6f4ffb172c3f4e
SHA1 dfca2669996030cf50709e5e20893266cfd3d4f9
SHA512 34207bcdf7624f24a713c3641c9d49a2caae78bb67dec9f43342aaa7a00e094487abc63a1f9703caef55d93c7616652bea3dab332b98ec780a587a2eb108b877
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyuNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:m/ezSC6vUzPv+Hjyfb5+Pl6bJTIZ5jdc
TLSH
T132756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5d6502b16bdabf489ecd440d96d320d465e3175b38dc083cde9f0aaa1a884bf7
MD5 18672a489212db5ac86e61709629a9a7
SHA1 d6ca6d7c31ac3d62e58749599a8a4301b68e9dc2
SHA512 3a2d3587903ddf04da664684091db7c7f224ebc78ae0c6103fccd380e7ed68888829062dd42aa1866a8e418bd810a333efbb67bf9c3d4105b4d0b015b23d3659
SSDEEP 24576:DVbqPb88hv/l+Bamb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:DVO88hXl+zb5+Pl6bJTIZ5jdgpI
TLSH
T14E559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 4d37da79ac3802f317f4ce2a5587ac5f33b468b3801a5714dabbb100610fd4ac
MD5 64e344c7ce2f8dceb9c515dd436407f0
SHA1 389e1c98cf8de383ebce056a44cf8603164dffcd
SHA512 3392994b953e7bb7bda60da325206e93e9a6470136a983117cecf4a194e0fefb2c3f71e50308aa4a77fd867dff8dd95498c2cc7a4a8197a80462d0f918a49fac
SSDEEP 24576:mFfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:Xb5+Pl6bJTIZ5jdgpX
TLSH
T1456523834B6930C5E5AB1739D9CDDB00F879EF55CD866BB6C579282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 3bbb56b2acb827676f347d964d0f5674cf2503c15f29325c3387cf4878e95a1b
MD5 4c9deda631088a7d76d40a397c2ca843
SHA1 9e70bfeecc12ecd88b76476cfe8e4fcfc6c0c95a
SHA512 ffd5e86e3347c74f8d4dbd39a15e9fab0a4464a74c0996bafc14e110c3c3c166182648ad23c51c0e5597307b8184fd10426c4538851c7cd20ffc939e0eeea9ed
SSDEEP 24576:cJIUymb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:cJIU9b5+Pl6bJTIZ5jdgpc
TLSH
T16985CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 04f61f266a449a7d7032b6593016ae1fb7de53c003b22001a5ef9ff425cf5912
MD5 cfd1e2eb0914b24597adb30f86dd6c19
SHA1 b702818afcd103349a3253465c48d1f5095b8e28
SHA512 6dec54c81bce2a98c27ecb41bb9c4337f302e8a2e45f25d3a96ba7f86081b9d210f1b6d2b5df210b3c1296334ee05023d97ae8198f242ae798329bee1c179dd4
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THT:9QvGAdlCEL8c/WRNw5CuslgJTIZ5Bgp
TLSH
T1CA266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 690dcb974fcf22eee2145ac217c4cdaa9f5784b586b16d305ac9712d044f4b9f
MD5 c90765842c080cf3cb66ad7b80e74f7f
SHA1 c0f3bbd0f20c1406f219c057a9665dca18c3bcca
SHA512 77c184bad643afe235895862f45a2113fb1c7535479e36bfc414896ee4b86ff87f186f5bd8e91a1dbeaec09fd2e35c1995f35cfe68974cb3f357b8ab4357bd58
SSDEEP 24576:3OewsAj0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:eljDb5+Pl6bJTIZ5jdgpg
TLSH
T1AB85E031FE75E036C2BB0DB65B65C706643DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8b9bff02d3318f3e54b2efff2c01476fdae6292779f4f3ee790539726581b692
MD5 dbeda1f1d3a5bd65146548b7b58b0d92
SHA1 5d1ebb0debe61ec8bc36a0f468865ddae3cf10b9
SHA512 ce4841f7a51efca9c87045fdc9a073bdb492fca997e31eb09f209025890794d3ece830ca138e43e2457a68b99631d55bb89b984ded1fd46862fdfea9cc99bf0f
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHfsT6p:bUEtQevvqc2W1cpV20I32fs
TLSH
T150474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9d15201a16ffc91723b61877d42d67096c11de9dbf635148d8537b7b2b328cbc
MD5 4edabdd760727ee368d6fc35148e2aa4
SHA1 844f5184ca429d90d263aa6d7bf8cb31492055fb
SHA512 568fe3805ab6f3e4781fdf9db3fbb8f921753f17954e970bf2543456e2f21c37fed6225ccb6c13e86fb3a2bf39aa5833b84ac53768a631964ee81aa996146a85
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/zjb5+Pl6bJTIZ5jdgpJ:SoqtVjnmKslgJTIZ5Bgp
TLSH
T1D1D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 93870003abd21c92b787061c0a358084367b229e701e67c5e2d0fa58fffe1287
MD5 53ebd49ac0f8bc803a8bd8d7aff4003d
SHA1 9e1cac15645b09086f706d7816b4fd1c2bf8a6ec
SHA512 8fa3ae2cb7dac4a229ae0492a297e83a2d176e0668bba9eca9d35a10bc0d13838a52a2c23eaca17cf2baa6545c4f9a9c2ef15c1c3c0527fa4314809c6aa253db
SSDEEP 24576:sAhGL6IFoiwtA5l7S53xmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:sAM5Foiq5cb5+Pl6bJTIZ5jdgpG
TLSH
T174359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 e9051e9239fc2fa728a893dbae345509316ab9ddc3042de41f451273772a20fc
MD5 0361c54aea31ca89d5a6a38d8d141fc6
SHA1 8110fd230fcd12cd30bc9d9ea5f40236b1a914d1
SHA512 694939d4daeba26165737a980bf9d7143458fad5e0e4049919a9d33ea0e083748909bad868da128b00ef3100ce681d4e83b09be711d5046cc80208605f417d55
SSDEEP 24576:LwuGOWImb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:LwNOob5+Pl6bJTIZ5jdgpT
TLSH
T15275F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 74af093334dc4deb35acbe15aa626d23d465654f21e3890a289b458f2f31ebd0
MD5 4465d2d7901c4c55ceb3aac19a78a9f8
SHA1 eb7db2bcd8cf7b9eca0190c518a94c3d84189c71
SHA512 08ca052dd4cac5a8c78828692fecb3d28ea513f8901d5f68c0fc244bdc9685f5cb816ef8f608c94d723a0a3a27898993187be7727c60014edcef48d7864bd010
SSDEEP 24576:8ZuLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:0b5+Pl6bJTIZ5jdgpc
TLSH
T14565128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ec9670fce4202015affcf55d8cb70c93f0ea3a3c7f92f70aa8d7f35b31a939ca
MD5 1e5fb3442b7468d4411fb6c4369d73eb
SHA1 2e0630371ffc0e15adcc51ed061542349359573e
SHA512 04cadd5970c9726e2cd595bf9a74c888e5c64c33cbc4cff644299522a64ec499441de940d781b6921343ac1a744d8c7c274d156aa9008180a773a9147d96e0ec
SSDEEP 98304:zQRQyi36YOcPDLvw2gAf+PN3FslgJTIZ5Bgp:iQyiKanX+PN1sT6p
TLSH
T172666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 34fd480424b012f26cd4b6cabf331d955df54f044694cebac604660f12785bfa
MD5 3497a983afc7c8f55eef21869eeaafa8
SHA1 0afbc4f156bfaeded270b058b8e1f30067164a01
SHA512 cd225e373f6aebe89253378ddcfb86acd5f5256a8d4a665f8b57fd7c3941b954e643840a7363b87666dc2f3037a08c478ec1471a3ff8090bb12bba257fb6450e
SSDEEP 98304:HQRQyi36YOcPDLvw2gAf+PN3FslgJTIZ5Bgp:WQyiKanX+PN1sT6p
TLSH
T173666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 256cfb20f2fafb704cac6335c1a5901ab2885fa157cd3a9a14fe099e83969eb8
MD5 529cc07f0580275b41b3c4496e0bf57d
SHA1 1719d236d46fbe064e20c06ea8c6ab290872c75a
SHA512 a771e14e315afa1cbd968ab0a2abaf37a3f8b4c0466ccc9944ad77af57b7d72a76251e301dc732f961f372f7bd13213c041cf1875f2ec0b8d9af9edb4f17595d
SSDEEP 49152:C68Qg55nhkeWu7PNU3/Tb5+Pl6bJTIZ5jdgph:AthTRc/XslgJTIZ5Bgp
TLSH
T190B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d8d7a2621afdca100e395b8c88ad11e91c81f4fe5d935de38d5e1fa9fcefbc85
MD5 b60c8122eb214bdb55f3dbb458a6fcdc
SHA1 c284353f7a195c0d9fa3db9d9394c16aa9ebe72a
SHA512 07f2d73db0f9334d742fda80402b8c0a517192efbe7fa50f308006ef8967881fd9fcc3201e894f8966f38c4ce9345f7d93e141a8573a4b883148973cca1dec39
SSDEEP 98304:iy5112gYy5azzVvU69nLKnhZkslgJTIZ5Bgp:rLIHRWhCsT6p
TLSH
T1BA167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7cb82db42c46b74a56c3f35f3c875ad9638f6008f722745f7115f0dba0f2a360
MD5 3fd872e5d12214ae758ff3f6a267544a
SHA1 9969fc0236afd3204e2190135135d2c0c0c3dbe1
SHA512 e49fe3078596733c8e9637d9c916dc1bcd4a20b80e94775a4d0ffc024e43798ce6fb4df95f2a642c7c70854e29bd67d18f6dc0ef0f37f702a9c0f0aa30f077fc
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glRb5+Pl6bJTIZ5jdgpv:Vu6JmIxd2dNslgJTIZ5Bgp
TLSH
T108D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 750a432b1c686f6947c3a85c4e7682cd609fa4da2eafe68c668ac406f68a94e8
MD5 f66da9d54af13a315a19515d317c90d9
SHA1 11ada66be2b240e052e164412285bb3052f32dc1
SHA512 e151dd0b1618641d277ba46c7a85039d4622258b8167b60612c20abc4110adc52d7db17ac02cdac1a721f7511a8895c689dd656b043f6f58f594ebf5be683e02
SSDEEP 49152:e1hpsNoJpF1A67U44CwH7R4xdb5+Pl6bJTIZ5jdgpe:emifPqRKslgJTIZ5Bgp
TLSH
T1A4B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 510348fd201e5569c087516e6ff7a53f5bf9d60fd5956b454adf0db0a3b0a74d
MD5 8254a05d849836fea5d69cf069d28fc9
SHA1 f2316a577f992e5ad84ae83546aa5d71c0f3eafb
SHA512 83b131d302e59effdc97411c400ed0177c15c741ed1e594689b0b3ed7a2ef028ec74c4aac11910d62df845f651fdbb9c74ea2be64383a9a2bf0ebcdd6bfbaca9
SSDEEP 49152:SSuZQIY0Be2KkRVtOnks6NMHqCb5+Pl6bJTIZ5jdgpS:M5dKqi61IslgJTIZ5Bgp
TLSH
T175C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 39d06a315765895c7de94598a3a28e887002b9013e6174bb7febc801a5a0db32
MD5 5e8a51df19c4f0f284f916a895245465
SHA1 a712df8288aeac00a337eadc8ae1e90a43e3c7f7
SHA512 86f2ffc416de7e7d0a29ae4e03616ae151e6d7e1d03cef29676abffecd5a99e743dd82a684a27390b32eae62989f66061ae317d5e4f03840beb39f578db1ed77
SSDEEP 49152:OhtSn8EApI0figjgiDn0AP5wBb5+Pl6bJTIZ5jdgpn:PX2iWphGslgJTIZ5Bgp
TLSH
T11295BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 37545d5d05b0c520031e8e4f853b7c350a081584488151499fdc037252fbad37
MD5 6ae81d48393f3469fbe821df35f12e05
SHA1 5b23619c2413e1b183385d138cc31a0f58fa0eb7
SHA512 95b9dc09e396e5fca85ea98ca31df7500bb17ab0a0452755c7b8506cd30d3c5d095927a96196a8c187397955a43f5ae08dfef0a2e6e1de73d14411e886ca5565
SSDEEP 24576:j3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:Sb5+Pl6bJTIZ5jdgp7
TLSH
T1686523824A6B20CAE09B5779D9C9DB00F87DBF96DD8727B6C67D0427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3f9f51be050d4fc5703e7ce99e93bd34d03caa1ed10c4f0a0d06d36444f1ccb8
MD5 79931a8e05222b57feb129c64ec097e2
SHA1 c7f6d1b0d4fd7d774d71ffc6b4c65f36deda6f70
SHA512 f071971fb0c4f2f8eac55475f3df859334ca8ad11fdba7decc34c850ec074b87a49d84774e7f9775fb6293015c2872a1d0b2ed5141862ff2e5fc10ec6d973706
SSDEEP 24576:zwmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:bb5+Pl6bJTIZ5jdgpS
TLSH
T15D6523824D6B20CAE05B5779D9C9DB00F879AF97DE8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d167d01b94f8e6aae2e80a335edfaba4cba21c09131fde9585f19002022823f8
MD5 ebd56b19af0b4bfa2ede406c42eb561b
SHA1 91899a7d3f7a99879eddfc6fdf0c6b66288517a9
SHA512 3eebf8fec1b0862b42be635dbc9606ade81d1c2127a3d76107b13820f369b90f9c6e4edbac41a79140982ab24ad22fd565fa65159336234a1e074244a85f7324
SSDEEP 24576:Zqmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:Hb5+Pl6bJTIZ5jdgpS
TLSH
T1F16523824D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D082BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 6884948da97886ed02819e61969468c374a87fc6167b0fae24a7a9bf922009e7
MD5 f40ec54862e33573c1e8a086efb57aff
SHA1 0f72d65b48b5e5ca8ec2d3f07fade4ecbd58a4e9
SHA512 6f45d5f86cf3ab0a708e62f8cee6a424153151843ae29e4334c13213fc0cab2588757850404f9678b34601f365951cee5cedef7da41bf0a8062ae444ed4bb202
SSDEEP 24576:bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:Sb5+Pl6bJTIZ5jdgpX
TLSH
T1DB6523424B6A20C5E4A79339C9D9D700F4B9BE96DF5267FFC675082BA9313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2c46bdd90617d4fe48c939c5bce838a5ff0f9b8cf2030b2591a7cc009661e352
MD5 6bf2a711d177f36106b2c8cd22b8bc2d
SHA1 cca439e404b56ad01b7168efe6b7e41f114149f4
SHA512 ce89bdf2cb997d1ae9d011a6c486c1be43a9137e1c0495c489e3ef53373c5897894989c3b1fc17b57586c5b26d7175d31107a4480ce605119f86912eaffdc725
SSDEEP 24576:E5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:rb5+Pl6bJTIZ5jdgpi
TLSH
T14C6523824D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 c3f06322ccd45b5dbe812dbfff71d81feb6e3caf0ddb54f77e049fc48223922a
MD5 6b002d5142d85d09fe136aaeafaf6016
SHA1 b267b95b7eb07a195e4316751fdb215161ae6a3a
SHA512 cf90d44232651329d82245d19fcfd57e63ce9cde7b05437800c149ecaf22b0ccea41f6fb95c93820281e22bf363f939d3bcf9117839ce6d52ef501147bbb5e9d
SSDEEP 24576:jMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:3b5+Pl6bJTIZ5jdgpp
TLSH
T1816523824E6B20CAE05B5779D9C9DB00F879AF97DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e1cd0c2ee3db57553bf6891b05d15a112a858413a879317f6e1933fef9ed59de
MD5 e28a985fd6336c4f7f03370d343c956c
SHA1 f0a9f980628160718d52bfad0d144d366e775c69
SHA512 e0a983c7d63c09693e73cc659cf3c42f5d63eadd5c545fad0eb11e85ef929231b9779552782dc4231d7d3982c53b3771185eae3541ed2fa958906332ae0809e4
SSDEEP 24576:hYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:Bb5+Pl6bJTIZ5jdgp9
TLSH
T16A6523868D6B20CAE05B5779D9C9DB00F879BF97DD8727B6C67D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 b130f30c7018072ba8c2872fe1ee96c03d15b8a3d12939f045562e650e78848b
MD5 6185f6d861a337a0ee14eec957ee6824
SHA1 7d09c3406eb6661875d7793f361dc7d74e3c3eff
SHA512 c8f87c10ba60152ad05eda191f0630df559863893792b7a84f9f4f2e95e91a086631338b6dd87fcb21208ecbcb20b7a03a69e2136424e7580b785c6ccd66a4d0
SSDEEP 24576:+ZMazFVSOQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:+ZMazfLb5+Pl6bJTIZ5jdgpx
TLSH
T15585F295B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5df946ab2d1cb8acab8c347f61399024e1413072d3b9cbcbe24548c444de9be2
MD5 37c0d95b97a98421bcd2ee936d19016e
SHA1 1f5e20186289ddeceaf5bba0e04918c1daadb0ba
SHA512 e8a11937afb9041707c7c283e2878ec3481edb09e9f90c06845e32850516421e425df3d0446e133678eab044b9d585c217aad76b023a1c94c7cb21880fb6e31d
SSDEEP 24576:07mb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:db5+Pl6bJTIZ5jdgp3
TLSH
T13E652387496B20CAE09B5739D9C9DB00F87DAF97DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 2bd5fdd655f2eadd22bff4d8dcd9a67bb6e90598b857bcd79f2babb8f4d4f742
MD5 9231b2a8dec3dd3b44e922fddf1b5fd4
SHA1 1035edc235d76ebdde5e3f9c4f7c211206bd8453
SHA512 9f4c50f9aee60e4a49f5fac096f8a2cef9442eef6b08f95706b8a7ba35cacea117ea7ce45f1846a731f3020ca84d05e37253b355bf1285bc9d33d8efb554ce95
SSDEEP 24576:iPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:fb5+Pl6bJTIZ5jdgp1
TLSH
T11B652387496B20CAE05B5779D9C9DB00F87DAF97DD8727B6C67D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 98e6683f8fd856ee81c854541f68230e39009c90f4bfe3daa10314ebd7b65585
MD5 a50f2b102004df5658c0d24e326f001f
SHA1 546b889b758de4fa5e825b83aa2cf217d894430f
SHA512 4333bef5a926bd0272ab90afc813c6ac3481dc52c700f2c40abf4f5fe09d41016d04636b6e0b7c8782b99eec4f3149e469865a760ffccdec2aae85bfbc821a0c
SSDEEP 24576:Szykmb57GBiOl6a8JTth/RWZvR6wQQ92pN39:SIb5+Pl6bJTIZ5jdgpT
TLSH
T1DD75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b9f97eb441ca930450170dff554152fceed7a975d81c553ab6065a217587562f
MD5 efb168b197d6d3adbb80e60ee03c30ba
SHA1 8b5f8d0923052bf6e523a65ee92bde7b58a27ffb
SHA512 89c76fa409a34e56bdffe7e092d78d87dfcc12af7562553bab45fb1730617cde055182440b7627eaac8be582224f09d26b9b919b5c1a2030ad769c88b915a0f5
SSDEEP 24576:27mb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:7b5+Pl6bJTIZ5jdgpD
TLSH
T19F652386496B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 e6b718e3c7f76823cb75160b85f8a8bd562c9da166e7dfad14f36ce9df2280bd
MD5 7102ed12305613826a15508e6a2e561d
SHA1 349550220d18028f0e68eae91f0650c372a35442
SHA512 ba9c45dbc8e5b11a0e307e1bd95d17edb8fc5073167ad60b688b71b3e8fdd4f985b6a23856ab203563dfe36e82b4093a22d10d462c9e1e6b9b1c42c52a6f2187
SSDEEP 24576:i7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:/b5+Pl6bJTIZ5jdgpx
TLSH
T1C1652386496B20CAE09B5779D9C9DB00F87DAF97DD8727F6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e385941f938e1e4c29d05e9a62af6b639dda1b4878968f4418b07bf54a398b48
MD5 108e810fb31505d2cc9d53963cb873b2
SHA1 7b5a58464f709afe939f48fa5f9d6f1668120974
SHA512 c6cfd4ec6397c3a7d314dd4bb8dffb74078ad25eb1901e827589f4597634223742d495712963f74e0911e87eb921a341faf619b90c5ea2ab9fd5cda5f3b85120
SSDEEP 24576:Yzykmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:YIb5+Pl6bJTIZ5jdgpu
TLSH
T19875024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 c6d77fb805db03e67a6c5f02b5cebd2baf9dc703c2d7ebdf336b94b8a1142ea4
MD5 fac37c264c7929f334e4e1080ec4d283
SHA1 811d5bb8c341be78ee107bf6f2c73a93715a07b3
SHA512 e7242f9ffc0ee0c45778f03d02e65125cbe046de2eeaeb39ea1c57ddec677ddf10ff8c0f6d7d320926d0ab32a94a7b8ae3afa2dab6dfab358556bbd57b9b751d
SSDEEP 24576:AT/aLl3z0zD6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:ATiLljQb5+Pl6bJTIZ5jdgpJ
TLSH
T1C385F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 30f5f8df28242e3840e488164bfcba128eccaa5db1e3ecec772565087b350590
MD5 24d70fb201c0d8a31ec1e0344135105b
SHA1 0442b3741eeaa8108b0c6f29885ff77c75dc985c
SHA512 54bde6b9d96fa42d68932090efe429be29c3746906e5ca2a21a4e6e07b3c114f1955cb135c8b6d756c6acae5daebfaaa8a7118eb136be7d965f7fa75ec908852
SSDEEP 24576:B3Ud9CHKy7GZ2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:xUd9CHKyaLb5+Pl6bJTIZ5jdgpn
TLSH
T1A795CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e178e2e0e9ab48bb457e5e5d99374fb178640d7a971b859b2df32427095f852e
MD5 68e5d4b1e86333048cddbc728f3adab8
SHA1 63ba207f57d0371b9480dfeeafbc4e9901a8bb54
SHA512 197e4b91c66de0efa0fbb27a1ce519f7f8d34ee07e5d1d52d615a4d9f02c9d190b3605ff39708944dd7c31dfe8fa05bc5732a660957781d741f7abeb7e4c82de
SSDEEP 24576:KKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:ib5+Pl6bJTIZ5jdgpI
TLSH
T1796523828D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 a306f74189dc7b587c56bd8ac23ee850381fdea3b6dd9993f1cd2836fc255401
MD5 c2c4d4c87a3e09b1b0d9dbe34795dc68
SHA1 75250f6b874c43d7520eee370d063036b843eaa5
SHA512 5d98db79be78af1a159bbdb2894363872c5379998bf844cd8c4da911896f33f074b63157c0ac2c522c2c1a4361f2fd6902cc319d9a7ca07d445533e9c22d270d
SSDEEP 24576:YEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:eb5+Pl6bJTIZ5jdgpa
TLSH
T1996523824E6B20CAE09B5779D9C9DB00F87DBF56DD8727B6C67D0827F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 a60bef8b5445766b0216c91cb9db2251149c95dcd0f96f6abdfce09f94c54df0
MD5 cca2db8f72a35e531c0fd697ffd88260
SHA1 208268cbcd3d84172d25163393cab0e653dc76a6
SHA512 a2801c30b249bb0bf539c91f3f8ff5a81a1f05a89fba7b451225bcef13575995ecd5695ef7cba8294ff997170fc4e3046f5ede3470cb7681a4e7240da134d799
SSDEEP 24576:s1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:Hb5+Pl6bJTIZ5jdgp8
TLSH
T1D9652382496B20CAE09B5739D9C9DB00F879BF97DD8727B6C57D082BF134789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 9beb3d72bb48ca36cc8c1a0d587bcdebf5e65dab67e203ea508def2b4444cc8c
MD5 80b0606317aff24ddda03f322404c025
SHA1 bb5b158751a4180ba2d254c6be800ade0ce6ad85
SHA512 07c3025a6137d31df35881334bd9f4d7eac17930a16612d68a4e51088f9e44a3b406aa614c562b7f5f91033c5ae3ac5b15d53c6879ade0663cea908b9e189ae9
SSDEEP 24576:f7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:ab5+Pl6bJTIZ5jdgp8
TLSH
T1A9652386496B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9a951abfa32d8bb66991f039bd766ce3104cf7c3e3b64103dab93ce0d7edeb05
MD5 651a795ecd8fed1198d51fc8e33fdc67
SHA1 9419da845e7c18d16ec8c42a5a272151604ab830
SHA512 14a6864cac8d7b365cafd066c656faaf2bb5619df6a707278820f494daf72a766b1ff8dabddf33257fef6ce26b3af58ad711c0da755be89476381c87bc5e166a
SSDEEP 24576:qKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:Cb5+Pl6bJTIZ5jdgp4
TLSH
T1D76523824D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 018b08ad52daf69ed9423606adb097622ff51b7a3cd50e31afb3d21a51c257ba
MD5 d15d0eb654f53086a4c5a12a00c5b582
SHA1 289b8ce6e5b1871fb66d61b0ef590edcbaca9a29
SHA512 faf2af347fd87088f491a9af6dd67e90fff3aa23767f02e4dd6452c024402bdb90be931595d33afbb0ffb0d1329c6f9792d7bd9fbe34fd3886c6a722152c5c90
SSDEEP 24576:Hjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:ab5+Pl6bJTIZ5jdgpg
TLSH
T1576523864D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67D082BF134389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 43d91594e8dc6c86b2ba30e283442fb6fc24592593bb3726363284fcc2d2526a
MD5 f18550a58d322a1de4717b397537f77c
SHA1 2bf2d8e0243ccec56b3cf2bc8d620dd9bd98f7c2
SHA512 730e8df4b58bc206f485e81af198fa49bee51c4a9d9f7e50b2dd753fed36fb059e3f64c6656fde080fc732c9e8c33ab9192b3ac3c248820d3650e387d6d26585
SSDEEP 24576:e5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:Bb5+Pl6bJTIZ5jdgp7
TLSH
T1216523824D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D082BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 037775a4e04a67ae410e0c56a608ede43f5ae07a12c89acc3803b7677aec81c2
MD5 cf24030f22fe0500a3b9e907b278c8d9
SHA1 364735c06f2fb5b3bacf2d2c58f276e81ad94e62
SHA512 fe36ff1a25efa8434f88fd00d21541f321556dbf37113f83ce8d585e45d6fbeface05ee87af9dd881dfd6ac2beb8630b775c04ff45b1918293c92bed2e61929d
SSDEEP 24576:jimb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:Zb5+Pl6bJTIZ5jdgp3
TLSH
T1966523864D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67D082BF130789385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 98f6603dfeedc5cc365f7ea7f9be17bcd3cc6d9fa8ff273bb197e6d55fe52278
MD5 d863be80f23aaded85da60e79fb2094c
SHA1 1303514fbdeb8d9ce3022d48f8b0d914e2f83669
SHA512 a51652ff26f6bfc0f88679f8efbb0db59072bc2c699b5e670f35d55b8321b40686309abf4b106c6f69bbc6d1b3c3a48013be6b05906ebffdeeb7d9634ee933fe
SSDEEP 24576:35mb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:Eb5+Pl6bJTIZ5jdgpD
TLSH
T12A6523824D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D082BF130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 4b9474d9b3979516cf86fc5ee8788758b60e4e71d865b6885799152b1839d8bf
MD5 458d0ef7e72bd3d9fcd3c13fbe7117e1
SHA1 3418c4c48677e6ddf2c586db5323ff28d6cfed91
SHA512 aea3333454cd39e6105c9cb9d79805930a8a8e14369322b19bdb57a9518bc13fb50ed5e9b69f3b90f718825a3af33dadae10f3acbeaca48b0e6d7eeb984946c6
SSDEEP 24576:Vfwvhk9RX6wkyAI/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:CMnYI+b5+Pl6bJTIZ5jdgpj
TLSH
T16C95CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d7544a5303e038f5b7f6dda86e7ff299b115eaee8f1677481910c6c63e10c4b0
MD5 ae9d82f7fccd3fd73107384ee4bf5840
SHA1 8b7a39fdb96da5a25424dedd3145712a1d2a4bc6
SHA512 b45e7d97118df40a44bfc33cda7efa65ee6a5e4a2dc2ea89da9dd37e0eb8290beda69e233447612b4d79ce1751334e8e7f8921be39d538673a7671b5b3b5bd05
SSDEEP 49152:fYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hb5+Pl6bJTIZW:CySzPlslgJTIZ5Bgp
TLSH
T1E2066C96A16801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bcfc31e10a907431a79831a2c7ca291c6077116a2d450ea767d6dbd4b3e7fb35
MD5 071a491453854362aa81f1daf1ef1f34
SHA1 af655e702b834c5534f613cbc3fa0dd96b6fdd02
SHA512 b63b2cd45c867c1f80995bf35b7d99719b21529dcdf3d09bcae3fde6b8a1710bbaa6ceb0ee457038f2a96a2178f324704c219494436c2c2388d8078696385b97
SSDEEP 24576:d47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYAmb57GBiOl6a8JTth/RWZvR6wQQ92W:d47JUQjqirIhCnDHUPfF/Rb5+Pl6bJTS
TLSH
T1B365AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b14f62cc6b789955172fe1942f239fa96662a846f3cd1656b72783812c0938bd
MD5 a025320cd7628ad8a7b914f26a0bea02
SHA1 ce173d90f97e1b8b14723f582a6ce7105998cf8b
SHA512 e99002253454c71e3bc8144842345b8658ebbbfe37e22245fee5f6b34b96415dff38846228ee00a55244a4a690ddaba7b571a3c6c94acbe31d6e353f330db991
SSDEEP 24576:FLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:8b5+Pl6bJTIZ5jdgp6
TLSH
T11675F14AC29811D9D06E6279CB858A00F7377D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1004KB
SHA256 54ed2e25f598af56a1e12770fa8dcdfac898966071d7156eda5214ccbd0ba54b
MD5 f3b9b326bb4dc6c6600b6ad4f17e93d0
SHA1 eaca94f077aeb7865c99135a15b75d2bb1a2659b
SHA512 1e9a796f39b275969a02be26ae62ff5096e13c6dc8e7ab676b52c69bd0ec91a3361fdc620bd7847df82a126ab9768c9c1f2e04ba6fc3e4df1757510e0698f75d
SSDEEP 12288:HNcHzCU3ffoYUtVyFpxcJ15jKRueO8kO0xESqr:HNcHmUPg5nyA1NKRueJh0xE
TLSH
T1AB252850766AD75FC6AD40321E33D5CCAB707D01EE05AB0372C8872FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a80d4f8f41297e3d69d8d9e7d31c7b7aabbe09ddfe669077a18f01a69687e839
MD5 b68fcb78a0fea4bc4b4822215aeee1b2
SHA1 86673481a33fbf0ec3abf0cd4dcf86d0b20386da
SHA512 5a45cac8cd76c95836604083e2ca6ec36b6fc20c6af7153b75f3b04dc5dcedfae06fb078f0683045956b750a9cb54e7a227818f750a2c134ae74a1991df87184
SSDEEP 6144:71q1+5Ls0StuErmfJOHxXgCezSDq8Hqq0Am0XDKneVPMkIZNuR2+zyAI1XI1UkLR:71qZkSWFT1kiNutzyf1Yqk3AS6cbhVJ7
TLSH
T18B55C781913BE3DFD1F72032076A5B4DA764AC03B7056F6673C4453ED82AA66A0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2e23f42c52c1c516cabf703110d82b4953d03c8bb247615d7f5315b9708b82b0
MD5 43080b278b82afba89d0173fcf73b89d
SHA1 86c10f5dd7f92e57e89561f2fb23f13facc0133e
SHA512 32830807bdeb15d41a27c35ba747d7f89a2c98a480d4ca01f44f405518ff67e530171e03a8a885cb83e99bc0fbf490186e56e0f4ff578486bf8c285ba1c0b23e
SSDEEP 24576:Wzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:WKb5+Pl6bJTIZ5jdgpS
TLSH
T1B36522428B6A6086E4BB5738D8CDD710B83EBF65CF8566E7C569142AF1306C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fd15572161d46da7f066a9b8d6c07eca149d2877fcfbf2b7162b66c5e0048011
MD5 3e70876e757e5bb03aec3b7c30a7c3f5
SHA1 a2bddf35616f17172bd800eb7810ea48682e408d
SHA512 98b45781f27f62954b3358856c67964920b8b5dcf52c3334a71b8c7b7a63aff84ebef4e8011aadc0d507987f19a1df54c9299865782e7a66ea041ff536b15c6e
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:Cgb4mBIBhGF3b5+Pl6bJTIZ5jdgps
TLSH
T18E659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 bdc6bd15ef24beedb75b42b63c9525d8b3ff735e92e16b5adcb15275d8154233
MD5 13d029859e9cad0df1dba801cc7c59c9
SHA1 66c18e91c319e3138011d018eaeeee7d4d738598
SHA512 02ccc052e6a62c6deec5c877356150e0e0cf6b686dad75e1396f7332472fc58098d2534773a5ab9c3ade0c01f6a35764c3d6c95fe32bba89277d3b0b082f7525
SSDEEP 24576:HG88u8FpJqH1ozria7/mQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:m7ZFPqVXa7/Yb5+Pl6bJTIZ5jdgpN
TLSH
T1F795F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 0ee6be550b6edebe3c41b6b4f216b8d334a954de20f8f9e7b04375fd9a46157e
MD5 65c7f81b91b18e9eb9a2bfd70010f4b9
SHA1 4349388f35a4a623d44bce85bce0da80cf616f49
SHA512 4cea1679200b7163e3d5a1ba5ef4670aeb34f842ac03a441012778ff630d104cc520f0f0d3ccf653e09e7cfc7afa285b571df9ac2b5327b5c086fe050e08d468
SSDEEP 24576:iPUr+NQ8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3m:iJQLb5+Pl6bJTIZ5jdgpA
TLSH
T11F75E11F26AD18D5E67AA17DC9C68709F771B862471292DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 26af446e1f681a0a3faf167884fb3a5c507529ff9233c58af21d61bd8b2dc562
MD5 314599cf9390da75f8340fc4a6a894cf
SHA1 f310880de78bf2ae049ce8503157016ae3e28d6f
SHA512 5798267f0cb4f995c7dd446658f4f5562871f0097fbbc2b0c52a1cd80214d49d78196649f6e68b2b3e8b49700d0b45e71355a063892907be835af17f818d4082
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbb5+Pl6bJTIZ5jdgh:VG05lO43bcslgJTIZ5Bgp
TLSH
T11FD5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 29d9154ab0029d29317656dd5c83001761e407c220e71f7ce2a53148765bf54c
MD5 eab2eff5e25cecf591c03be9bcfe8ecc
SHA1 d3a07e42b5219762b911ca8d5ca44aa900ec5451
SHA512 32e98654cd0d0ccf2509f4ed1fe38b0e061e19265492305fd5cccdfa7f256ba857fd2d450507683e2c9443d64f205840633826a92a58572aac61e0416b736cee
SSDEEP 24576:Mfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn+mb57GBiOl6a8JTth/RWZvR6wQQB:Ua5POZ3lJt2pasx2+mTb5+Pl6bJTIZ5z
TLSH
T18B65AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2ba84efcc104779efafcb37f3a47fc2e84f61f0e85c12ba0e4dd152b746cf4b2
MD5 b39ff100ec442a9868caa51648031fba
SHA1 6398dd5537885ac9630287c31d83254d136ce394
SHA512 4c7a503cb435e9e7af8d1d831b33181831cd661f38fb0e94290a1183d80e60cda06708c003103054e23ae0f2755e8a5ccb2edc5efea780ddea81021b9715df0d
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7Fkomb57GBiOl6a8JTth/RWZvR6wQQ92pN36:lNc/zEOVHF4b5+Pl6bJTIZ5jdgpM
TLSH
T1BA858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 50b79a5a517f24c454ceeb748bb5883762b2951a0fd2fac48c805317f4fa1e2f
MD5 e818a5b8b70d62a7654843f0124e7de5
SHA1 69deb86da46433dc3ce335649732c7edbf8a638a
SHA512 370fcd9504865b2e89f4189e4145a4bfcd64370856431d6ec1a5106f7debea901d3c451def5c0962124c934c201054e20dfd3e2394a4720258194ca847260006
SSDEEP 24576:YzkNvNnaFeYhJNtmZBmimb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:YzMwBtOmtb5+Pl6bJTIZ5jdgp/
TLSH
T1E655AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e9c8dd12d66a339fa70cd78c68e67e94fd2f50f9eee97804ab00b58be67784f0
MD5 3260da11fc15925d43d9f6ded0716f66
SHA1 efc3a76b7e64193e296f05c374d1599d901e4a58
SHA512 84da28345df3832f41663a2d04deeae378df503c6afd0022071a13306af54cd2147b9f8e6f0b1e65b579046d5afce3a8756f402dd75463297dd97e36fb636390
SSDEEP 24576:ID3FHshBIYQgAXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:IDVHeBIAAWb5+Pl6bJTIZ5jdgpQ
TLSH
T1C685E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1556-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1556-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1556-366-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1556-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1556-105-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1740-365-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1740-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1740-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1740-114-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2056-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2056-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2056-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2056-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2548-49-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/2548-51-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2548-39-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/2548-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2548-45-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/2552-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2552-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2552-381-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2552-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2552-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2552-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3432-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3432-137-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3432-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3432-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3432-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3696-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3696-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3696-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3696-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4104-398-0x00000248DFC00000-0x00000248DFDCA000-memory.dmp

Download

memory/4104-378-0x00000248DFC00000-0x00000248DFDCA000-memory.dmp

Download

memory/4496-66-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4496-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4496-65-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4496-304-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4632-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4632-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4632-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4632-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4900-76-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4900-1-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/4900-9-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/4900-310-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/4900-7-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/4900-314-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4900-0-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/5940-77-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5940-78-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/5940-83-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/5940-308-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5980-54-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/5980-284-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5980-53-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5980-60-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download