28db5e4858df2975edee994494e3845cd8e51d15e1a6f3324e239e7c5b9c0209

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
Size 1.6MB
Sample260804-jlqabafe44
SHA256 28db5e4858df2975edee994494e3845cd8e51d15e1a6f3324e239e7c5b9c0209
MD5 3482bb3c65237ddf4270b63cff303c58
SHA1 207fc5662fe51a3cb090f2659ac0a1e861327626
SHA512 dcea4a6611c69ebc33414ec85db01114aa0ab5ae9c54490707c7668c48e7c038784c77958f68e31a1f8109a41f426031ac1c3577547005cd7544b1215a71a1b4
SSDEEP 24576:6HDvaM+Xmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:Iz+Wb5+Pl6bJTIZ5jdgpC
TLSH
T1FF75F103A26D7CDDD066C23589B58691EB31FC315B50A69F43F57B262E322C3BD2A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3080	elevation_service.exe
3264	elevation_service.exe
5116	maintenanceservice.exe
3512	OSE.EXE
5060	PerceptionSimulationService.exe
4140	perfhost.exe
1952	ReFsDedupSvc.exe
1356	SensorDataService.exe
1892	ssh-agent.exe
5364	AgentService.exe
5784	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9bd47c77e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000752bd69ae523dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013d08b5be523dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e7e145de523dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027ad5460e523dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d187c29ae523dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e37ec9ae523dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3080	elevation_service.exe
3080	elevation_service.exe
3080	elevation_service.exe
3080	elevation_service.exe
3080	elevation_service.exe
3080	elevation_service.exe
3080	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3692	2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	5364	AgentService.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: 33	5784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5784	SearchIndexer.exe
Token: SeDebugPrivilege	3080	elevation_service.exe
Token: SeDebugPrivilege	3264	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 6100	5784	SearchIndexer.exe	100
PID 5784 wrote to memory of 2424	5784	SearchIndexer.exe	101
PID 5784 wrote to memory of 1632	5784	SearchIndexer.exe	102
PID 5784 wrote to memory of 2028	5784	SearchIndexer.exe	103
PID 5784 wrote to memory of 4452	5784	SearchIndexer.exe	105
PID 5784 wrote to memory of 2536	5784	SearchIndexer.exe	106
PID 5784 wrote to memory of 3528	5784	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3482bb3c65237ddf4270b63cff303c58_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5116

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4140

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1356

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5364

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2812 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2812 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0dcd77f3419cd40d58ac2893e6fdd50bd98f021b35863849a6d940c85e88013f
MD5 fdf955cb076e6d57424136918d34ab48
SHA1 1fcee4422be40af9faaa1b17143b0fa00f9f468e
SHA512 7e7482922a0761704b394b8fa7c3caa9253cad668cdc5b7d29a1d418d85f9d620e7c815aecba1bc568eb9ee7bac0b8816da05904eddd3ba34d9c07d7347bfc3e
SSDEEP 49152:Sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrb5+Pl6bJTIZ5jdgpU:03q6mjB2slgJTIZ5Bgp
TLSH
T1F8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 cd79f0455b7c892b7e89adcc328e2688fd6de0a068d35941cb26ea2ef4106644
MD5 8eff7651b1617c57d71e8be959f2685c
SHA1 5f3374f95dede05cd1d8470b14ad032e1eec7658
SHA512 a1275f3e3fa7640576a2f22ce3bac3a599177f6aaf17f7593a5a637a978be3821a7db8f96ea1e87c7b94f2fd033dc682602051d6f2434dc86ffb03b559d85178
SSDEEP 24576:AXYfDtczAZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:3tcZb5+Pl6bJTIZ5jdgp1
TLSH
T14585F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 23df346aa4c5c95b9a3d085c92b1aef5f612b5b91717a83f14ff97929f879558
MD5 97455dbab2275b48a118ddebcec7bf00
SHA1 7f2846ec2f2647489c97119adc2edc3770b2b831
SHA512 858a03ed50dd1f732f9879cb93844b7facae6b87f45e35c4bcf89c08cf2be0f91419e3f72cea6a227a5d0a4edf034cb9701cc69af9aa0d0aa5e34331a5a5e58f
SSDEEP 24576:U0Le5ji0hmxyrMUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:UPji0AIub5+Pl6bJTIZ5jdgpR
TLSH
T1CE95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2548d09f806b1de4e9c34d4902ba84321d2e9ade47de23a01a4f22a677325094
MD5 b2ca19c514a32ae8d4103ec0deb2c147
SHA1 371e331482fdd23fa28f9634f6d7d887c513d5c8
SHA512 4503b6f3c9bcf41735947f4afdd2e20593012920457aeb64bd609525e8db70510a2d0db44fbf13d426c298dab88a61538ba9410cca280f71e125869d1e529a1c
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWj6q8wyummb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:0/ezSC6vUzPv+Hjy6b5+Pl6bJTIZ5jd5
TLSH
T13C756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 75dc6d22adc296036a1d4197398b06841ab024d3137947310fed1ea3510366cb
MD5 85f60e5de68995df31a2454fc8817722
SHA1 75098ce85c4c450eb990ec2dd268714791ac2b56
SHA512 5c30846c14ad9f077e6483ea655c394feb07f809c5ead972deedd1ec76b927858990608c1abc814b1c41a22efdc145b9eda323abe9dccf717dd9a826e53cdbad
SSDEEP 24576:ZVbqPb88hv/l+Blmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:ZVO88hXl+Ob5+Pl6bJTIZ5jdgp/
TLSH
T1A7559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 307da10a4c392c537929f40c832c5a2a29b65ba9e46b4317303c8a001f35d3a5
MD5 a2783607fa2284a9f93e5fc9b31427ca
SHA1 e3e8fbeeb1fa2c98fc4d37780933686bcb27d907
SHA512 7371b3df775140f05be09199f54bcf15831ebf99c746993131ad55ade547862b8436dd0f8e14325dc64070550f55c0ba076dc6059a127ffd7f4136dd66ca52b4
SSDEEP 24576:bFgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:tb5+Pl6bJTIZ5jdgpe
TLSH
T17A6523834B6930C5E5AB1739D9CDDB00F879EF55CD866BB6C579282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 97a8c886b4dcfaed8e71983b10c31e01db7aefa2e14455f2b503342a19e8a215
MD5 72fa98ce783c457e9ea47af18214cf06
SHA1 2a7619e861ceb8e82356dcae1ab5468bb4d14ec0
SHA512 46f8574d8285b3ba0332f92b5c33d38ae3a1b295101fc881a8e7dea3eff3fd7192607fb0c13c7d0528d7d238b24357dae388e0334f9feed8ad1427f2cbd7a1b6
SSDEEP 24576:aJIU9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Rm:aJIUAb5+Pl6bJTIZ5jdgpPm
TLSH
T1A685CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d8b5c24eb40797280ae13ca3fb1f33ccb865a4d994057b0e5e2f6ffcde7d1f6c
MD5 84075362ea6c09c91443eb8ab73f3220
SHA1 8716c944901ea22f5bd7161819fddd2ec67518a4
SHA512 1518aa37329e7b584a98a6bcdec8e9065f2d3be3028a3ad650782e79a40b56974ac40d455587abb909226ad7b354f779296e95ce367a58adcd999b019559f9d0
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THg:bQvGAdlCEL8c/WRNw5ClslgJTIZ5Bgp
TLSH
T172266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 c0ae83662c47da75524e4883291dbfc71d2733a74cdf2cf1ccce736f53b5e408
MD5 4a9e792a67f694180ab0a3c5df122d90
SHA1 99e80be2a1e1d6e091452e85ce582804aac410ec
SHA512 e3450b254984fdd6dffe07e6756c789bc8f316e80b8d80a7e775d0acc70e60915388db0c4b4fecbd7a3dae83a0f362128a5c5488cddcced8833b52ded27c9ca3
SSDEEP 24576:rOewsAj/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:Slj+b5+Pl6bJTIZ5jdgp3
TLSH
T13685E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d9d77503c4f712f2188148fc2862bc9ee280459b4de6e77db32c144942dc3a7f
MD5 1f6fb366bac8efc85e3a780c3a997a41
SHA1 1f2697be008a6bb1f63adfa0808a2131183f83d1
SHA512 04f620fd07fefac6732bda6d1f1fd1d305353587c75ee53b1bce893637dddd891e1eb857938962180839e0cac5ffe857c3927b629f69cd13dad3eb03a9d1149e
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH8sT6p:EUEtQevvqc2W1cpV20I328s
TLSH
T152474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 47a6b24f6816084eb46a8c7014acbe42de907c45ba77024333d62115f0dfcaa6
MD5 52422146c8970a62ccb28e50ef764305
SHA1 27edec69bbfcc2ec9e7d0dc6ecf090da71405c1f
SHA512 7ad2874e1592a9735f44a2dec9a6e961e2788aba29c0446da7c2e9fc976684b63c2bb285ee02ad5b99f259bce6c3c8eb0731239d336f3697d5f0cb8d1829cf22
SSDEEP 49152:7CbRquA/m2yL5zQfFiV+XenmE3/zeb5+Pl6bJTIZ5jdgpV:koqtVjnmRslgJTIZ5Bgp
TLSH
T1CED58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cc03b419d81e6fbd01cecd70a0c984b2e130d84be392704466a96773734e46fb
MD5 6fa03115e3d98340c2e6f424d5d3bd91
SHA1 48bebb0522898a10a44acbdfcdd20368ebd3108c
SHA512 3fa1f752daf968fde909a916f9842cb9760d21fc4cd9b240537674b96b9209d74f0583ef9dce50307051a4562766c7f3166e707fb3c9fe4d7940bd2cc1165aa5
SSDEEP 24576:YAhGL6IFoiwtA5l7S53qmb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:YAM5Foiq5Fb5+Pl6bJTIZ5jdgpM
TLSH
T107359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 9f85193f8631a73f7a9db0442830207e98c590ecec163ff3eb22a7263448b87e
MD5 50a41c387aba60752604c1e668088972
SHA1 3e3c9b4f730a27376e0fdf445a347bbb5e37011d
SHA512 cd907e4a238add7b09097b42ff4c0482cae51df7ea8518d0f38934f2533c3db960c0df8d0051595236d4f20e05bd018436a9a7982641b2722812dd0af2cc8d16
SSDEEP 24576:wwuGOWDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:wwNOBb5+Pl6bJTIZ5jdgpi
TLSH
T1B075F14666A51CF9E5A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 44afd7e884f368eb3b3aa08ce30eca0abd0dfaf953f6480ca426bfc08211dd2e
MD5 c7de4d71bdbc945803c469908028ac5d
SHA1 fbc66ac72a1d3c40352a30fa81507cff1fbe9ff0
SHA512 3f3b09b981e33ce937d852c0c70418c1fd73f6bf6ed373c1d79221428e78052f23365f0744982cadb400cffbb53d8d2f5d2cc31ac294c5dc1dd432ba76c2f1eb
SSDEEP 24576:mZusmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:3b5+Pl6bJTIZ5jdgpE
TLSH
T18A65128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f3a83c4e77dae54495ee19fee279c9dd087649b544cf0195f888fab9442ddb54
MD5 06e13c3aad67310ae6855c03303e6b04
SHA1 a39b3388111dc5e4c7853507611a7cd335a3c1a6
SHA512 761fcf7b5206f3e9dcf1fb9803bd57dae571f76f57cd976731221d0a2d3e29c7e020986a8c030f1433fc44a15a4427c8d826a421534738ed72a4ca50b190a61a
SSDEEP 98304:eQRQyi36YOcPDLvw2gAf+PN3KslgJTIZ5Bgp:FQyiKanX+PNasT6p
TLSH
T12F666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 de6b4f8edb9359016c5688925184590fa8d82e183dc0f7a1eca9db2183abc112
MD5 86a2abd5bbd1a89b0fe6bb1d4d9bbfe0
SHA1 ae1b2b457fe0f90fc8d2c42dc380fe4351f46774
SHA512 0eb17b1cb2118e8da3c37d7d237c6a0af94897173cf576b0e8b3ac7471c959febef505ade7df128ca76cafb80c5e35de042319a269a65c9e583a3927f094d9d8
SSDEEP 98304:wQRQyi36YOcPDLvw2gAf+PN3KslgJTIZ5Bgp:nQyiKanX+PNasT6p
TLSH
T139666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 241c42148f4a266d7d78cabbc4ac8da9dce6a986a411048772ee1b9ae78db3f1
MD5 2d7c80b34ff1d1a3dfe59c97141e0e10
SHA1 43aacc3f9278c3427e9fa255ca7a9d951789fa3a
SHA512 e0b4868b3fc01b9bfc14a98fc6e4b33e6e7bcaa8f43f518d2a2a764f40fe6069bbb1aaa99d78996ea5a29d309d5c40ac4834bd3eb3c498ccbbc288da63d929fc
SSDEEP 49152:O68Qg55nhkeWu7PNU3/ub5+Pl6bJTIZ5jdgpg:cthTRc/UslgJTIZ5Bgp
TLSH
T16CB55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e9d096be3c1acdf198811d70ee93ff74b6a7b017cc8f7b2fc93cee3e25cb783b
MD5 787fc96458ba3b1b937e40c40fe7107f
SHA1 72dfc5fe94262583e29d238b4b3323d053af3c21
SHA512 7c024e3b138b1af1693c0772dccc024621fea1813b62a2a76a138551f708ab19446105c9429c0fbe056ee989b0e91eaca864ce7e523adfab7d8238ded95703a2
SSDEEP 98304:qy5112gYy5azzVvU69nLKnhZrslgJTIZ5Bgp:TLIHRWhJsT6p
TLSH
T1EB167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a73813ac497656977f40bc722010df165588af5b438dd2b3599b541551da0bf7
MD5 bbf3d7a82122182838b300890f044afb
SHA1 9fb1bcb17006fe3b547a6008cc3c72b02b930eef
SHA512 5128d740d2712e68eb831c96f8ae93305717e13d92d2cff609459ec298f758e9e3dd129b894f254b58b3676b2c9e75d72fa2d3774b2c35a6df2e9c34d12e2fa5
SSDEEP 49152:5B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glEb5+Pl6bJTIZ5jdgp/:vu6JmIxd2dSslgJTIZ5Bgp
TLSH
T114D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 39483b7be62c40f868e75c44f680efbb10b88f5db8fbecb0078371c3e581790a
MD5 123bb3e031dee621f419270dc9550753
SHA1 d37c2e88c9a0485b43860db80262af086a548e72
SHA512 ff93927e8a250d712a46c1fe8527fa4607d0b7976b25e8bb03be8baf4d35881eaa2b26bdff6f3f507318b0b4b8b436a78e2550dc42acfecfaccc8799630b5fae
SSDEEP 49152:P1hpsNoJpF1A67U44CwH7R4xgb5+Pl6bJTIZ5jdgpj:PmifPqRRslgJTIZ5Bgp
TLSH
T183B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e598f98e2c6fee7509e4c9071393a6aac6ee40675e25c384efc185f7beaf978a
MD5 75fb943a98c8a7fe803937514f3eb73f
SHA1 33a97f450bca976383e3350dd263e4d6decb61a1
SHA512 66f23ac35ee3f348ba13c23de51da6916f8b2d29cd53f4f41b0c030b4c92276921cf978165835819e675a4dfaac2b46ab39e7cf30bb49e5b5021bd186e15ad37
SSDEEP 49152:tSuZQIY0Be2KkRVtOnks6NMHq7b5+Pl6bJTIZ5jdgpc:j5dKqi61PslgJTIZ5Bgp
TLSH
T1DDC5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 81145c5be09967b53c0f359aaa11bc0f1262b524025380d844072306b0d962b1
MD5 c8cf17b0c9e54bb3087bd26ee24a4886
SHA1 c6dd4e305e30e02045d6eefca5e344d01a290f6c
SHA512 8fc38665152f98d53b771ab51d2e53483e7384c30730691364bc0f2774800e4ab046cb45ca60cc920cb37bfcb50f49c7f297f89837e8913878e0f996d2230996
SSDEEP 49152:khtSn8EApI0figjgiDn0AP5wUb5+Pl6bJTIZ5jdgpb:lX2iWph9slgJTIZ5Bgp
TLSH
T16695BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ad469482497fb4602a557e0abbaaf265c190fd681011b638ec6d1d485e95f915
MD5 fad18d67c1a93f32ee17b2ea2f5943b7
SHA1 1c5e7a3cb40c496ba4d63bc16dfa0e0a09bde310
SHA512 8d84411b6e4ea844a47b92aa8334553bf9fc42703ab47e9c89bcb786fdfe0fd4c5ebe52302f7a42eab3e960c713e3508d4a7c2dcce2fad251445acb54db2ca4a
SSDEEP 24576:t4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:tb5+Pl6bJTIZ5jdgpH
TLSH
T1296523864E6B20CAE09B5779D9C9DB00F87DAF56DE8727B6C67D0427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ef100a8912145786374c07b1711c394c47042dc44f4cc598fe2782e3f9650c08
MD5 c71819b41b2b7143af70a7a5d3aa5c7f
SHA1 f2fc9b27ce84d7c3e4e419bfb8a0b1e80edc1181
SHA512 873101c549427784562f9e2b99c18d1fbfd1055a6e1b68451a62d1d5814ae0114898e978a9a52408917c0679f78b8d9f32b50d9b58d77dce00da68a5b1e14d0b
SSDEEP 24576:/rmb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:6b5+Pl6bJTIZ5jdgpH
TLSH
T10D6523828E6B20C6E05B5779D9C9DB00F87DAF57DE8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a897f3cfb7651dfa1f31fcc92cb4eab52a4361b21408d35c3f698f6fc4acfed7
MD5 96a811d35ea236fac87e16d8b011349f
SHA1 ae17b6d76a4e63803a01f6c1ebf629f9f7701d73
SHA512 e62259bea5e570b3340fd5c48798168b5db5eef737bbcd87de8a7e2b67b9c6640d4a46af595d685b06b4314b0965a4031a30e0d010a36a7b31b22982efa3cbd7
SSDEEP 24576:cVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:lb5+Pl6bJTIZ5jdgpC
TLSH
T1806523824E6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 b0e7cc048b8cdc0cbf0f4a6a186bd12e501aec286d244639977b0a897ac32cdf
MD5 b51c6b9713e682f5db7c481d56cbaf05
SHA1 3a631ba6b8d27c6537cc2d0768ef65c5dec77ac9
SHA512 8e04a0f0acf81907e8ec104218978817b65c23bde881e7829b19b8bd3dbf68822d64a07d2f573733cbc363f666ba19604fb8edb8f690f3931bafb74c0ea77530
SSDEEP 24576:1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:4b5+Pl6bJTIZ5jdgpZ
TLSH
T1BC6523424B6A20C5E4A79379C9D5D700F4B9BE96DF5267FFC675082BAA313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9458aa21bad47a08ddb3038a6e225afc37e2cf9fc08c5be9c3b177eb0f57335f
MD5 a5927b63f19567f115d27f44bbc86bd4
SHA1 6c60033be4b4189c47aa5a367616e5538ad7e7b2
SHA512 f621280b7b101d2fa98dc8b45cfdcf10ab05c52701af2345466040f495345d9412746d1b5663ce4543933fd8ad7792ed63d072e12d1da233bc82bfeb8ba6c3d9
SSDEEP 24576:aymb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:Ib5+Pl6bJTIZ5jdgp0
TLSH
T14B6523824E6B20C6E09B5779D9C9DB00F87DAF57DD8727B6C67D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 644a23cdd91bb990a8304f81b4c230ab27df01756047aec5e3290977a38d40ba
MD5 91aa568cdf1535055be720193315a1f0
SHA1 94a75776010dc8fcb3964ca8f269cd73b168ae67
SHA512 1d2045d459c2719c1e36e6f60b1e0e467a3fb9ca6271ddc6f9e92038989f8664977150c56ea57586fd992570298eb6483224ea5534bb57db08eee534e03f1424
SSDEEP 24576:rXmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:ab5+Pl6bJTIZ5jdgp0
TLSH
T1636523824E6B20CAE05B5779D9C9DB00F87DAF56DE8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 4401766fcb634bc7ae11f1fc25806133ee4480e35a950db977ce9d72c66328b7
MD5 6ef1a0f1400bd545e09c9a664a3f4abf
SHA1 054460108a4d4f2b72d738bdc6106a258ffcb123
SHA512 9c15cd7830c8d21268194439c5751ab86ca3d45e336d0760ad8d5f181a460070b7e3f79d1fb5917302dcb818aed52dbf9ee348c7b951cd35d0e3b80249ccf703
SSDEEP 24576:Uzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3d:vb5+Pl6bJTIZ5jdgpv
TLSH
T1E66523868E6B20C6E05B5779D9C9DB00F87DBF97DD8627B6C67D0827F130389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 46d1cbddcfa3e57ee30f37a935deea201465c22b2141f73ffe41e7f8a1c407b1
MD5 a6a05dbb310464a1b38785f6365771bc
SHA1 8cb841a87a4a65a4bdcade26087088532397c44e
SHA512 ad5d0a73f45a097eacf0f72f27b17b4ca5ebd7d91116601f2b3088f29fe587a1583f63ff15c8f1141cea080b85749bfd4c3c45586007a577ee82aa8e46fd32cb
SSDEEP 24576:vZMazFVSOLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:vZMazfmb5+Pl6bJTIZ5jdgp1
TLSH
T1BF85F295B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 78fe6fabb33f48bc1e4be7704dbd1bad3dd3a405d4d24648f3c53816133cab7a
MD5 acdbd91323f67183d0c21a16e5d6b18c
SHA1 510d23e372b472286a37b3aadd1b99a0cee9e35c
SHA512 6f1d558a104d7404f399dc9af71ae314f648a0eef96e54dde817dbc50954b580b7e7a9bda97f5b3d1e0d5b45fb66021e632b5badb716e60d41ff62b3cd6f481a
SSDEEP 24576:a8mb57GBiOl6a8JTth/RWZvR6wQQ92pN34:Cb5+Pl6bJTIZ5jdgpe
TLSH
T16A6523864A6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c38cf63a538323cb9255ca156d18afbc52598be784e87e95a385bab74d1e1502
MD5 26bb6dc9e112f1be3c07b24ac6fc5365
SHA1 df6066a9c1ad690de902dc85b5ac8c2e1344f0c3
SHA512 c86cefc92adbd6c293b68cc7637343318a3cae48e0a2201758076bd160447a9a8c74a4344c0600a47e70e4fc9bfafd980ef0f05285a4439b103780a6828cf267
SSDEEP 24576:awmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:ib5+Pl6bJTIZ5jdgpv
TLSH
T18B6523874A6B20C6E05B5779D9C9DB00F87DAF57DD8727B6CA7D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5298f94709a6e75b4968d31c47cc051a6297bb9a982f1df6dc00e53854b84d5e
MD5 aac3b7c5d42f72a6438e12def4974104
SHA1 a09d280328e16372fe50dc1f659e26c83c5c54c5
SHA512 5c09e146edaa1267ac8a6e0a47d10953179528293b47293af876e5be4ba187ee5743cea7eb39f53f7657c69730f876512e7c3b7664e54955583f9fdf3cb71c3b
SSDEEP 24576:7zyPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:7hb5+Pl6bJTIZ5jdgpR
TLSH
T1E675024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 27802115914bb9fcd8a7701d20c175cff7024ed48e42dbd465676dac38557487
MD5 c198cbf166446c637077232da7fc4ec8
SHA1 a4df6d85c0d847731a64192b17a4e0a9a402331a
SHA512 997005695189e6e1055c1cc8c613d376b60f66cc23a226fde0be8d3859654ea4ed824ef09cd5c8eaa274e8f2391891d10ea1e4225bac4881c7b3612abafa8ce2
SSDEEP 24576:S8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:Kb5+Pl6bJTIZ5jdgp4
TLSH
T1E06523874A6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 6ea2125790a41b00c92a5c52b0ae9180744143ab05aa1edc9bfe896fe9ea6e94
MD5 ccfed3fd71e11e4e95488eea82a2b1a8
SHA1 5527ea1a28dba7f0c401d7f9d2099a17eb083def
SHA512 067fc10aecbe6a045fe19b727f7a239279f5c5ba2d696e460e15697c8681af812e752a936ae3cae45feb8dd2e09452bfadbdfaaf197b1ef03f19913f907214a7
SSDEEP 24576:58mb57GBiOl6a8JTth/RWZvR6wQQ92pN36:hb5+Pl6bJTIZ5jdgpI
TLSH
T1946523864A6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f43d2f28406a399168c230e2ae673029e25f312f2b793b4ddc126b2d0eac35d2
MD5 0cde8c2146b73fd1c9eec1d57c78911a
SHA1 08cb98a5b5641df1ff24646e057b7decf4ca749f
SHA512 bfe423631eeab56993be2230d6862c4da9b9a7ec28ce22376736f0783387f638efc0202a86c50725920fdebc9d48401c89bd8fabbc86d381aa78310040761b83
SSDEEP 24576:wzyPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:whb5+Pl6bJTIZ5jdgp+
TLSH
T13B75024767A630F9D0678239C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 323a890011a5e5f0457bfd90e84d1b6fab80373dd2b8130d7cfb637c7647dbe0
MD5 8fe0e3caa030c97403bf102a6eeab8dd
SHA1 68b4810b6939cf2da5eeec400f30d6b4baab72a4
SHA512 f057798dd50c8221d46ea864345538d23a1cb413e33d065923e6e37dbd49aac9873162ffc5d0047e816dd51d9abc7d281efc49894d70a9a3992dd39da6b3e24a
SSDEEP 24576:HT/aLl3z0zDFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:HTiLljpb5+Pl6bJTIZ5jdgpE
TLSH
T15D850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 3ac4d8c9f5f2269cdff36f6a336930a71655c4270d4cb3b3b71578467ecbcde9
MD5 4fe07a75f08c70d137f094b9fe582e22
SHA1 361051258f39784650d1305e58f3d03b4e1119c3
SHA512 dc345b588e5569bcfe45db6e83659d148b2caaea988f1f9aaf371c7dc239e4db559f5b6d7bf72e859829185f7b0d053ddf3672d021c00e94ac29d728060107d4
SSDEEP 24576:L3Ud9CHKy7GZxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:rUd9CHKyamb5+Pl6bJTIZ5jdgpB
TLSH
T1BD95CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 af30c50e31d20de78bfdbe5519d484de30b27a097ebb0fe4bb5538456593ccff
MD5 cec44f5b2abf9602c180a57864bb262e
SHA1 e45f633339eec87f2398702949771f9973fd4f2e
SHA512 c9d7cef0b44991c2fe1b9b319a73d4b1f74a16821e9fb9a1e152c4a0e85d03c5441be7ecb45b281f4b439dd1f2ea4d16edb5a4dc37522c0d385671404ad5f8ff
SSDEEP 24576:j1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:0b5+Pl6bJTIZ5jdgpG
TLSH
T10E6523428E6B20C6E05B5779D9C9DB00F87DAF97DD8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 4cf618bd3a522d4a4cd579cfd7bc339e3bb207b56da0d0003ff363d3ff5bc9ed
MD5 40d804092e6f137e097fe8dcff195918
SHA1 8fd6febd14c592e8ac9061a4aea2eb7b8031c2b7
SHA512 a1ab125fe939a855a4ca8e85f26192c1f5015acb0ab91c04afde4e4065c5ea8f73a9bd446a6531499006ea6996a907685ab9e46962cc04a0ee7330c23616e4ed
SSDEEP 24576:6vmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:xb5+Pl6bJTIZ5jdgpa
TLSH
T1106523824E6B20CAE05B5779D9C9DB00F87DBF56DD8727B6C67D0827F134789381220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3dbd40a88e050a24427c2dc74c7ce0edd12a7deb7b988807216b2fd0f528b113
MD5 8f87a211777287e5e2abd498ad6471ed
SHA1 840f405c94c5fb2ed8ad46dba178c3af7ef31a45
SHA512 f5519707dbff775ffcf20ba551b98aab2cda655183456cc7b3286bc89004e953cd0315633fca22547ba797c1f9ffe96a9acc7413d6fbfed6dd2ccabaa11fe7ca
SSDEEP 24576:COmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:Mb5+Pl6bJTIZ5jdgpy
TLSH
T1B7652382496B20C6E09B5739D9C9DB00F87DAF97DD8727B6C57D082BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 3a58450f5d045b60ad151db48b40a3ec5c2edf37526d86efd88466ae5e086335
MD5 50b0d830bfad82b1f37987e26070377a
SHA1 f2ddf783ac8b45d31aabdddc18b4c877d848789a
SHA512 5ab3ad57ab0a990c62db5c25be160360d0db9e8a45286d12cf52583d07d79be21301a4965605299f33d49bfd595aa46f0954e16b8a5f37a25df847c70e6cb518
SSDEEP 24576:V8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:1b5+Pl6bJTIZ5jdgpy
TLSH
T1726523864A6B20C6E05B5779D9C9DB00F87DAF57DD8727B6C57D082BF134389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 dcde65637d372bb152a76c83d962fffcc94bd25a671db8183d706ef02f18e32a
MD5 deaa6f2a5c2a0c34beadfec181640b73
SHA1 ad5e6522627f1d32225c20e5bdb2324bb80b2878
SHA512 dc92b9abbc5311880a72fd790aed0415c34dae4c07d2fe8a4452a8d51cf8df44bccb3e4bfb4f93310b562067449fa09c1c89eb193f784943566d09f0f6464da1
SSDEEP 24576:P1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:gb5+Pl6bJTIZ5jdgpV
TLSH
T1F86523824E6B20C6E05B5779D9C9DB00F87DAF57DD8627B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 9949664c5da11417b5db73e1e8e0ff18ba4c89f338e3759c2d1c01c4223ebf4a
MD5 6bb5096eec571fd357cf6b787ddf2ab5
SHA1 7933da5198b782913c527a309025b131fc88ac5d
SHA512 279522e7f2f70f8405591b867deef86a62ccde648157835324ca426ad2c0ebe84099ad7fe5d76e1ea04a9b920257d7feedf98477e0bea0238e00d3d5bbd460fc
SSDEEP 24576:ZEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:Jb5+Pl6bJTIZ5jdgpm
TLSH
T13F6523464E6B20CAE05B5779D9C9DB00F87DAF56DD8727B6C67D082BF134389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 66117550568258a297c66d7df2c27425a3baff1205aa1191042f380458d37677
MD5 8a702de272d01890ba4fdbfa41c75ca9
SHA1 5cfc5f5d2b6221c94ac831193b3defcbbf59dd31
SHA512 bbd19d42415660bcada588e5aebfdb0afdb5efdf807aa9c44cf415aa0f27c66a83d9d2dc661f76e0a9cbe1aec5c56c2fe0c7d0f48312a4a02b72ca20b36a2670
SSDEEP 24576:Aymb57GBiOl6a8JTth/RWZvR6wQQ92pN39:Kb5+Pl6bJTIZ5jdgp/
TLSH
T17A6523824E6B20C6E09B5779D9C9DB00F87DAF57DD8727B6C67D0827F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 145fb9158a3a9f2de78df8a2afad0d27a7ab47554ae5a6e8b75eab673917ccfe
MD5 266919086d88885df41d467dcfb2bbb9
SHA1 6632b40f51c53e6c7108e495e072a233ba11929d
SHA512 d86c39b17dd8821ff454d79e3b9861af3fd8fc9ded606d8b65da5616e106c6d8314c4bf647b8b9dc58fb0ea1fd220858d6907750f5b1dfd8533a0e225da0bc1b
SSDEEP 24576:ZNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:6b5+Pl6bJTIZ5jdgpe
TLSH
T1C36523464E6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67D082BF134389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 2461addcbfcf695d779e252ca4793a55fcff3e5a2d27d7f60517a8a431a55acc
MD5 27c3b154589d0d1594a2055312529a1a
SHA1 a660b1f886fa51e792424ecbfae649ffe1992c22
SHA512 a44a98a5f5b2f5de1121a2814a8562d2061cc896fcf33c34b848c1cea5a7afac471080b23fbb424797d4232a379e5eae0c941d76ad19ca0932eca4b6c24aadca
SSDEEP 24576:4ymb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:ib5+Pl6bJTIZ5jdgpq
TLSH
T1286523828E6B20C6E05B5779D9C9DB00F87DAF57DE8627B6C67D0827F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f94bebd94f3a31aee207e4d461beefb10c673745c1b9d00f5074c7d8a3f33343
MD5 f34ad06b5661a84247a86a62fe6aa968
SHA1 977f80a869a89c8400bb4a85cce9b2d65a393abd
SHA512 792f6b5418242009e271e722e02dda210be69572fe41fb3f5fd2e235cd308a398eed2d0b943bd20e20b5115860025c255cbb4156dfb57ec1d0edc1521acb57d0
SSDEEP 24576:jfwvhk9RX6wkyAIAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:wMnYI3b5+Pl6bJTIZ5jdgpj
TLSH
T1DC95CF29EBDC04D5E0B7923C89E7460AF6B178595B31C6CF02AA536E0E33ED46D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 02bf8f902b3e16063b27a1ccb1b0cb8d3f68185368285ac8f13592aeee19d050
MD5 9bd934f9389375bfb10aa256e2ffb04a
SHA1 c54418265d49e9a32bb0bf62849c3d6e432108f6
SHA512 76d66f301c9afeb38c64e25cb34a8a966d595c765eefd5881a954a2b58c12e5d06590b0176fe81c82ff04d07b20431d91f0a840f47b62ff2dd4ea63dc96214d1
SSDEEP 49152:rYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00b5+Pl6bJTIZx:2ySzPqslgJTIZ5Bgp
TLSH
T1DA066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8f2ed0509366131376da40f9d0dbbd58676a352d01658c89d45ddcfb7ac601b0
MD5 daea8dc854bf28e12a787cb2c189e029
SHA1 657f9bc545114e4556e079220eaad2fdcdaf3cfc
SHA512 c93edbadb9b976a6a216ff37a5e7ea6199a334e49b4c376f55c0290531afe35d48e96d30cc09a02c90159aed451771735368d1a22a341cab28d92a689cf63212
SSDEEP 24576:y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYbmb57GBiOl6a8JTth/RWZvR6wQQ928:y47JUQjqirIhCnDHUPfF/Eb5+Pl6bJTY
TLSH
T1C365AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 1a8f3647f5ce23e76547cfebddd1c2b26a5eecf6ce35bbde6125043d01e1be02
MD5 b15e17259027bf971a12ee3162d19409
SHA1 2bfbb6f402725f206ebb815dac8a3c07c1a073b0
SHA512 b745237e7150e78083a341b7599954073f3c3f0ba230d15eae021f91b1cc3825fe66f079da261fd9c4a5eb44ae6f30072f1e7b331c55267a39c239d4baceaf0c
SSDEEP 24576:0smb57GBiOl6a8JTth/RWZvR6wQQ92pN38:gb5+Pl6bJTIZ5jdgpS
TLSH
T19075F14AC29811D8D06E6279CB858A00F7777D65CBE193DB86E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 964c9a8999b96934d8ec5872f1879c84cd951860f8a7c4ec708ef89e4a047d15
MD5 7cb752d9c21152ef484432e3039af560
SHA1 366db8565285cc05bb3bf6a88e983361aafcc752
SHA512 5a317a3cece520c0fdefc6f3dd5c2e1de4be98bb9f30b9be5411db6c07fdcb6fd893c011918a8c27817230dacf0140f396ceb86de1cc72fdcc90e42a74b38978
SSDEEP 12288:NLJdCU3fvPXbX+2V4xL8dNypfOQrYEILEKKXBSHwQzd823f:NLJUUPXZOxg6fVrYzLHKXBSHBB823f
TLSH
T11F451740762AD69FC6A940325E36D6CCA7707D11FE046F1373C8873F9476A68BAF6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4cc33f4923ce9cde1ca67c5c42dda5480229e58408636c6147f0d74eea794095
MD5 7466352975f7a5bae1989a54a3f44174
SHA1 90fde997bf69630da04ed05a9c1f0e94ada80496
SHA512 2e86e3f6e274fa8c4bfb7173f28be0d2f0e2f63e9e8056ff77eb2a9eb5e4b1b73a5265859160fbaf3327fd0614d200ed620ea7b320ee07a26bffdaf64a0f3cc0
SSDEEP 12288:mGpW/D7OTOonkTqldun7YLM6KRh0Wzk0QLMECM/nh1:mGpuFTqTKMgEKtK51
TLSH
T145552A41A5ABE35FC9FE50370632C68DAB745C12BB453B0173448A3C9877A7EB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 13e6f99a5ddabfb008f5c9fae371542d7d6e781b321d9a2f9df2a11651afcba2
MD5 8fb34acf6989f6dd56ec08c275cda506
SHA1 2eac933f518b02c09f3c4fc6d33c53a91340ed47
SHA512 9ac0ff52db08997a81feb11cb291bb2139c613ae3cce939f9128fa6113f453ab39158df3a35f2fa9753e1548fd2e5abe6386bb2b2ddab7a5a2bc7be94a12e380
SSDEEP 24576:Z0mb57GBiOl6a8JTth/RWZvR6wQQ92pN32:ZDb5+Pl6bJTIZ5jdgp8
TLSH
T12A6522428B6E6086E0AB5779D8CDD710B83EBF65CF8566E7C529142AF1306C87C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8465ad8ce9684bd517685d7b953f64013074124e9306700e358eecb9ccd5b7a7
MD5 45d037db821fd585ef1b09ebc5441712
SHA1 b9947604abb050284d1df5e7b9fdb72a2cc6b438
SHA512 adcdd35f9cb1aaa6646d87381bb0ade941eaa85a95448b41319c7a323371a124557cac66ddef8929fe56a1def40a50cee7ec211f04f574c2182e1a034e271b18
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:lgb4mBIBhGFSb5+Pl6bJTIZ5jdgpx
TLSH
T1CA659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 121b223a30d9e846e5204e7c551d5f2d7f201d6b1c46e583bd34def3129f6296
MD5 a9422b9a5ace957ed617e8a68b78aef3
SHA1 ed29436bca9e356f8935c44de832671598f249a1
SHA512 c93f1278430d4a40549daffb3db39a6809e649e9013675c93876adaed2545cc028e3933d9fd2e6d8e4916a9e97fe3f49ce8e11de1dc726eb370cf681bc4d1856
SSDEEP 24576:zG88u8FpJqH1ozria7/mLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:C7ZFPqVXa7/Rb5+Pl6bJTIZ5jdgpT
TLSH
T1DF95F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3e154ff974ac52bd39ea2f79c4ff626f17d92e7808e45cb553f99b6344304629
MD5 d261f97e66b6e32842ae7e425041b65c
SHA1 32e0caa8563995fdc70315c238185f109d3adb6d
SHA512 92f4b1b10a173de41b92be9a41439722be425504e54a245c7f42ba1d448dd107f5852cca0ac392662230025247aeef7153537e3db559489d3c448e3e4a43115d
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWb5+Pl6bJTIZ5jdg6:pG05lO43bDslgJTIZ5Bgp
TLSH
T1B8D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3eaf727105c0fa8370aa0874a1764ecbc86bd627a4264bcc9e2dc655e6ed9fd0
MD5 e2bfaa57c34624bdcd550f38720bc09e
SHA1 2d3b9404d7e9ce00163d9727824ca9b8bacbc5a2
SHA512 4eff16ab15d379d4232cbee76fe95200e0a8894a5239c2a27b475099f87b0d15ff4cc665ed4eb6acfc1b005c401684041786b67f576b5e4b901c86352db134af
SSDEEP 24576:Xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5mb57GBiOl6a8JTth/RWZvR6wQQh:va5POZ3lJt2pasx2+mub5+Pl6bJTIZ5T
TLSH
T12965AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f424407f7265ec0479d88c931f1abe92d85fea8fe4442a2cd9d1ebb8dee7b746
MD5 7e530a06313a60abe2b627151d78476f
SHA1 d5a184756e945c221b2dadb801654d6f1a2c69ea
SHA512 65ac57667957a526eb8c9088c5c069386c836b79b2dc9bbb86fd07e3dca1a3cfc03b5923dcfc2d7615983bfcda22806512271bba1b214f7bbde870caed1ac835
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7Fkjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:2Nc/zEOVHFxb5+Pl6bJTIZ5jdgpm
TLSH
T162858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 223da863d33ba25e33c612f5934d339ba9112eedb6e113f8ef910b75f95eba8a
MD5 fb754a955c21611a19aee13d7f87868f
SHA1 b3866a36f12205af98dcd5f0bc53290b6841f71a
SHA512 e0bdab8bbd7d9fe362878893711750d1da5535e60d06400fed3b1494e76d3b0303108dd49407414eded475511885293169fd8044080c2689cc1d332cbaba8f3a
SSDEEP 24576:NzkNvNnaFeYhJNtmZBmNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:NzMwBtOmQb5+Pl6bJTIZ5jdgp8
TLSH
T16055AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 31d25bf4c9c716db47e2d05c662272bc0d6cfb4301c81496ae15bfb1c07b4b3f
MD5 a139ff7cd115d9e9e9839df30a2a2375
SHA1 fb47d2ef77a39b7986bca510ccec39f3d65fbba6
SHA512 b52f0b28d48891a2d06005697d066a5f3250c0bc1a570c8bfd8746202c1a1eb929427a10817c3fc685b4ab25f3fbf06bdf146ef633634a198e8c7a5f8fefcc1a
SSDEEP 24576:CPUr+NQnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:CJQmb5+Pl6bJTIZ5jdgp/
TLSH
T17575F11F26AD18D5E67AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 338e674ee8aa65d4824dc175007cbd3f5e1d71c4fa4c0f5858ee1dfd888b14f5
MD5 4f356ab025de63870a9f64745a100c5c
SHA1 2ef5884f7a33fe9bf8fdb461f94883db629dbf6b
SHA512 2e444d0bdea30c24449538c6b616995f9158fff08b3d11116a783dfd26775dbd882d01419df81b35c828d4e66b530b5953b164834c31970906a4135aca2e880d
SSDEEP 24576:+D3FHshBIYQgAYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:+DVHeBIAAPb5+Pl6bJTIZ5jdgpg
TLSH
T12285E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BFD43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1356-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1356-362-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1356-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1356-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1892-361-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1892-106-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1892-112-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1892-118-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1952-116-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-370-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-83-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1952-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1952-360-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-368-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2028-393-0x000001D3E27A0000-0x000001D3E2923000-memory.dmp

Download

memory/2028-371-0x000001D3E27A0000-0x000001D3E2923000-memory.dmp

Download

memory/3080-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3080-212-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3080-15-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3080-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3264-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3264-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3264-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3264-270-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3512-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3512-120-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3512-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3692-288-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/3692-0-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/3692-291-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/3692-9-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/3692-1-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/3692-140-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4140-74-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/4140-79-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/4140-115-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5060-70-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5060-121-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5060-64-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5116-39-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5116-51-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5116-45-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5116-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5116-49-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5116-114-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5364-125-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5364-136-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5364-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5364-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5364-131-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5784-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5784-365-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5784-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5784-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download