1a8b8bf85b4974ab7fefad7dce3bcd1a89bcba1f6d60675008e3a592ccb7c77e

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
Size 2.2MB
Sample260804-p8fbhsfj9x
SHA256 1a8b8bf85b4974ab7fefad7dce3bcd1a89bcba1f6d60675008e3a592ccb7c77e
MD5 148e84a3dc4e26f74d21808b56671cf9
SHA1 173b83d8b43a039d0e47e23ec6ca220d37ba162d
SHA512 183932f21985b0ddfdaf0341e0548921df456654a251b9aff0d6961ebe65e4d5125b4197031e17eadb54e209bde5e6de66b364b8f77bcd3cdf637e72af3fb604
SSDEEP 49152:/ORd2+D0XDGGlsiOtUB4ulwCTDmg27RnWGj:9XDGCVTD527BWG
TLSH
T1C5B5C05562D402A8F4B3D279C9768A65EE72BC0943EC96C713EC76E51F137E04A3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3852	elevation_service.exe
4156	elevation_service.exe
1648	maintenanceservice.exe
3212	OSE.EXE
4708	PerceptionSimulationService.exe
932	perfhost.exe
752	ReFsDedupSvc.exe
5248	SensorDataService.exe
4516	ssh-agent.exe
4536	AgentService.exe
1068	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\69e4902e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c69ddd2e1124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7f71d2c1124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3b3286d1124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001dc2876d1124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098b38e2f1124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
4156	elevation_service.exe
4156	elevation_service.exe
4156	elevation_service.exe
4156	elevation_service.exe
4156	elevation_service.exe
4156	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3480	2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	752	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4536	AgentService.exe
Token: 33	1068	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeDebugPrivilege	3852	elevation_service.exe
Token: SeDebugPrivilege	4156	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 3868	1068	SearchIndexer.exe	100
PID 1068 wrote to memory of 1112	1068	SearchIndexer.exe	101
PID 1068 wrote to memory of 6076	1068	SearchIndexer.exe	102
PID 1068 wrote to memory of 4332	1068	SearchIndexer.exe	103
PID 1068 wrote to memory of 912	1068	SearchIndexer.exe	105
PID 1068 wrote to memory of 5612	1068	SearchIndexer.exe	106
PID 1068 wrote to memory of 2732	1068	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_148e84a3dc4e26f74d21808b56671cf9_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1648

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3212

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4708

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:932

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5248

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2936 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2804 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2804 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2936 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4a71ecf48beadf2e275db1b828bd958c6aadd67d62a95032124b95853dc9762c
MD5 119e1ff0df3ad10f2bf6a8cca860bec0
SHA1 004a8c615298ca7ebda2469a3f9e86615f1be76b
SHA512 9c26f20cad91f2322778a1de6d81c828b1c29c5066696b07055cf283b83fa07c3ad1915393a24b8d19f9607763907962213f4f081f36b7dbce3b0bfd91dfa471
SSDEEP 49152:Nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnHDmg27RnWGj:T3q6HjBgD527BWG
TLSH
T16BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 839551271e01f96a99e53c5298115d5c6799901240a490ec28e808bd3ac1049f
MD5 09d12329d78037e5dd978971a9e4d146
SHA1 b1668f4f3bc3a80105a9d7deb1f62c4440a5b52b
SHA512 b9b61383d03f0b433182c9eec975d69096c1f0fef8a51f9625a3586e1e1fba06ecbcff8dad0440a4ff4b1ec28aa3c1058a56109bbccc427d8aa30dae7a07cf56
SSDEEP 24576:LXYfDtczAAsqjnhMgeiCl7G0nehbGZpbD:OtcxDmg27RnWGj
TLSH
T13A650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 85edf77834a57e2a60bac62e4f2f54de3cd473596adffd9533fe269cec7b4788
MD5 b6bbc47cad2f506b379a047ac2ff41d2
SHA1 0d0b9014bf38a4f5e40ffa21d1b02063045f9971
SHA512 4708b06bc2009ac6e7eddd3484a0f5b9335f0c594f69d12f715264a2865dcfc43f37e35c1db613df13c4a25f8add0391f989baac52a87681e27b1227f2fd80ca
SSDEEP 24576:l0Le5ji0hmx5rMrsqjnhMgeiCl7G0nehbGZpbD:lPji0AXCDmg27RnWGj
TLSH
T140859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d981b04045fdef722a22009eed4e779373f1b5002df0bb90eba6f347aef4f4d5
MD5 18785e4ec38be1d7eb4a269be464c6e9
SHA1 ffa2c8bde55688e623ba0643fb19bb3b22fb9f74
SHA512 b8ae97ca5e4fecc8c870e4c71a5ca487307249ce117e81e8e0e641758200827c426b0b718ecbf540c799f99125c4db1b2a37d6f9779adcaa896d2812df6102dc
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyudsqjnhMgeiCl7G0nehbGZpbD:+/ezSC6vUzPvxHjy+Dmg27RnWGj
TLSH
T16F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 45454e3da58c7198419b6c993eeba5a10df5af4c5d3633b23715de929c8b69ae
MD5 0d3602748839887bc4d0f4faa3059bf1
SHA1 54d6cbf12c24387da474ef416d90a864ac02e14e
SHA512 f0e5ec33d25d610233b5fb56f88ae647c1e380310ad5c52bc54b673d9507193105e59e5e52a3a89c00ffbb242287599a75486ff3749bfb4269a7dc174ce23a98
SSDEEP 24576:yVbqPb88hv/l+6UsqjnhMgeiCl7G0nehbGZpbD:yVO88hXl+7Dmg27RnWGj
TLSH
T149559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 8499d66faf209f9518cb8e2459d11d3ccc26ee03541aecb28471c67ec3ac680b
MD5 9bd9adbbac1a799962d14c02944b3964
SHA1 e360544887f5b64ce8294e58478fc9ad81f0b1c3
SHA512 aa963d4947b2757803ca8032a6d0b2ed13e5448cc9b733bc807a0669512bcbaf7c76bbe2f28099a9468aaa2850a31fbf19e05bf0c3b34d6481754911d180f81d
SSDEEP 12288:e5/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e5/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BE824C11CAEA7708B5C3E9F55DAC177D56982008436AA37DFDE6F5468CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3aa61c23669da9303d4976ad69cae2753a308892d7158dd2f01c1f87cec69a49
MD5 91c17a911621ad07f9598c1a56db699d
SHA1 a5a2adaef5ac52b5183e73f46274623ed51ef163
SHA512 2baaebbdfa3b7caca85d98c2173f707483156366273836f2b45523b46c7a1e6c85fab058e7fdea05af734428f08b621da85b245f391d1568fa8bed382bdd09fd
SSDEEP 12288:ueBNUbTVO86U8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:uJIU8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 08442a9bff26ecad4b71fd00066c7f09bec48665b1da1d531e58971bb815006c
MD5 a670dd1ef351e253907f69d7e76087f3
SHA1 a6f6ad867c80dd3f0af6d214a44927a0a0a22934
SHA512 a5b09ebe4cd11064e640b8110bcd551a5e691caeb72f944f9661a619b865eaa29d6bb7c06354a466628b1ca4615da7ef2edd2bcfaeab051452d47cfc8b093814
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:6QvGAdlCEL8c/yRNw5CRD527BWG
TLSH
T125266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 436a127255cc332de8bb89c7eef108f36bacdf469411da27b2ab6a2f8217591d
MD5 369202ecc071899be509509d91d3051f
SHA1 2fef578dde8850fafdfba62598266e9319b99233
SHA512 5cdab1d937ddf1d853579a0e482ab48cd0655cde8ef5e278e06e0a3a96ad16d19402b2e6ebb4d3ce0bb5ddb093a9a720f5e99e4424095e8d9cc84cd414771056
SSDEEP 24576:mmewsAj+sqjnhMgeiCl7G0nehbGZpbDO:VljSDmg27RnWGjG
TLSH
T17165E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f6b56fcf901d4acc9b8b3555549ca9e77bcf40ad78fd9e2f3ca41e1179244020
MD5 7f934e5e86f6db9e3a3efec70b5599a8
SHA1 998bede399cde1ec27cfdd01e26e108442905828
SHA512 8034ba5d6beb5af2249f42d0ced1c073ea436c14e5f63445d2153d425b822727e8c512f67e21dcceee87b5ad412240ff5e1cf28b5a63ad7f91fac6e478169b9e
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH6VQBWG:2UEtQevvqc2W1cpV2EI32NB
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6d0c63ab183709aceb6ede1f4e25513333da635985e46a16a2a11c2942974910
MD5 e81c1ebcc4ef67bb54add8c0a98c0fbf
SHA1 2b18976d90c9e8dfa7c5fa2669c5df4695151b44
SHA512 8d85b99e23b448f8762ca7292b57e82678c38c29584e9da213e990351266b09ad7808df94d7801b1ca5b179f41f6f58b06b067708404c10d8bafdd038d5f6f61
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/zyDmg27RnWGj:poqtVjnm9D527BWG
TLSH
T1C0D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3f3847adaf698eb791530bed2fe8c15ad1f2a297f9aa1a95d9afb42fe2095e00
MD5 069dd651bda5fbc2990234225885d233
SHA1 d2e80c4030c607f957aaa9834e926b380c715fc8
SHA512 a4b9cd6d6dae2ef87b91473b02e154696f7e37b1f1d9066caccb21924f8c4aa18ea1a76d566bd5f7e23260c3f6bf908262ba30f3a07fdca7fe2ca6678d3502da
SSDEEP 24576:kAhGLJIFoiwtA5l7S53ZsqjnhMgeiCl7G0nehbGZpbD:kAMyFoiq5NDmg27RnWGj
TLSH
T126359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 b855930bf0af6bdc58ba273ef5557a5ce3119c6a9df0834c9f77e985878059fa
MD5 7150162e4417e1ba23eccc8352b21a9f
SHA1 67d04d7f2b6dd87639076451df5fba951d464364
SHA512 4614fc0e76896376919ebd59b46118e061ec27ac974a300622054e8ee5217c4e2622559a692ff31cbd5f9a01f4677f7be538c318e360a768d4101dfd6be600ba
SSDEEP 12288:vmw5HEjsChN8BFgl0WDm+C9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:OwuxOWKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11655F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 6cd1b62c2fb22115d67e804edd0f9f64eac03eebe4d8e8fcd687bbeb682e5e74
MD5 eec3f412b390b0664b37b3b9c443f9ac
SHA1 246eacadfbfad90c4df03169a16de3e58dc249c6
SHA512 5a97ba56549836692733e540aa06937e945c6f2b7f2a9036e77747bdffcddf68204a9f3e06c9aaf1a6f0592ef00176def1b43a13a8d6c5efcdf3aad870467e6a
SSDEEP 12288:1ZZ1IyOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ZuTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4512AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6949e7ee96ea79c362a888064af09997dfc090cafb5c2fd1f8c5837ea3a15b0a
MD5 5da7996435522eb7b082edf8154dd334
SHA1 2c67c3c799634836b96ef7b3f2174445589cd95b
SHA512 d48265fefa9f6b7209ccaf337de0a67747292c8af28a5f77df66a0a35d6412566e2dc7dec43234be3d2eeec7d1e7770d6b4b10bd75e5123d1e392f1482595795
SSDEEP 98304:cQRQyi36YOcPQLvw2gAf+PN30D527BWG:DQyiKayX+PNkVQBWG
TLSH
T140667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8da4f97ae6a9f190289673b26af541f839205d144e88e053a7a0f8c37daf508d
MD5 50d738f2c83d144e1efb739bd1bcb761
SHA1 a6b67bf7a7b775f66dfd4fcbbc498a9ebd007747
SHA512 e3750c243696bd6d4a08074b8b466ec60e15236913595a7a23a5f0577cc045290e575ee151251496e940a5665e25da2a6f58199bc4164ecd7b6a41185bb6f2b0
SSDEEP 98304:uQRQyi36YOcPQLvw2gAf+PN30D527BWG:1QyiKayX+PNkVQBWG
TLSH
T124667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d14ceb2dd3d0718c9e38f0fffd3217665a2cb1b07c4060bab57bfb123b34bddd
MD5 2ea67ca1807143eabf53565ae5652045
SHA1 2f84b5b9ece85c6accf2023037f365a599fd9f7b
SHA512 7771bf6907c6cc529f1b6bf304244467b2d9e6fcebfc692d638b216d0e4ccca7edc875fc6ac97d49124b7174e8d1257a6b61c45ae445598915f06643c0d7fc6a
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DsqjnhMgeiCl7Ge:/68Qg55nhheWu7PNU3/CDmg27RnWGj
TLSH
T1BFB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7d1b64c12e95c0a054a8b17a44a0b6681059d4e2524a69ac9cabb4f4790ed714
MD5 55fe05b9deb422b65eb414a5a6351d5e
SHA1 0ffae537c05ee9d7fe639950bf74237368a8646e
SHA512 618764ccde5e3e5a7e2f1265d302e1b9cd8b485d4b5aa839a9ae7fb7aa77b7e8958e0900b99a467c161f85cffdaff5668581680b56ee6102ab80f95e203798d9
SSDEEP 98304:Ay5112gYy5azzVvL69nLKnhZjD527BWG:ZLIHmWhlVQBWG
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9e18e946228dbefbbbaffb0f2dd5e9f470cdbca66d8e22fa11d361580c872798
MD5 17ecaeecf181ad8aa0beb33bd52c3d51
SHA1 310cae7040a425aab0c3fa979d80194ead85c32d
SHA512 b1764aa2d672ed2ba83f77488e72165ad9c1aa8ac9b751a27f84f634ad4b436dc01ae17a7fbb68302b36849c0f6de167f7926846f4395860275dfeeffcd66d43
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glsDmg27RnWGj:Iu6JmVxd2dsD527BWG
TLSH
T186D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ecae61b90cc8b69cc83dc6a12d9faa3a8dedf612a2734dd6abdf072564422425
MD5 a37ebce7522b7b0c5046fa5b04885520
SHA1 00152650b36179ba86eb42c7b22bc98bef90edf1
SHA512 08b13fd38a116b2afaa12877b046b42152de16acd25751fd513b6f01cfe3c54ad38fcb629568fa8b5341eac08657640b76bc748460ba84baf03d37d1ca2b7c8b
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4xIDmg27RnWGj:fmifPbR9D527BWG
TLSH
T100B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 20c2603a2a97dccd36f653b064b495ef4d50735171f1374125a34957bc2274b2
MD5 68a725ad63db9b938eb6c9898c60d01a
SHA1 2fb0b5c57ede9c8cb2d3d14aef8855d98134f700
SHA512 f56ab1ff4f66dd4ab524311f7a0f33ecbdd89c05c0e77849f3d035ff7cc44c74ce22582c4175e5ce124ed279d3f44d3cb96c05b3e78e508a72173b325c77ab35
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqXDmg27RnWGj:w5dKTi61XD527BWG
TLSH
T107C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 679a82fac73c2be61cb5a5781d91c7d7e9f69c96576507113d6c351bbf171d41
MD5 934cea555a1400a66d3e0038c96f1039
SHA1 9c32a8cd80b25ffb1962ee94bc13913acf14821f
SHA512 823c65eab2c49034c9a3b87407736722e743b92de8efd724b24cbe64b2300ce5b0e1165cf48c3582d8f1b766e4a00d27b5050e00aa64d03c2b9852fa991f19ab
SSDEEP 49152:whtSn8EApI0figngiDn0AP5w8Dmg27RnWGj:hX2iyph5D527BWG
TLSH
T12D95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 7d2019fb89ee7aa1510ff572736ebf4c28975bcc396387aacc900d72226389e0
MD5 1bca46cb02f64977a289e5146ca4df91
SHA1 c800fee723e84c135099c45796573d0204d94f40
SHA512 c0fb50759610dc8538e2648cb9717a467cee931d4857dd2047ffd245ba02ac66aeb48fc020a3531de55973f005e876255071bea178d884aff5e1527906951135
SSDEEP 12288:DnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF4523BE915C01CBE92244B5C3E5F15DAC173E57E92004837B9778BAFBF24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 d59ca3532820638684d9a19c3ce9322d6d6168496afa4ca2678e4f5727fa2352
MD5 3dc10206bce84d21a47ffeb50cbb2148
SHA1 7b8225e2a5db2fb4fbcacca047cb5152b1524dde
SHA512 15de885a33711ea769f633792b4a1c3c2081512d2d8590dfca14f329e543046c08fea57e17b8d1e9dd5fea98fb3b87d87298a97f688f873cad55690d057d2448
SSDEEP 12288:ACXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ACsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D4523BE915C01CBE92244B5C3E5F15DAC173E57E92004837B97B8BAFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 669d138e26ead9756dce4bf4da511607eb015ea3782f26fedb036609c709859a
MD5 298f4e141ad2f46f7534c72c66c074f5
SHA1 64bced9f2952060d61e6c16ee8725b77b2ce6f3f
SHA512 0e4fd9daba8c496552724993d140c834b30a923592f2ce08bf82317013f7caf2fb237edc7bdac76ecec92be8e31bd7ad6ab45456d2a631149e94604a3159d34f
SSDEEP 12288:LEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C4523BE915C01CBE92644B5C3E5F15DAC173E57E9200483BB9B78B9FBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 1233212f1ebbeb2d0d88a1ef575915681eeca79655160eeac9d6a0b152fe59f1
MD5 0b67cf125f4bdb37aca11b1ae909800e
SHA1 5230f775df72f5d28593ddf8e07ab1f281bc714e
SHA512 76caf0438957f562eb0f5330631be98dc66d1da238865eaa08455308a3ff86c1048444fea3c279287f785e100d7d814a762e16856f9aca0ed4de141b7d25d22f
SSDEEP 12288:2V5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A445236E535C01C6D83285B5C3E5E11DE8277D96EB3005CB6B532CBE9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 8c81987abb6f36477ff6af7ef47b69210b22d983c04fe4fe2668958da43548ee
MD5 3e1258ea42c5b8ef3f5f79dd429c28fd
SHA1 d2f6dd6eb760804a81b575fb3253d40eadb08c51
SHA512 559f5fc1ef05458f45845e5cd22cfbd851e407b245d2819a2b5e01ac39b388d67c4234e7420641201f0edd00ab46ef82667da1144acf81650e3f94d3d7f48c65
SSDEEP 12288:CxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED4523BE915C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78B9FBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 5c85b2c6ba072eafcae7aaf4be686a474aae950e74754c5196aef2e417e830df
MD5 6093e941187560302a04155b8dff6c2b
SHA1 e2e79b7a2ce1c40500f250de8d844223c9804fc9
SHA512 1b183ae2acab78f7f106095a6ad6fdc33fca2718f4647f01ddae4eb15bdbde9b82b45af3970d655d8c8eda1a503f27400eb7f7f58e96ecaad8adce0a185b983a
SSDEEP 12288:eGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1514523BE915C01CBE92644B5C3E5F15DAC073E57E92004837B97B8BAFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 7b028a45c8654bf5204dae62c633b19ffb421acf37b8e7ef3a79d220e8e6710b
MD5 03db5bc2cf76eaa355ec016540cf2310
SHA1 99b924b52972214083951008f04f4c5eb1000a09
SHA512 9e4e93e6be8d65e2898a779adcf9364f2ca0b3f7489630e97518722f8005c416029b8012a8dd3b163e13871379c4e3d62ba83655a03c9d8d0141568894e30d42
SSDEEP 12288:h6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BE915C01CBE92644B5C3E5F15DAC173E57E9200483BB57B8B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b7cd681b0c4e2754354338b74cd409f0fa37d1a95fd9bccf01db124d726f782f
MD5 ff70249241a2c29bb623d4e158f95f26
SHA1 4501cdb28843c1516090aa58e5c3592f663fd004
SHA512 f4322217a6f84b407a0d2d42cf89baeee6becbb1a3bddeb13e06a416d12ed13ade1a28d67169f5db7a794a00fc447dd3bcc718f0713a619d24aedddee6428f16
SSDEEP 24576:LZMhzFVSOisqjnhMgeiCl7G0nehbGZpbD:LZMhzfaDmg27RnWGj
TLSH
T1E86501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 8412f9c3fe057bb32004c740a9c92c706c9dd6bc4f3be4c18839c5d4996018ff
MD5 602ba4f2865348514ac97b0d0a371a02
SHA1 65ff9418f1ce2138e18a9505e6b07d3864606223
SHA512 ac93f5e1fe1ebcdab8917250b9974015ece8bfa9a6f24ca014c3d4b55280ac81be10fb338f062c3e2dce982362f447a81a2fa5ee18ba0955df774faf0e520057
SSDEEP 12288:UjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1444523BE915C01CAE92604B5C3E5F15DAC173E57F9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 51bcae4f35433c10e932c8e655a67ff3bb624d3aa494691ee61d0968b2ba3a4e
MD5 7dbc2208e4b2476e9b09e63dac7add3c
SHA1 5e48d0fa86f8992594b25b37f4564c524f680605
SHA512 42ca3a05563aa72f92353b2544b48ca6411d0e64a5840238cecaf74a8485066e4322ae709d95121f33dfe3916e54670b6a150b5e7454f4594aede4e6e2d565ee
SSDEEP 12288:bPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F4523BE915C01CAE92604B5C3E5F15DAC173E57E9200483BB5BB8B9F7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 a9724a14c1992344c79a6e891ace9af6c55be868dba24b6f8f5c64bad4edde8d
MD5 cd82ce0f30551a122f5a7c70a3607ffb
SHA1 d750b83064940f6324f3a1c9213da023edcd1434
SHA512 c0c249ed6929864a2a0589bfdeb357cb9fc41750e50cb903624c698fef2271193e18b6e70b8ce13d822bee44ccb91937b7df8f1fea76bb44c467f2ebc2d79a98
SSDEEP 12288:+yPz5L8OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzyOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10155025B73A530F9D1378138C5A29A06F7337C3247204A9F17A556BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 674b6e53192cb9bdb9a30a4c2c50c0599c3598f2c36003b7e7bef40aceece5ff
MD5 3f406600f952a4ea91f4dd068272f51c
SHA1 34cf13562456449eef683fda6b3091ecdae6df99
SHA512 9948b5025e86c6cc3e080b138da0d58c584c24d9fde33e06695c7a1a147e5c70bea798f87c2f831c991ea467d5dd281e69dbc16baa9932905f8110a957ab956e
SSDEEP 12288:njXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:njsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BE915C01CAE92604B5C3E5F15DEC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 5bfa9b3fadb103e4d6519be4de20593a76fd0beffe21c97552dcc9a6970b016f
MD5 4a24723f068e0a3f670e6befbf8fc2fb
SHA1 e2ef4cb38a7ff7e6b99551e1ea3c0ec110eb9435
SHA512 0c094cc5eb31b289a67ed0fabec6dc65321dd50f958c0a0e84f8533fe8fd7538143b938a235221992bde6dd130a406b80b5eeac1541a6b7c9a68b57c633a5e45
SSDEEP 12288:PjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E4523BE915C01CAE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 f5305b24e68fab3bb763a7ab6b4428202afccf41cfd099106fe5a6172c0a4a23
MD5 8087de1b08a29b8534deee072a6acea5
SHA1 043cdd5c62ffd73478f566c44cdbcc125dcd7ad6
SHA512 ab5b4a9519f0ddd56252f633418ec9d42ea0b5297fc458b58542eb4ab41644b9475a8cf6018a62cbbba11f3f15c456935182f8e13039160b8cefa682ecf3e75e
SSDEEP 12288:ryPz5L8OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GzyOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15055025B73A530F9D1378138C5A29A06F7337C3247204A9F17A556BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9e69742f1763c55eb941a851b9e0b6009b4a8aedc159c2d9246f5db85d4640c2
MD5 7f6f9f2bd5462a6cd5dd7bc15725a388
SHA1 ff42383c515085a587d9b647202a5299571f1648
SHA512 05cb8e2f50f8b9749ac207e04f6b954345331fef647e39d4f67c8a8593f8a17d12c74da22ba5aa54331e4b3c23403e9d0e651d90d5e772716d4b65c7e5b7c315
SSDEEP 24576:ATCaLl3z0zD0sqjnhMgeiCl7G0nehbGZpbD:ATZLljBDmg27RnWGj
TLSH
T19A6501A9B35018F8EC67813EC965C90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 4721fdf51fad8c3a33d2ecb1bc54b9ccc64f53f1cd845bf636993a03493e866c
MD5 66ffb821c3540c780fc97b33d647e278
SHA1 9a05a45640dba09bacc0df2d3dc2cc86787431aa
SHA512 98aaa5c56fbc1b9f931bcdf388db1a2c0cda17c309ad9484de6f55437acf06bd9f454f1f75b2901b42cc76e8d109bae249386379d51b7ebae04073851a04a1f3
SSDEEP 24576:C3jd9CHKy7GZosqjnhMgeiCl7G0nehbGZpbD:kjd9CHKyaaDmg27RnWGj
TLSH
T1C675CF90F3E810E8F0B79A35C9769511D9767C5A5B30CE8F03A4656A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 b24add0e0274926246845be379f01c55625dd311aaa2f97cc6deed8db95fc9ac
MD5 a2f05faa6e631b299ac43d4281976c8e
SHA1 a312887f7eb8c352158e7c2685f2b9870036dd28
SHA512 d3ad528eb6a971c4dfb3989f4714f9b9542b1f59851d730ad5e38514d0db6dd54e675a4c765bb210154bd65fcc6389968342af1cdeef3260d933c11a998c1edc
SSDEEP 12288:ckXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cksqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D4523BE915C01CBE92644B5C3E5F15DAC173E57E9200483BB9B78B9FBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 05b62da9e3451df45af19520ba60480d23147988b59d6ac915ac7333a46bbcbc
MD5 da2bcca011eb651d7cae478657d1d746
SHA1 68152d380cf024721dbe897f0b198dc92a83c275
SHA512 b02f4d64016e2cdd3259f76d4e768831daa2ab2bdfc6b6adaf09640a12e2eb7ad1ba673cec782a033091eeddb0a68c5f7270b425368adc9dc1f6adbfd31501ec
SSDEEP 12288:AuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF4523BE915C01CBE92644F5C3E5E15DAC073E57E9200483BB9778BAEBF24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 6a322c020a9dd1a9f335696cf8255c93c921a39d870ced9c2807599fa1c53c9f
MD5 28e8aa35ca79e28c544f275a9ac11130
SHA1 ce9eb124e077ba733a59d1b7eae969e2ca933df8
SHA512 20e83243bd013469c14dd0107430eba926911aac3fb5520c708137db6a22c771c0f1747b628e9e1990493e26471f06644f01625ec85c588f8e7cb41e4e43b2ee
SSDEEP 12288:SVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1814523BE915C01CAE92204B5C3E5F15DAC173E57E9200483BB9778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 a050932e5ff1f84ac1d7428a38705fda7511ae573392651680e19fde11264f37
MD5 7628f0b5f482d0b2eca8518827a52a1e
SHA1 5dca0a41dab3ea281dd624a956b39a670c082570
SHA512 3feddec5184102663e583ef1cef386fdeb183ea687edaf029d3db53d6b59cfcfc5d84a0890ee8ac2dcd8b355852b217115ebec31475137e3d0c044d1c2bb57ab
SSDEEP 12288:yjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BE915C01CAE92604B5C3E5F15DAC173E57F9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 5cacb1f94ae6a1d2ac8ea05db12645c085005063d4e6e84cc39dd3cd27695c04
MD5 e54445d6707bc8f0fc9aca890092dafa
SHA1 e9105be780de1efbf085970cb87444b95ffc0614
SHA512 9ef48ecc9a60e451f38fdae4314e22ade2fb81154261d56d368da06f97a8ffa556e9a2195b269d445eb36477ceb7a3aefb67260a5ac348e0c7edb036b4155d4a
SSDEEP 12288:KkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D74523BE915C01CBE92604B5C3E5E15DAC173E57E9200483BA9B78B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 b2af7546b0f6e5fe85450f589b371b63a582e7547a70f29c2868da468dfeaeca
MD5 9530551dfea6adbba41ca7e3eda5fa3a
SHA1 53b793b33dec123dc2e88013485713f7e6d76924
SHA512 b1f7d11834002591f1c1cda22d30d6e4deb7bc5d73a37ff38e86c0147af4966bcc6e727391f152469c198af67d125083fa2a0d811731d09a39a5803a0c83a4a4
SSDEEP 12288:ybXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ybsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BE915C01CAE92244F5C3E5E15DAC173E57E9200483BB97B8BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 66123e94fadf53300f2e099ac5dfdefff66b71d80cc78ed2efc6f0849105ad1d
MD5 88b93a4bfba8cb9d09e50324fae6e488
SHA1 8ae59f217762fe672d35a2fc8b6e9d08cab08a28
SHA512 499683c87b189dc892a8d56f200f18a4294db92e562ca00d553fef3053d171f74139171db9771864d6cd1f84e49cc5eae717b487498e86044bf78dd922bfd795
SSDEEP 12288:DxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BE915C01CBE92244B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.1MB
SHA256 a6e28de847f17fcbf223e5f936ed66496431c805387eeb9101aae197cf75be07
MD5 b9fbef6efe8ea61c183990a6853b812b
SHA1 856b2e8c26f468332cb1c96127d824264b0747e3
SHA512 61cc99d89cdc6fa7422de56b41d7b85e85d84c0ae96ff3829be05c8b1a8d69944fae25285fb6c11fcf78f60d0658088a208cc3ffbc29f6c63fbf8aa961114aa5
SSDEEP 12288:2MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1644523BE915C01CAE92244F5C3E5E15DAC173E57E9200483BB57B8BEFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.1MB
SHA256 21976a4b774cb2fc80d9bc38804cfb7c09e167df6223fa7410e757f2e4611457
MD5 dd10005cb14e066e967fed3b209948ad
SHA1 297040c98d4ecfbac869acad65163712da7f2321
SHA512 f34857c7edfc7e99e1742ec00a99aeaf93ca17a491ccc32c329db93df629bfb050fa89f0d417464da890abaa71ba139dc9763dee3e34c77197cd6e54378c579e
SSDEEP 12288:YxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE915C01CBE92204B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4fd93e0dfa66deb009959dd449864c5ff26b39ef1db042d9d110d8df1814647d
MD5 e65d1a231ff15f15fd1953bb13d616bb
SHA1 11a0f6ba9ca56760ffc683f0015f8aab5291dc5f
SHA512 c8797e28fe27b2ff252d1437d5d15c594f24065d9a3214f3de9aad208f657f96379728c3ced784982dfc5019f8b3ef3a0bcbc4eb5f3856859f93d7f0e3b03872
SSDEEP 24576:vfwvFk9RX6wkyAIfsqjnhMgeiCl7G0nehbGZpbD:8MnYIDDmg27RnWGj
TLSH
T15575D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e704945db68c62100455b79feb6c176f5a03179ac075ac03c20a64b2c1bb8579
MD5 03a41900db52fed0a9265e447b136c15
SHA1 56590ca9ed5714fd5f83fbbe5bed80a00f0fed6f
SHA512 d0cec9876e6b9e645eac4f686d36a2fe130cbee6a8efc94943a47c4e1427ac323cf7a1b808c102dbcc1699b287864f4a6cecf731c77737688ebc18b3a59cc54f
SSDEEP 49152:6YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cDmg27RnWGj:UySzPUD527BWG
TLSH
T1C7066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d326ab273eb2dae7d62bc364b7237a0fa0a67c1b59a35359c743f853c27c28fa
MD5 119f0bc0371452761b85de9edc78826d
SHA1 bebf041f61083a9d620d7b33a27041192a3150aa
SHA512 0069bdcb60f177358b25a0f730c831015e570b7d64491c890450a38289f2254e6b706840bbf60513f6446e5ae3e644e33e05ccdb64979834f60a025bce2ef11d
SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYysqjnhMgeiCl7G0nehbGZpbD:a47JUQj1irIhCnDHUPfF/sDmg27RnWGj
TLSH
T1CD65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 714c869a789d63835442b04b6f6384f751ef9af816b335f936de11b57f7b6b95
MD5 472fdffbc4fbd041fb782db86ad51d8c
SHA1 5e8d70b1349b305d331df70bcd2b32fa133bdb9a
SHA512 225ce7c3d1d54f08bd125f7655b8554c0d1e4abb3ece6577a8f77832a0093709c9ebeaed9678a7f15c5bb3ac6f125cc82e26b6a57467a20fa143479c79d19fca
SSDEEP 12288:MysfTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14955015AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 86bc1194a4a1dff149a3d49e9d084d89fee8674418b52eea235d8f6d12c5b0b4
MD5 cb211256ad865d28d097311655d11bd9
SHA1 6590816fc5e060de82f4c2b7108de5c17e96ddfa
SHA512 a7ed7dca08a37b1fc13fbef085fe8472b9b7cb29b5416d526a1b70ac7619df252a2d168bb12213fb8c61e4116530274d13930fee628a8466d739196f28580bab
SSDEEP 12288:h2oe+fU3fzcP1jTNyX6O2tKzIovcI/J7oDOcvaau:h2tMUPAjY2EzHvcIBcOcyP
TLSH
T16A252810766BD75FC6A940321E33D2CCA7707D01EE05AB0372C8972FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 9a54f6cf9dab6ee97f5cb1a54da11e4ece27e8df4a2a7b7a47fa5e283f2d21c2
MD5 53c362d682b8ba368c29e74a80e3c1b7
SHA1 19b13daceb1ce3c492de56d9099605648fa184e5
SHA512 993c4c0411388d61c67904d479326f3985329fd2141b65583f30346102df9be89004e505a9feda9584e94cedd6f4c22f73bef0cbf15bc56e706e3049a7528f23
SSDEEP 12288:ZNAwqnxBu9jqFXZwo/SbpXq2q4DFf2pV3pBTsIozgKMolE:rqxQGXZwQSV62q4DFf2pV3VolE
TLSH
T13155C7815437A3CBD1F76032072A5B4CA764EC0777496F26B3C4453EE82AB26A1BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 0c6695df98793c57d32ee7cae8a7f25be33a4c8ab09f81ce7da8bf30d1b56730
MD5 3579c4d78daa43adcf5ed06c288ec699
SHA1 12233b1b9f08c0f62123645768f0d5dd55734442
SHA512 7a7661559ade2f81bd405691af9567e6bb3ec00a55c4791d877ac36199abae18b29407317ba68fc09d90f7d18ff48e14fd61e7ed8e6c478875bdadf6e62611cb
SSDEEP 12288:z07LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B345237AD34C118AF83605B482EAE12D681B7E669F2004C3BA5778FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 629f22e8c7827bddfdff5b463ade9d4f6130310c945e8ed066cea0914c5f4b3f
MD5 ddd7c3a61599790245ce0d4e7737abf0
SHA1 92fe0a85b85c9bbcd8d8d0f1970610eae483ad6f
SHA512 d37aa8759745fd6527de2b723973a16bf9bd61dce2c708e0257a48c7399c7b7f068dba625b0fffbff43c9b5641dedc5f7d47f9ef958a3084f38b21ad71f04b9c
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYdsqjnhMgeiCl7G0nehbGZpbD:tgb4mBIBhGF2Dmg27RnWGj
TLSH
T190659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 a2b8c5ad453b01bec43d9dd45958c34d355ff144c96b8560764cc9b9b3ec4265
MD5 0512e86e3e92e30dc1cff5cf37955c83
SHA1 6a2cbf618949d312824f94bc373a032bc6ee7acc
SHA512 d8fa0484ed40f4833b7fc3352cd166dd0267764d6c4e6b859061c38297da1137f239bd7c0d773c2670455b44459e20714677137eb22592b415bb33db26b9a126
SSDEEP 24576:cG88u8FpJqH1Wzria7/misqjnhMgeiCl7G0nehbGZpbD:f7ZFPqVha7/pDmg27RnWGj
TLSH
T13485F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0e29261807393bf53a339c749075e29957254ed12f0ac8c9f42c9b12b58af418
MD5 923bf22692e4907c28ca3b3e80cbe787
SHA1 e1e6e19687166cea8fdba55868406545b822c5c8
SHA512 7b767bafedf06df7c35ba4ddb0f297bae3e176da52cea63279be5161f12de5b0f5a930e461a08372528a6581e9a0903d94cf34598c7a350eda4f74c5e7a500e6
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKDmg27RnWGj:5G05lO43bLD527BWG
TLSH
T115D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4842ea50a387e4cdd39a24d44bb39c93409183e58f1e9d547f83a715521be387
MD5 0bdf03f0d1c91a45ed81abecf8583926
SHA1 d9afc93ab8ec0bdd0b5f4d1a86301a38e59333af
SHA512 cbdb29e3b51276e77c9e6eef40372d6cfb7fe5d44b6327acfd182d034e6b4a959c4cee29605a47fa20ca0fcde8464daffa96858f1c97fa016f4f7fdc9d1e2efb
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidngsqjnhMgeiCl7G0nehbGZpbD:qa5POZ3+Jt2pasx2+mCDmg27RnWGj
TLSH
T1DD65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 95d08454713fe9b29aa0ea655ffe62e8492a13a2bad6ae39bc54c5630f4367b7
MD5 bf801364aee961a6219a5810bb06b071
SHA1 e38c1c064e8fea342e7093c570b8752b678555fe
SHA512 e9d18f5b44f59cfeb3736f499a63110c346314ee873481a9ba30bf7afc27af2d1fabafd1af1a1c6cd9ee185bf5edf20725a4f7adc7065f0ba39011fda9679269
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkqsqjnhMgeiCl7G0nehbGZpbD:5Nc/zEOVHFJDmg27RnWGj
TLSH
T147857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fcfb4b88c1e3960a23dc5fdb6436e1ed8dc34c661414efcfb6a76568f063d1b1
MD5 e52610af41a6561baed17009c2e3592c
SHA1 0d275bb36aed13989cfd1bac3b0f3a2d44d593d3
SHA512 cdf69f0e0567ca8f350b5e4e8c80f07437a8b5b19061f55d84b2f8ad6635b057188a3b10c81e2aef5406e9b7ee2bf830ed64b9f03f64e7a95f7083e3c8b2a5ff
SSDEEP 24576:E8kNvNnaFeYhJNtmZBmMsqjnhMgeiCl7G0nehbGZpbD:E8MwBtOm4Dmg27RnWGj
TLSH
T1DA55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 84d44655945e3a465f6cfa95238426d8587fc3ec56de16afcc2454f810fc336d
MD5 5096faca08439bfb11e1a6e18fc8580a
SHA1 99928d9c8bce2a2074e473319be25b7a7948d661
SHA512 67e1fd3085da7e4541892770ff8217befc0e1ae6293cd75b7674dd5d16299660ba56c651437ac078ff39cd9724e7b25197d4a7974cc85266cad844ebe32cbe34
SSDEEP 12288:AHvUrBFrEjwaQWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:APUr+NQWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A55F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 23a8073d07155b3fa848511cdbc63ee9e20525ee05b66617ad36e981cd336f03
MD5 c34d8283b3d67bd032d8d6ca9ade1139
SHA1 37dd0ff0a9ff8eb5efcf3d97747edb2e9a058dcb
SHA512 0ccba6900af5b50c4c7554f6145e8d484b5548fc13d2d162a32ccee64290ff908d9f42ade30e360ce18c0e8cb3c2feb4f80a58affc4252b80ce8400f53b8f614
SSDEEP 24576:fD3FHshBIYQgAHsqjnhMgeiCl7G0nehbGZpbD:fDVHeBIAAbDmg27RnWGj
TLSH
T12875E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/752-89-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/752-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/752-382-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/752-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/752-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/932-77-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/932-309-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/932-78-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/932-83-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/1068-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1068-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1068-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1068-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1648-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1648-52-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/1648-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1648-39-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/1648-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3212-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3212-286-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/3212-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3212-54-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/3480-87-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/3480-315-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/3480-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3480-8-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3480-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3480-0-0x0000000140000000-0x0000000140235000-memory.dmp

Download

memory/3480-311-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3852-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3852-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3852-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3852-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3852-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4156-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4156-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4156-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4156-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4156-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4516-113-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4516-369-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4516-121-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4516-115-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4536-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4536-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4536-126-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4536-137-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4536-132-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4708-73-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4708-65-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4708-308-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4708-67-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5248-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5248-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5248-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5248-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5248-366-0x0000000000770000-0x00000000007D0000-memory.dmp

Download