48488b3f3391e55984d18a4e5f6d03b64cfc0dcb9b685c2661af418546156d22

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
Size 1.7MB
Sample260804-skg2zstaqa
SHA256 48488b3f3391e55984d18a4e5f6d03b64cfc0dcb9b685c2661af418546156d22
MD5 837a0285fb1fac55167f725ffad3a1e4
SHA1 6cdce2b8c01b995a7b14509c28ff54fddc8c2a7b
SHA512 700ecfea1bfebfb8bde44725ac7af13e132b4046b7d2192249b5a1c2b4fc9f2a52266c8eab4dad8b1aa5aa819d195c3629035e197c7ecb85352d854e2c948460
SSDEEP 24576:mBP03afTOJkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:mKafIb5+Pl6bJTIZ5jdgp
TLSH
T1EE85E111E7F501E9E1738238CEA78512FD727C491774AAEF03A485AA1F33AD44E39B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3544	elevation_service.exe
1272	elevation_service.exe
1172	maintenanceservice.exe
3904	OSE.EXE
4092	PerceptionSimulationService.exe
5868	perfhost.exe
5744	ReFsDedupSvc.exe
5404	SensorDataService.exe
1580	ssh-agent.exe
5444	AgentService.exe
4312	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\52c81884c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000787a43bf2324dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c6e3d7f2324dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000584709812324dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7717a7e2324dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9ce3f7e2324dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008c5de67e2324dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff3be07e2324dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
3544	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3740	2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5444	AgentService.exe
Token: 33	4312	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4312	SearchIndexer.exe
Token: SeDebugPrivilege	3544	elevation_service.exe
Token: SeDebugPrivilege	1272	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4676	4312	SearchIndexer.exe	101
PID 4312 wrote to memory of 5168	4312	SearchIndexer.exe	102
PID 4312 wrote to memory of 5556	4312	SearchIndexer.exe	103
PID 4312 wrote to memory of 5788	4312	SearchIndexer.exe	104
PID 4312 wrote to memory of 3744	4312	SearchIndexer.exe	106
PID 4312 wrote to memory of 1496	4312	SearchIndexer.exe	107
PID 4312 wrote to memory of 4500	4312	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_837a0285fb1fac55167f725ffad3a1e4_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1172

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5868

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5404

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1580

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5444

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4676
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4915493229aea3d84625bccd0e165b2eec76ee97f3fe3d97537ae398333959e5
MD5 f1113fd7511ec7a5ff2b918b1f3c788a
SHA1 73e7f5dbfd348cc68c4c4bd0bb4db116837437a9
SHA512 c83399e8f1fb3088e2044b419f45793ec25d8a6be8d82fd84b56a21e8b638ddae24d10c354bb02fea1c7a95cc32e8613bba9dd83a38d82533d4d0d8acbefb42a
SSDEEP 49152:Nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJb5+Pl6bJTIZ5jdgp:T3q6mjBAslgJTIZ5Bgp
TLSH
T19FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 81394c69308cccddb56e60c50a3a0acdf815cbaca4dd07100ce4ce489e61a415
MD5 a33b90253c79a83ffebbcb78787cda6e
SHA1 8696deba4a83f8688293d556991178dc21edd6b9
SHA512 a00e850f88fffdd8ebdd1a00ade3fc394eaa3de79307ffb660fdf445b33f8c6276c9e274158aa49cea97325daa8339bb404917d0040c44e0a852de94468465e1
SSDEEP 24576:fXYfDtczA/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:qtcvb5+Pl6bJTIZ5jdgp
TLSH
T12F85F12967A504F9EC67823DCCE1C611EA73B85587A0E79B03B499265F333C86D3E742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 88b20ac2bfe8b2017fe1664cc4a298e151b6e242a13b3b1407697e5e82c4e8e6
MD5 1e0db0bc6af656215782c2c848c532d8
SHA1 5fa5f2c65e63a3ccd4526fa78992cc48770f80bd
SHA512 378807605ea2a04c7bd293bd67ee19322fff4d6b270cea8745dfbf1df343edc9b249172d3dc423af554ec882ef5c5820a99ac09ea535c670dd71518dc2a147a9
SSDEEP 24576:E0Le5ji0hmxyrMumb57GBiOl6a8JTth/RWZvR6wQQ92pN3:EPji0AIAb5+Pl6bJTIZ5jdgp
TLSH
T1DB95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b52da6eb784397c476eb8cd845c35560a18058c27a1d8a66473ad934a646bb47
MD5 bd30f1d46ff04b202dc1caf29a2c372c
SHA1 48ab54222b1ab0c4ef5b21300a3afb366e30508b
SHA512 df24e68cc243d3e788f19d353505e4dc890e7df8d5ec9f60421f9e18fc4a1a1d1b7d099b1f4b0ba2ebde3bac289d4ce127ceff8c1d1e7bf678b5e7302413d474
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWj6q8wyuomb57GBiOl6a8JTth/RWZvR6wQQ92pN3:E/ezSC6vUzPv+Hjykb5+Pl6bJTIZ5jdw
TLSH
T193756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 41fd1112b07151ca4595bc6a7a23fae7fc08db6bab6636e079cab547f1133fda
MD5 a983552a8ab5b8f5fe53770159df569f
SHA1 1adda3ebe357eade415b4c9c1d66f0378a173d78
SHA512 64831607e4a09930a5d842fd063f61b746989243846656b4835c6665bd2f09d82634c609d7d1b54845237ef6e00edd1a78bb62f57685f36a22ac51bb0187ec37
SSDEEP 24576:aVbqPb88hv/l+Bjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:aVO88hXl+gb5+Pl6bJTIZ5jdgp
TLSH
T151559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c4dff67a2c71b7d4ac1e5a1ef0bb3bece3ab508147b3e4d33153ca964a338bbd
MD5 1e1f410cec7f65f5a7ea2f22792ba4c3
SHA1 997700fcdfb0492e945958c8c396fd9e0456d99d
SHA512 b5c55924af2469bb4a8257d7b0cff5139a8425343b05062041774c6b045446e3a49bde3f3a5849484a2c8907933a9914ca8c409fd04bc35d276463f3c93911cb
SSDEEP 24576:dFCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Fb5+Pl6bJTIZ5jdgp
TLSH
T1EF6523838B6930C5E5AB1739E9CDDF00B87AEF55CD867B76C5752C2BE034249B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 0d59eee5d4f4224a1f53bdaedd12f5d747453345b3a37c5c9a31e6ed288c663e
MD5 af18edd9c4df5afdfa28e00d56977492
SHA1 32ea5a953d3577f819155ea5efa76b00057c7ae6
SHA512 30eaa74ca10b6409b75c5ce9c420c93eb17c6dfc547da596061cabf6d39569f210b216fb291aaf71f16e31218c8557936a5d6148a084096bcc6498d4b2b605b1
SSDEEP 24576:+JIULmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+JIUCb5+Pl6bJTIZ5jdgp
TLSH
T19285CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55E76815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e6eabb19b20683a18ac04d1ad0b0dbf199ca15520b02d053e6aa66208e509869
MD5 76e4cbc3baf198a29257ceeb878c8566
SHA1 5fd350462e1e438ee587eaf885797e4d5106ac6a
SHA512 1213697ec7f63995d46a209280bcaf2d6d3336a234c9d3500c4c53ba3f823697ccaecf23d626e28898fbd4a68a9e4b579726255b3e20351cd247e865dfbf1893
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THa:rQvGAdlCEL8c/WRNw5CzslgJTIZ5Bgp
TLSH
T195266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 32b98fa13e24af9492e0f80b5e94c28c20899d37a5a2b9c3759cf8992e257732
MD5 b4104144c7dd9202c859004fabad7fc1
SHA1 e500451ffbf545430b5cb2338dde6ece09318d1f
SHA512 f9ba6fd3b8a01a018c4549f26dba8b8b4eef363f719759e9a2e2666f0364b1463fbc524770bf33b61ea33de0423f200388326375b64326a6f541bed5f62bbe00
SSDEEP 24576:POewsAjtmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Gljwb5+Pl6bJTIZ5jdgp
TLSH
T12785E031FE74E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fb7f91e9bfee59447b521bccfa970a4c235c27e96db273cbdd2137520b0f95a7
MD5 0218f479420d49a3e7d6b5f892e3a664
SHA1 a039965c3805eb121564d3e5f095a5a104e4e76f
SHA512 4da53b89008448de9f9f25241e255c1fe6ca9c03c93070551edbbb3caacef7630710f5fdb9e12761c1ddce6f54d3ed56d6dbfe2f22a617fd6625dabf5b1407a4
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHGsT6p:EUEtQevvqc2W1cpV20I32Gs
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 73fe54e3087b5c6bde530f5182b90f80f0f9eeac6c1bda7a87a71542a688e0b3
MD5 e390b9c4d50f33e40fb828ee01822458
SHA1 5410f20fbc20c246db92022340a766c529d33532
SHA512 d7d7e34a6f2de47834eb964aab3fccc190f610df1ed368a7adf876e1ff279c7154d5d3ac92bdbf12396de82594e12934ca40b66051eefa148709e348c068fa4f
SSDEEP 49152:3CbRquA/m2yL5zQfFiV+XenmE3/zQb5+Pl6bJTIZ5jdgp:goqtVjnmnslgJTIZ5Bgp
TLSH
T18BD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7d8b577e14bdd9c7659e5d3293d3184b4279c87c6c7790a861f1ab1716ee499b
MD5 96c6c8940f3d115e78cf4831c5963729
SHA1 953d400530f815ff407d67a72e5c8d1873dbd78f
SHA512 c8c02d4634761acdcaa561b02ba85729933a31acfd1a8d41a90cc04673e4e7123b835700f8e6d7f70da0854b26fb91366f292ff6ecf5fb5e15e1b33c0b284127
SSDEEP 24576:1AhGL6IFoiwtA5l7S53Umb57GBiOl6a8JTth/RWZvR6wQQ92pN3:1AM5Foiq5zb5+Pl6bJTIZ5jdgp
TLSH
T1B5359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7224e1d195ab68fddc5ce197df5e8cb615ecbd22a261d5fbb0332b19e246af4a
MD5 226bc5b891ee8d3c33019057b4cf53ac
SHA1 e6fccb53013dcd6889f7091c5721dee49dd348a1
SHA512 f161ce102e4f8ded053285dbe22bb4582fc9f131c9bfd0b6d621be9f76be526e07ab47c6faaa3b07726f5ae6b98412c10f2bd041cab9757864ae3f6083b7231d
SSDEEP 24576:vwuGOWJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:vwNOnb5+Pl6bJTIZ5jdgp
TLSH
T1C975F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 fd64071aa0ae279dd38f227bd7c2bd60044bf894ea18c5dced9ad4b3ac99d2d0
MD5 8a10f8fdd58c12689595d8a4b1c9d308
SHA1 9686c9601c964f0dfaef58f4c08e4b920ef09ff0
SHA512 933328cbbc38c1d6d256aeec4342647c39221ec9e92dc5741462d9ebc894fdc3d5f59d28f63338d867deda7c601ed448f1c88019bd7c76bcd93a9414b53f1c81
SSDEEP 24576:EZu2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:zb5+Pl6bJTIZ5jdgp
TLSH
T19865128627A830F9E1A7523DCCE58B00E772B8529B7653DF4674056AAF33BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6c502573bc9cac55359c27a3b642737c5384e3d109dcc571d56e5bd4292f93f4
MD5 85fad4bab43ec2065f278b8979c44dfa
SHA1 558a99a4de49852942e2101e5584d14847c1ae1f
SHA512 76f3a69effbe9c870391727d7d17a5584a441eb041c806b623d2c34556b6f3e9e30b050c62db204eb6ec92d6a7684fb649642412480d45be6d3e68ce79c769eb
SSDEEP 98304:8QRQyi36YOcPDLvw2gAf+PN3cslgJTIZ5Bgp:jQyiKanX+PNMsT6p
TLSH
T131666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ff05ad67e0004177babd09bd43a3121d76d4dbff581b81d946a99d79da6d51af
MD5 fb46d248343037c43cd55c5ca9731603
SHA1 bdb6f55bded0db48ccfc818585741db119793c3b
SHA512 f8c40ca3e74ab758ec49a991a58ebb292607b1c947270518bf0c414d44eab6a8eecad092088d3aaf7c722168a02a61825d4cc0cf59a2f4232a688553682c29f1
SSDEEP 98304:FQRQyi36YOcPDLvw2gAf+PN3cslgJTIZ5Bgp:8QyiKanX+PNMsT6p
TLSH
T153666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7277304b1ec9b64250f7c03b5b652718aa0f39df22f32fb7de737bbbbf935e3f
MD5 299ebb2057ed94cd005a8873e77502ce
SHA1 34c04f4bb49c8d64317640df66fb1218e1dc8eae
SHA512 1100b474b713593c8013d3a08b6df4ea9d4def38cf74372388f9c9a51ea328f10350e544392ab8ef123089795c5b1ba5105805ea03862caa3fa7b5b699a389f5
SSDEEP 49152:D68Qg55nhkeWu7PNU3/Ab5+Pl6bJTIZ5jdgp:9thTRc/uslgJTIZ5Bgp
TLSH
T11BB55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b5e9bf413b2f14a88145c906bfe094e762ad0a2ad38cc1318fecf57f0c060ed7
MD5 2032872006888f1db6eff54f2d0d0d11
SHA1 25794ae258294b586580ef130aee201b6652b918
SHA512 ff32597784a124fa0620c2f3706c0d1486cbe2e9c93213553d89142fcd9cb838d34cd874b73b1d2a3e84e556bcfa4181527ded73db4358547c5ff30d1e5bda67
SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZZslgJTIZ5Bgp:iLIHRWhvsT6p
TLSH
T1BB167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fa48acf744e433cea85f5e5cfcd3abb7b03cd52b6a718d20d30ebea68cc2b3c1
MD5 b519066d8564badd42f195ee27126318
SHA1 9b5659aa722fe27e61f1790c57ada8606e7f1554
SHA512 e0dbedf51a846689ddb15a7737632b792bcdd2a5843a0f3c5311894e3417047f5a13718d456b47e761860a1fdcd1942e2ec777c330652f0815004a7cc11bb008
SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glOb5+Pl6bJTIZ5jdgp:7u6JmIxd2d0slgJTIZ5Bgp
TLSH
T11ED59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 455f6976f48c43769b754315553d70e7b1c2cc75b68b02ef4b39dec0e8eb5ac0
MD5 9305423a4f39581715c5e4aabc076b1f
SHA1 35026057e5378f9cc62276b5491e5cea4b75ada9
SHA512 928fb4c149d55df9deb8805d5cfa37880d1a094da04f23c68e9204fe68c8c4b10c2a620da1a67a357413d64465afeb42b7dafd2034c266c83631a583a6b5d714
SSDEEP 49152:u1hpsNoJpF1A67U44CwH7R4xib5+Pl6bJTIZ5jdgp:umifPqRnslgJTIZ5Bgp
TLSH
T134B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 55cf23de1fd4baa3b57851750ede4716749e8aa2a1f2db6db7f12f2bbca0edef
MD5 4fa52e56d49834f31a679a1212ffae3c
SHA1 f9eda9ce48384d51753b2ec67db6d57b00c9f2a8
SHA512 567ae03c457e00aefd8ac97766bbfe8747605a3f09a7898ab62ecfb958755cc41b2c02ff8b880e59983fadba73cb8137a683eaa682d67b0c7fed18f8bbf254a3
SSDEEP 49152:qSuZQIY0Be2KkRVtOnks6NMHq5b5+Pl6bJTIZ5jdgp:05dKqi61lslgJTIZ5Bgp
TLSH
T162C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2bc99738e5724708851294ec75dbdd704f3e7732dc494ce2863ff5cdefb07d2e
MD5 8596d597fa53f7c9ca2cfe7729e7dc95
SHA1 66783e2a9e7d0d0e0e90345b6c0ee66509b2e306
SHA512 3cb7edb9131c4e62095441a15aedf0571df03b754c13fbd81eac92f65d9a665eee3c71097cb1cd38eec9608a329b7d047ff7dc437a60540e42d38256a78b539c
SSDEEP 49152:ahtSn8EApI0figjgiDn0AP5w+b5+Pl6bJTIZ5jdgp:bX2iWph7slgJTIZ5Bgp
TLSH
T16C95BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 fbb4603c2dd1cdabd25f53078e62a5f95a6a7ac2e9ee0f89e74474fa477162ba
MD5 db6ce0a3c7273f8eee38870db0d881ff
SHA1 d76b2ade664d60645edab3e3031d78d2bad36b74
SHA512 cf5c406a6815d2f8c83eb1e73d1fb7d97ef1deb93cac66d0b95cb83949761f147c9e1d2763e35d0094c97346fd3d7561bed63bffc5326a5b164200e781ec1dc3
SSDEEP 24576:Vqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:zb5+Pl6bJTIZ5jdgp
TLSH
T1E8652387496B20CAE45B5739D9C8DB00F87EAF56DE8727B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 eb1b52c2602cb67212dfa05a58fc7a09f4c18c1ea86cc387cc48e1bcabb8554d
MD5 8300af233759478f87a54010144e4eab
SHA1 9f0bb8056796751734fe92d969fb202246148d7e
SHA512 22bf9bf2af57ededb13becaa56d6964c7a6aaf7e5e9ec13f10e146d2d139c74f00a281d80bfa7d8cceadbd731851b1922d9768cf0ff8f8b7b2498badbe5447e1
SSDEEP 24576:9hmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:yb5+Pl6bJTIZ5jdgp
TLSH
T1AA652387496B20C6E45B5739D9C8DB00F87DAF57EE8627B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 b938f94b0cfd04bf3c1a6ab5681926e772d9db37fb34f41ed83fcf5f7792f70c
MD5 7c9248edde9661aa41d5287efc91934c
SHA1 ceae2a766472c625237fab959e3bdbc5faa73f40
SHA512 67d82deb7158024cd879de24f03bda519b6693df5135844a9d77997221d442c99a69dd8ca4fd4dcf5ed62f802d4003c413a1a2305f9213b7dadc0c7565f45e32
SSDEEP 24576:Jzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Mb5+Pl6bJTIZ5jdgp
TLSH
T142652382896B20CAE05B5739D9C8DB00F87AAF57ED8737B6C57D0827F131389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 960dcb7108f5d2ddf42b21b8ffcfb748f1cbac26b5e8ccfb842052978d4c668d
MD5 f3a2a6fc500d065a1437724ed6cc9569
SHA1 8164eaaedba85be6278d87b215379c9d92016a1e
SHA512 55074ebf041ea720a2ce1cff822a3411651e9cdc649179fe6d7e220ac28e0e5f9b3e348226c8425aa2681d0094c7408acfc0cea3bde8d297ea1c101309ca5ddd
SSDEEP 24576:Hmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Gb5+Pl6bJTIZ5jdgp
TLSH
T13A6523424B6A20C5E4679339C9D5D700F4BABE96DF5267FFC675082BAA313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 0d6b59533d51550631286f98f938d553015c9705a2cc9f870a3c9748324a2da6
MD5 d295ab488125c519b208f220209fd9a5
SHA1 bdc7270c3910c91e14abb65069589eaf2948e064
SHA512 d25a7258169851fc439930ff00f20cd561d8ce4be12f95ebb2b8b72c82d90a6b14bb20de778dd2afabcabf19fea56b107d1cefb5d6a2258d45a9cfc0319dab02
SSDEEP 24576:1smb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Nb5+Pl6bJTIZ5jdgp
TLSH
T1C9652382896B20CAE05B5739D9C9DB00F87EAF57ED8627B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3676c156123ac5c7f6a6f67f37552ef2c41e2a0cef6a947cd90d203b27d9c8ea
MD5 68ddb83ed103dc5c52269d60d02f45bc
SHA1 e222cdfc13f5d1578ad3f05d6c570ef93581f974
SHA512 b855c59eebfafb0b74df12acac8543fade7ded719392b973faaf288a5062b489758363e58fde70cb12b691331d9c3c5be0bc0c409e1e6cf1c712268ac4cf4b28
SSDEEP 24576:e1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hb5+Pl6bJTIZ5jdgp
TLSH
T1B2652387496B20CAE05B5739D9C8DB00F879AF57EE8627B6C57D0827F231789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d11ae4bd835786be040ecba97b85e30af882bd6568bfe0183cb8f3e84ae4f408
MD5 cf84f5be5191db9a8cc7a4b9e1d77d41
SHA1 948acd35e3e756fedf249d5325b12ac21f7ef162
SHA512 6b3332b2ac01fd79ca774078d9a37e6573a47dc7fa0d7f9075eee7af278197cedde2c5ce27a2dd3d883bd1aeba74a0494eff90cc6653fb2bcedab0d10f585793
SSDEEP 24576:pZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:mb5+Pl6bJTIZ5jdgp
TLSH
T16D652387896B20CAE45B5739D9C8DB00F87EAF97DD8627B6C57D4827F231349381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 a4e20b984beff94061e3064ac9ce59cef6cec8c3ba2a0283c84931b411704e44
MD5 076cf33427d7972f360ec71cc574fb15
SHA1 fae779de7dbb1bb644d13a391a1224caea24f46e
SHA512 1815f59c4964fde99fdc4830a8e73f5d0af0e5fdb85462a77f451aa27638716b75f0e51774111a3e6e3065367c6250398df81a78d00cfcc9c882664fc5078c78
SSDEEP 24576:HZMazFVSOBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:HZMazfob5+Pl6bJTIZ5jdgp
TLSH
T10285F195B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 de763519ca3686e909ae053d77cd3c3209717c16e86100bc5ceb55eb965bfff9
MD5 7c52c42a3d4db19dc32300982bb4f4b4
SHA1 338c1cc74d2fad3a592cd193fac16efe024d2cb1
SHA512 673f60f0f2470c960c4787609d8954d23776c5d537f46ce8d14a5650c369aeaa8064b2818b3ed85c108c1fa4a299f0153ae4dad5552b3748afa324caa1d69c19
SSDEEP 24576:Ommb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Qb5+Pl6bJTIZ5jdgp
TLSH
T1A3652387896B20CAE45B5739D9C8DB00F87DAF97ED8627B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c5b336d8ddf67c252ce91e9bcae40714e8d9f9078b3c2649bcc4cc9569c7ed36
MD5 6a28f75978be251c4e07ae564208df95
SHA1 d0087b3cba0a61e7876dc9779ffb2444d842cca8
SHA512 11607d561d7eb439da003b438b153a30aadfef15efb1df40d720a1d785ea847142abe66b30e541ed518db8dc12cd5e748ba0f489bbabe4380a948287fd09fd55
SSDEEP 24576:Hymb57GBiOl6a8JTth/RWZvR6wQQ92pN3:db5+Pl6bJTIZ5jdgp
TLSH
T179652387496A20CAE45B5739D9C8DB00F87DAF57ED8727B6C57D0827F231389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5e1b29458771ba690b6a5a3d379d9d719c814613651505682aaee0aa84d33179
MD5 1d867bc17e7d04f53b1105efe76ade5e
SHA1 3735a36ff3d4ea4d62d3040af25426bf0ddfebd0
SHA512 81801d092b07563f6bcaf638f8ffbb78e71a29abfa998baa1132f52e4e74686002897bb2da456f9db1624069ab3a9f6e724b10b8fbf79ad16dd7b13d978f8d3c
SSDEEP 24576:uzydmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:uHb5+Pl6bJTIZ5jdgp
TLSH
T1B475024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 533de93c810a2d276951f8acec3275f32ea58d66efb8b348931aeae828a19861
MD5 af80f49cf9373698653cab3464596359
SHA1 96ca6c02704e5d9087580c7e37b73ea658b163e2
SHA512 0c5b6812ead16443feba2fe20131a2c25d2d785c8f7695e122afe343ed6fd99ea91f3e08efc710be3ccde1ef1743b7a7d65a2efa6f93a8dd2da57968dd4fdd9d
SSDEEP 24576:rmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Nb5+Pl6bJTIZ5jdgp
TLSH
T1A9652387896B20CAE45B5739D9C8DB00F87DAF97ED8627B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 9782df0cb00d125229a575336766f51628bb0148d5512ef1eca991468dc85cba
MD5 f1eb78dfbe7a34220e7393c6b6fddfec
SHA1 558cb926fbaac17e937cd337953f4e0e38f2e578
SHA512 53b0e98d4563eaeec944a3907fc74eff95b38e6ca718c1f2d592eb5b41261e9e498a8d84bebdba1b0fee2f4ae08dd625320053d7320d2c5f6b30a7c06c82bccc
SSDEEP 24576:Xmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:5b5+Pl6bJTIZ5jdgp
TLSH
T138652387896B20CAE45B5739D9C8DB00F87DAF97ED8627B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 bbb7e4bccb1c031680f8b9623c63c620d3f0dd48971d4b52bde2f51c5556bad5
MD5 bdde68cd98e4e9c12f038dbeaf028177
SHA1 a0256492e952836b21ce950a8af44a2243222579
SHA512 bd0a8f8ee2f69566e29f7c499f3009c241c3160734ce36abba968644d3a94bb3cecaba4519a96df66075cfa9fe1dca00ce476f4dafa76f85d9ca93ed4bb27df5
SSDEEP 24576:hzydmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:hHb5+Pl6bJTIZ5jdgp
TLSH
T1A075024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 654609ef3d12279be5ed68bc48c6cc772536815659ac7c06b16bb0da909db06b
MD5 58b938e80e6542d2e87cfd9f55f685e7
SHA1 d6a57d199319f9e5e95fc09d6349038ee8ef8c89
SHA512 6dd47dbc6891fd4f229e23c6b2a21b64f974871be7ae9803e385902dce78cadc9140e7a260bdb6bbd2f594ee16633f040184b91ac86b29fe442b58b3930a9aef
SSDEEP 24576:CT/aLl3z0zDDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:CTiLljfb5+Pl6bJTIZ5jdgp
TLSH
T15785F195B35018F8EC67823ECD958A05E5B27C5A4B60C75F43B8362B5F333912C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 860180142dc9088f47e97d3d9c65d6d0976ff896fc8d59d0c736bb7cb0c5fe57
MD5 cb82d82c4b66fda9f91543474fae7cde
SHA1 368efc5d1e0e1661b01d9d53fcf78c6c377cf09c
SHA512 a1245e454108813f0c4cc8cf2189566370425de1f15df9f87ef18fa54f2e290a9b472b5806b3edfb06b7c7dd398e5b9519728abb45306f3c0f74c0fbd865bdcc
SSDEEP 24576:+3Ud9CHKy7GZHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:AUd9CHKyaob5+Pl6bJTIZ5jdgp
TLSH
T16895CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 8ed7d89699bc8c139807caa2449e0e86a6544989d1abf6af69e1c716b12383a7
MD5 8779f8ba15a54a8e43dca1e5b40465a0
SHA1 39fbbadf40fc561c978437fa8d2b79acce19a6be
SHA512 5138e38bc9fddf78abeffc8c1192e2e6b6171cba27bce255c0ea33555b9961819f99c8fd4c72c0e6edfa95a85b22983ee003cb05a257569bf9189ea2baa73115
SSDEEP 24576:2Tmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:9b5+Pl6bJTIZ5jdgp
TLSH
T188652387896B20CAE45B5739D9C8DB00F87EAF97DD8627B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 db4534d9a09748b55f3477419b1ea499c8e7f49f0c79470aa88cb279d6106dd3
MD5 a7c1ea3f1a937ec2969e73899b90fe71
SHA1 b3df9d24d99a8a2784abfacce2d7ad1ee270ebf8
SHA512 7fcbf5b4b637c864139b90dae768bf5ef297b4f0740e0f69c0a22f546acc77a5edbbb40c9403640184f70deacbd19865733293c3034f71ca16ec6ae380f3d49f
SSDEEP 24576:t9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:2b5+Pl6bJTIZ5jdgp
TLSH
T1C46523864A6A20CAE05B5379D9C8DB00F87DAF56DD8727B6C67D0827F235789381224F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 b7642ae721bebdd0cd04b0ecf9fb5076d1b57e4b20f31621154409cc5e168ad3
MD5 3f7a62ee25a24cce4535efadf4dcef84
SHA1 533e8bc416310c968d91c123389f991b28560f9f
SHA512 9e9447d06e0b959c64f588a9b16244371815d697d22dc5f4a2f587b7601d466c4eded9a4243a50aabdeeff48ae6aff72a59f2469cb9456ede11f6435c2f63ab4
SSDEEP 24576:IAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Qb5+Pl6bJTIZ5jdgp
TLSH
T143652387896B20CAE45B5739D9C8DB00F879AF97ED8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 79ce33756b6109aae11b784cae6307c22eb0873452cf879d1c6d931b958d4299
MD5 22b2fee2574b0efabed57868895a420d
SHA1 11cb4704a032eba3b8e8b1df256d8d66014a867c
SHA512 29f7b9d46a964f409b40bbc1d76f85c3348f0f10e1612ff6978bdf90a0f62ccc9b40f4060afc8da023abedfd9f5c880c9db838e638602fac04243229c618182f
SSDEEP 24576:Jmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:3b5+Pl6bJTIZ5jdgp
TLSH
T1B4652387896B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 580df58f8ae4d8fe38c8b27f838ce54619d24a5adf561d35b044727e57dd55be
MD5 057eaaad85f5c4ea3aedd5306579e429
SHA1 a7b006853eb79cd50b2b74041cd04ecbaf3fd356
SHA512 729bd91029016b71f39cec650d8639a332193c791527ee6e2adfe8f3dcfb09d8fe480d35d5e09beec565afd6ca3b2cd347cb0b488cd0deabf45c4ac2820e8f61
SSDEEP 24576:FTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Qb5+Pl6bJTIZ5jdgp
TLSH
T1CB652387896B20CAE45B5739D9C9DB00F87AAF57ED8627B6C57D0827F131389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 832ad5e1fcab1620ab48dcb8bf2a0a0c73ec4940ebd5ee56e62c9238a9bd0b3c
MD5 8039bf255296eae92b1991896e40db37
SHA1 bd6a8b1aad987f83fdfe88ae45f2cbf8b71162c0
SHA512 3334ed48634fa4b938348a8b34d22f6e422a5c1302a9ea9b945cbf680cd9aebf36b1ee601cbe18164538a3840581a7fd73e8a76513abcf54a0a58cc672604727
SSDEEP 24576:C+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:8b5+Pl6bJTIZ5jdgp
TLSH
T1E36523868D6B20CAE45B5779D9C8DB00F87DAF96ED8727B6C57D0827F235349381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 f531cb15edfa3616396eca85b863d2a5e1352e7e0429623437e32b6cb53b580b
MD5 3c92b1454d6b05a4f868c860e4d6b402
SHA1 a520b76810fb09a4311368d4f4f04f7d7720e172
SHA512 5f83877168843511827ee3e3a2719ab294de7ddb0b824b80f933ec388d6ac0824ff387c2b19390730172f82484381689a13396ae897264b0512218d9cdf03225
SSDEEP 24576:Esmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ib5+Pl6bJTIZ5jdgp
TLSH
T142652382896B20C6E45B5739D9C9DB00F87EAF57ED8727B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 9693c33e7f3a1821718bd1f8bc320db0f8379169820c25ed1382a123bb5be563
MD5 63e22b3cab85a0bb726a6f4a862107a3
SHA1 0d99e36f4be6f559844833771c856e94e452a6d2
SHA512 780e6a582cae305e9b841dd55f486fe4c2c32d2766b6755525a795939382912c97a6cdc61935f240ac200f4f3e1ccda4929f0c9d921ab1cabb6f8002f8425457
SSDEEP 24576:m7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:1b5+Pl6bJTIZ5jdgp
TLSH
T17C6523864D6B20CAE45B5779D9C8DB00F87DAF96DD8727B6C57D0827F231349381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 a759970ee5ecf73829f97fec2b43acde19265675ddad8a5f06d937a402bb6995
MD5 85bd45fdaa5efe3421fb667e182002ea
SHA1 84977e826412498ea62846e66a58772cabe14d8c
SHA512 beca21182cb9ff1ddd5b2c107e2d9404940ed73f905493b8b30de5005b132607c55defed5de747333e6a8f1df86c6b67533864d4c2b5a2d5e933a06cc80d5ff5
SSDEEP 24576:csmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:wb5+Pl6bJTIZ5jdgp
TLSH
T197652383896B20C6E05B5739D9C9DB00F87EAF97ED8627B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 7fd2400c824c814c3a9724a2a512a98ab062aaa4958b9aa998eeafdc2283ec96
MD5 81d34b87b1d0e8f3e7885c8b990dfdca
SHA1 aae698aa14c13268775792c94716cf00e17cd4ed
SHA512 060f08d00a56fd5a74be19724780d00d6cf7605c3008a8f5f9c35209ae91a693d883c30d0d1a3252a5a3bb34ae228045bf2c11aeec11bfcb29869f2d5bc0d2bf
SSDEEP 24576:zfwvhk9RX6wkyAIimb57GBiOl6a8JTth/RWZvR6wQQ92pN3:gMnYItb5+Pl6bJTIZ5jdgp
TLSH
T17A95CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 af0c320b91702ce3ba98a32ccc1a623c6b6b047f0b636185771851c3e9f6feb9
MD5 3a781493075f5593de21af7a52f51eab
SHA1 fc80e35b1580c3c8cfb54bced561a4d70f370a22
SHA512 fa61d9e885b9450aaca95712758b94ae6ad30d0c769d6f9b742743faa51c74ac67e2a1718ec94096591b006b8c81650cdc316ca80d2817ec6619ba0491689278
SSDEEP 49152:ZYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eb5+Pl6bJTIZs:QySzP8slgJTIZ5Bgp
TLSH
T165066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bc5e726ac9d57502a2cc84a7184d8288d0f0b5d4daa2130be77857e371bf4897
MD5 c115c2802343e5fb476b687808fdeb7e
SHA1 d740f9a997ba4565d086ec8519d4183f59eab1e4
SHA512 78b72a5b209a5a315c10f94ea532a88b4bb75b2ff8aa43bbe22d2e3e86179fc3eff4f271351c3f1074596fb5c528c326137ffe99a982495f62764c85784cf285
SSDEEP 24576:u47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYxmb57GBiOl6a8JTth/RWZvR6wQQ92X:u47JUQjqirIhCnDHUPfF/Ob5+Pl6bJTl
TLSH
T1C665AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 ca9ffbdd6fe2a1e5381207e0734b650b58752bd7690c97e99d3908857c451ef6
MD5 3fb2922756e981ac32330e0584a972cb
SHA1 072cfed007e7f8e6fba6e6f40e55dc9b9de768e6
SHA512 426d79723fdc1bf04e6ee403a9c92626030e3c61830926883f8ddc3903ad553c3e558ceb386a62619cddc8c217279051ebb8961c987d2a132418dcc8d3c11799
SSDEEP 24576:c2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:6b5+Pl6bJTIZ5jdgp
TLSH
T11475F14AC29811D8D06F6239CB858A00F7777D659BE1A3DB86E0F43E1F366846DE6703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 992KB
SHA256 a3f1f381d1a83b245fdbabf1c3be68103722806cce3f5201df2d8347c4050601
MD5 3120f07fe873ca8d9017d9b269cd361a
SHA1 c51eff8e1ddc1cd9f36ad94037cdb8db0bdac0af
SHA512 9b8a11579ddc1cd403b9eabb9e2fec1788ee184f987eb6b1a63ecc563785faf37c27bc89f20d22f2947b6885c4756cded57fcbd4b6888fbbb03fccf5944f69a7
SSDEEP 12288:se+8zxU3fBkkwgFANpDRemLQONCAUn8LMeIJAkLuCgh:sZ8tUPqkwI0pdF08LMeI6kKL
TLSH
T11B250810762BC75FC6A940321E32C5CCAB707D41FE45AB0772C84B2FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 aaa15002e84aad93dd5524238fb826054bab610d0085eea28b0d7d220d78854a
MD5 805d4b23e9d0c1badb0bfe60cae5024e
SHA1 53919a14b8d7569671336988fbdd54c3c9be0948
SHA512 26834654a85fd55645fc704a477ab293cb49221292947ee37863bb2ad253577459cfb012318b881ccc8d10c48967dfcc1563cd581095d9c2e3c64bdda5d541dd
SSDEEP 12288:m4w2JAsnA3mAGaw4S5YGNvgBQGA2Ap9AxUA01AEILfC0MqPq/XotPfll/xsgAQZ6:m4wiLRAwfYD5h49VlSYwWVj
TLSH
T1DA65C7415537E38FD1FB2032072A5B4DA764EC4773096F2677C8493ED86AA26B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a8d444c5f30a54dd13f305657ab3e02551ea405b557240ac5541cc727ff24e8f
MD5 15af17f4a93b651beedca4d3c19460f5
SHA1 0640dd00cc01a9918577ac3c89d8518e81290c5a
SHA512 e9690318bde85782cef2be15d747f2324a79823fe97f6875150ccc34a89a84cd893801df95e0732a84affac8a888feced67be62af74bee5d6ba5ca7694c6eb0e
SSDEEP 24576:4Omb57GBiOl6a8JTth/RWZvR6wQQ92pN3:4xb5+Pl6bJTIZ5jdgp
TLSH
T1AD6522428A6A6086E4BB5738D8CDD710B83EBF65CF8566E7C579142BF1316C87C7220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1871b600ad9bee96e7eaad3c5bbfc1720715f6e500b02cad8c3d7e4fd7682076
MD5 07512209b693e0106c51520dbdf28a89
SHA1 029cc1681901bc07cf61ca0d4b0a6e0c733ecf11
SHA512 3f73466060ab457d16f7b7d64271ff18b972df83e0d147d89bbf8a5858e9a301d2eac9953f1698c036c1d16b092fb39da7ae49974e18faa4484b14bf72aec386
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYomb57GBiOl6a8JTth/RWZvR6wQQ92pN3:lgb4mBIBhGFMb5+Pl6bJTIZ5jdgp
TLSH
T191659E1E22EC02F5E0FAD2B8DDAA4417D6B278165731D2DF0151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 c87f2803b698f3f3d4415a2cc2e884b52c7ef0f7f53030246229cb8e24e1033f
MD5 edfb517d5718839c3865993442c165d5
SHA1 05b102a2923fbb034112d8d1b13e122add6c52d4
SHA512 180598108b207bbdb08a557c460a3b579b6a122b95290c99e557558c587f8da2b277ef4bf4c820459e9ee8f362cbf8ed5a370cd1e7767487876e20b99749ad5d
SSDEEP 24576:wG88u8FpJqH1ozria7/mBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:j7ZFPqVXa7/Xb5+Pl6bJTIZ5jdgp
TLSH
T14E95F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 3f9a01b304f0a969d442a1542a7b5c813fa5bba1891861560504111f42ca7392
MD5 5c39cd5e0aa363549e618b168c8612eb
SHA1 1a4d6c6857c69951dee5a6ca9923776b6dff8679
SHA512 d61ab93e6fbc90f6188c02b5f847b0927535e3b2ebfa08f0f22ee3401489b34655895909374f61dd1a83b5a0925ed27829b1348b46d52818983b85322ed105b0
SSDEEP 24576:pPUr+NQlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:pJQob5+Pl6bJTIZ5jdgp
TLSH
T17875E11F26AD18D5E67AA17DC9C68709F671B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d4f58cf85f2bf571576d10bffb639037e864e5e301039ba4d40731930642c924
MD5 ea8c51b2f366f103e230d5c8486a05fe
SHA1 c927b076aabc5e21cc5b89c2343e150e4cebe93f
SHA512 20532ddc2dccfe0b5799908203270c3397501eed72b2d06eb4c6cb885ba10a9f954accc13713fa174b05915afa90fe187ca4041081d528efc6ddb0fac1d982d3
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4b5+Pl6bJTIZ5jdgp:kG05lO43bBslgJTIZ5Bgp
TLSH
T144D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d068478b1a427960ec6ee7195ea5fbb22f430e9df48bbfd7fc65290ad1c4cdce
MD5 a4ff56a1d63b2f861d0109519ca9db60
SHA1 34d8feaab4d4fd55cc0ecd28dcebd1b1f3d83946
SHA512 0f561818b3886f800e00a6f8944320f513f30fbb72448dabdfadf3eeaf8d5cc8aac5af2217e5d4d3c519facccc4658fc71c097332ba3e020a75f516626ea0650
SSDEEP 24576:Hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnfmb57GBiOl6a8JTth/RWZvR6wQQ4:/a5POZ3lJt2pasx2+mAb5+Pl6bJTIZ5G
TLSH
T16665AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 468601f78deea29f65e3ebd786f9c4b2af03132d51c01dafa2afba274bccc359
MD5 a8f8cb5b6469d815676441d6280eaf56
SHA1 cd00e87d5ff91e708580a3e81fcfa36be6becbe6
SHA512 db0a70d04813c86dee229e02ddb0f523ac0aefb0fad46689bfade935f736f4b5ddc323b34852ff5f9b0ca9696405ec33b5c2031ab8640ac2ee44e1ac917e198c
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7Fkpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:VNc/zEOVHF3b5+Pl6bJTIZ5jdgp
TLSH
T1B4858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 98db2416d597ba599d9eae05681439d4aa68587061228d2ef225b9f32b3ba148
MD5 14f41c31792f50a104ab5457f8bfbbcd
SHA1 625c145fe9f20167b7dd7776d36508d6b42140b7
SHA512 94ef4dfc976286cc7e31ce9409c6083296c7271c13003899b678f6389146e7da7f18b025980dc27c1c1dd9a7cfa8a7e536a5836a45914a2029aeaaec5c045e4c
SSDEEP 24576:zzkNvNnaFeYhJNtmZBm7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:zzMwBtOmyb5+Pl6bJTIZ5jdgp
TLSH
T1A355AF6EAAB806E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 692df21abeea999f17ebb20b75c1571cf961548c8fa40c193065d0cb9f65383f
MD5 6c35c4f54a9075bf75665ff9ee51645c
SHA1 6a35dced1ed987bb4bfe4d3fe4fba459e73acba2
SHA512 214137934dcdb754dd97d4e148400c4653b47da889485191c2c4d54871e790201cd6ccdf76d4af722475ceba08d696c7b81885d54930507f557688ea8045473f
SSDEEP 24576:qD3FHshBIYQgAKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:qDVHeBIAA1b5+Pl6bJTIZ5jdgp
TLSH
T1AD85E27ED75D00E4E47BD27CDA938A06E67138A9472266DB02D481BA5F27FE43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-46-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1172-63-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1172-39-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/1172-40-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1172-61-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/1272-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1272-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1272-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1272-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1580-369-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1580-114-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1580-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3544-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3544-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3544-23-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3544-15-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3740-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3740-0-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/3740-87-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/3740-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3740-314-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/3740-310-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3740-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3904-269-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3904-51-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3904-57-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3904-50-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4092-292-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4092-67-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4092-73-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4092-65-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4312-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4312-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4312-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4312-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5404-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5404-366-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5404-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5404-107-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5404-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5404-101-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5444-132-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5444-126-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5444-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5444-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5444-138-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5744-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5744-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5744-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5744-382-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5744-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5744-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5788-379-0x0000029A6DB60000-0x0000029A6DD2A000-memory.dmp

Download

memory/5868-83-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/5868-77-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5868-78-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/5868-309-0x0000000000400000-0x000000000056A000-memory.dmp

Download