e6524df597e93132628a36420927d61ae9673be3238fd35226f02d2d9cb84df5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample260805-k2v16stdpf
SHA256 e6524df597e93132628a36420927d61ae9673be3238fd35226f02d2d9cb84df5
MD5 932ad3cf6513a85d4310c6c7f529ee12
SHA1 99dc77edefadbff89c0607bf717ddded6be4700b
SHA512 cbe69f24edcccf24bf8e6b626da5dd83445dbc939ecd3ace3cd6bfd668a3877c54081c4374ef95b4084473d821ad30f743510d7250816831122d69903f2cf399
SSDEEP 24576:qM1mrPSIwwcYqynQ/tbw/2Mkjy6Fr7g0o+:qM10XwgQ/lFTjN4
TLSH
T17675F12DE3A495FAE5B7D13CC8924507E6723C959BB1D38F0791195A2E333E08E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
480	elevation_service.exe
2820	elevation_service.exe
5640	maintenanceservice.exe
5292	OSE.EXE
4244	PerceptionSimulationService.exe
4968	perfhost.exe
52	ReFsDedupSvc.exe
5684	SensorDataService.exe
4172	ssh-agent.exe
5204	AgentService.exe
4548	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\50a92978b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c405dabbb924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b36c29fdb924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000613518bbb924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa0ec9fcb924dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016bbd4fcb924dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efcab7fcb924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051aecabab924dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000ca46dbcb924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
480	elevation_service.exe
480	elevation_service.exe
480	elevation_service.exe
480	elevation_service.exe
480	elevation_service.exe
480	elevation_service.exe
480	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3592	2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	52	ReFsDedupSvc.exe
Token: SeRestorePrivilege	52	ReFsDedupSvc.exe
Token: SeBackupPrivilege	52	ReFsDedupSvc.exe
Token: SeRestorePrivilege	52	ReFsDedupSvc.exe
Token: SeBackupPrivilege	52	ReFsDedupSvc.exe
Token: SeRestorePrivilege	52	ReFsDedupSvc.exe
Token: SeBackupPrivilege	52	ReFsDedupSvc.exe
Token: SeRestorePrivilege	52	ReFsDedupSvc.exe
Token: SeBackupPrivilege	52	ReFsDedupSvc.exe
Token: SeRestorePrivilege	52	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5204	AgentService.exe
Token: 33	4548	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4548	SearchIndexer.exe
Token: SeDebugPrivilege	480	elevation_service.exe
Token: SeDebugPrivilege	2820	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3484	4548	SearchIndexer.exe	100
PID 4548 wrote to memory of 3752	4548	SearchIndexer.exe	101
PID 4548 wrote to memory of 2188	4548	SearchIndexer.exe	102
PID 4548 wrote to memory of 4848	4548	SearchIndexer.exe	103
PID 4548 wrote to memory of 5584	4548	SearchIndexer.exe	105
PID 4548 wrote to memory of 684	4548	SearchIndexer.exe	106
PID 4548 wrote to memory of 1052	4548	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_932ad3cf6513a85d4310c6c7f529ee12_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5640

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5292

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4968

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:52

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5684

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4172

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b224334d48f0a4a8a1d05a55bfc281ec67d39be5e2b7f851d35843381fcd0b9f
MD5 d2a19cec1986a7cbd806c01a62069370
SHA1 35a52fc74fd070f33ae4f9dc418b0a9350cfa202
SHA512 b29c860738cafd3ace68df21766796baf5a110480b60d2fe6d1d7333bfc7b3eb0dfc9d8a0487452f74d42d2cde1ec8ab0854e376df84355789f362719a4e540a
SSDEEP 49152:jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnNQ/lFTjN4:B3q6HjBhLm
TLSH
T19CD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 bf418b2f3e090c280d386c152401c93920c961c40c18c3050bd65d8ae78887d0
MD5 15a71a29aa805826321c769165896b0a
SHA1 aceca29fa42a41f1ee04585dabc2798e3dd3e86b
SHA512 efaf0944d87cd0a4b99158d285879a8e84f6b730ab54e1d01bf937a5b9eedba1beb9c1878d28bf7a1677c34c35886728a75b14a347c8765f48dfb5c68f4d69ca
SSDEEP 12288:E1XLsswWkxy2lRq2czAKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:CXYfDtczAKnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1DE65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6d8e1a6ef67fb08f102f7534c21fc3c3f947b7786eb2e773ef1cce306332f9f8
MD5 8b26e943af567e9c8eb75f84e7da19ad
SHA1 4a983ad5a57c7dcbc50eb57a1aca109c9dea43ad
SHA512 876a2e20c6d7881924af72a5779a2a72f89ee752087a97a346d427cf7bf7a8c6de64fb0f90cc332a396ad44957a15310bfc8e0ee0968d1d03afcc4137f9328c1
SSDEEP 24576:Q0Le5ji0hmxLrMlnQ/tbw/2Mkjy6Fr7g0o5:QPji0AlEQ/lFTjN4
TLSH
T123859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dc88a599be398c76a0dc61c18638fc0135042ba9234c8f1f3187d30e8b85070a
MD5 a7aa553342b720dfdf62f0ab4cfc179b
SHA1 0dcb54dbdd5a1e2f8c672cc5f1c3d9bcbe60d398
SHA512 30b6f2862bad526ec18ba2fc0d4ada6dc64b4049ab38b6b58320e0257048ae6da7cf1ad5f5e6f82282d62f48e3666f6657a0cc8e0051ac47ec473b247c9029df
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyuTnQ/tbw/2Mkjy6Fr7g0oV:Y/ezSC6vUzPvxHjy4Q/lFTjN4
TLSH
T1E2755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c408143fe0a3532a7b82cbc02a8729ea09042b32496f347981b34746db357009
MD5 efbdd3fc9678c10d996797e4ac41f283
SHA1 e588412dc4b544925786c91b8a1e319e77622cb2
SHA512 d480e3fafe1bb439d4b3c47f475244d7b5502207558ce2d4d0a799289cf9a3bcae493c0162482852002afb8b20675dad94a6de1b923558df9511dab04bef0cca
SSDEEP 24576:xVbqPb88hv/l+6mnQ/tbw/2Mkjy6Fr7g0o1:xVO88hXl+pQ/lFTjN4
TLSH
T171559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 02c921631d7867b89844ca2e191384306ffd88aac92a402336d35fb86e9a707f
MD5 ecbf3c45e29335fa443aa6c1a8843eee
SHA1 ae5355eba7625227cbff7a8ccf1bf0b1bfbd53f4
SHA512 1135f8e882a658832352a6632f23f0de807a94cf9db4d87e2381c5d54205ecf633418a44dcfc918669d55869243f5f88917e312e12220d8daeb326f6c93de62c
SSDEEP 12288:4zhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:4zxnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1825523796A24F897FF2B06B15CD284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c0d740a908cb1396251f6d68fe1ccee212d73a6e70280398510b796d54848be6
MD5 641fd641b69c7213502eed730f966995
SHA1 dd609ce1f7feb01e59380d8f02bd7e267c5b35e9
SHA512 6897de2144c040c8bd146a18110f2064c52a18e982bfa0f9f13ef8efb88e04bbf3780be92e733780578f87ba10906e4b5bbcc5251ff2276db174467228859157
SSDEEP 12288:2eBNUbTVO86U+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:2JIU+nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1E175CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9c7d5a00285e1b68685596ca873479d6948da4099219eae4eb5a59b6d8e81d9c
MD5 774383a2efedd26c52d02972c899dfe1
SHA1 c6bdb6e96966d39fe0543543c0e643c4602ade2c
SHA512 96526c91a7b4a244c2e85e7c7ddcdb2e6bffecdc5ffde8e8c084e2879031a3fc76626b744558a6dcb34d682098936b5e11de49184a4abbed1a71983f8c5a0574
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:5QvGAdlCEL8c/yRNw5CILm
TLSH
T157267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 75d5347d39702cc712f648c684935551fcb2cfa5943bb731317f15665d5b7229
MD5 7f598499635180ab27b977de9a2e2977
SHA1 78dd5f1a83839da491888e9077f8fee73b19cece
SHA512 179eaa8fea930062f092c0f9e7bf39fdf78e1034d8e70bc72f48591e3e52e3f8e292988d9b455062ce314463d0346a705b354f89163dbf48f9ea5ba6377e6921
SSDEEP 12288:OAwSfxL/2Dc39DLLmt0LDQewsAj0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgg:zQewsAjUnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1CE75E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 60a75948bca04b145278d08e6fce3ac000eb42fc2b9fd11ce4c4074439c62e56
MD5 9e5f90f4911154606de5566e4fa6aaf2
SHA1 b8a7432c16a463ac69143fbd0becdace55cc0d4b
SHA512 91058517bdbd3c6db17ef82134ade9f85d764872c0983e988e6c5f64240997870937b2430b8829ff000000d1f25aec8156355ff1a601f3fd038531b6f68818dc
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHfL:EUEtQevvqc2W1cpV2EI32
TLSH
T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7b6f46b9d241cd5b8ea93cd95f27efb609d5bb38d929a7e499b9bba40ef1e9cc
MD5 fd09a913ac5634f60e7c644de4fd5c17
SHA1 8fa30e3d69653cacd4dbb0b268ec1f59380502e4
SHA512 6cb463554d027e289f8408aa83eb7061e3d464625b91004ea4177e5a98224a97237ef46dc1c6508ae624e308acb682a69afddfc3f7dbb1c0f1a1484f7a160e1a
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/z0Q/lFTjN4:OoqtVjnm8Lm
TLSH
T1FCD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 eb3858cf046070fd284cc6de15530aa366349b6e8a3135fbebf7dae6a6e779c1
MD5 8b3670ba533e32edf7fa8f90b2415fda
SHA1 ec51a4704f096cbd52b12abe415a3d070e9b7cb1
SHA512 1ec83b320c598817ef001fce87a9a5e85274cb4f05cf1deca1e2953273ae4991c44fb14ff177df495ecb2f44e5734ea81741b8aed698d5a8ff1dc676954db00d
SSDEEP 24576:uAhGLJIFoiwtA5l7S533nQ/tbw/2Mkjy6Fr7g0oo:uAMyFoiq5nQ/lFTjN4
TLSH
T13835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ba5b9f5e5cc7a866748ee6da431c142777fcce89bffd41a8a8fc5112161b7fd0
MD5 05ba6c9e0422cae1a39f89d966e235d0
SHA1 eb448f46b5410116239da11b6097ab1986496744
SHA512 3c4c9cecbb4ed7fe8cad3ac7950267b247c7f085e1c43600a43f559fe00588c69c294c20d3c009d854cbb4aa76c4466ca3c94be0d94ce92a3adee2eff90e8e30
SSDEEP 12288:imw5HEjsChN2BFgl0WDm+CDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM7:7wuHOWYnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1BC65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 46327eb164aeafbd9248e31cae8d8f6c56ed8607cc66f33afb81fbf25feddb76
MD5 dc78de4cc65cbea00a8777a3afab3fca
SHA1 7dd2c6cbd7354b45bf2ee1a563225033ed3a30cd
SHA512 d229dbe9b6e54c2b8a4bd7554c23b34dc40df14f7b8a46ee46f17bdd7cea52fb6cb1d8772da4bbb0f88478c1cca6cda59108e788b5a2cf10a83124e9f5b1001b
SSDEEP 12288:4XZ1IyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:AZudnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T12455126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 24ccb895f84d6576ddaf32953fad2e96fe0ef424c2a760c038992ced1928bc30
MD5 1afe66334ecb4d80da1ddec65e48689a
SHA1 8e5d44726eaeeda38b339444100d558b1bb3aa77
SHA512 9af711d944231d06c17f566ce9a7bd18132bb719b3d62a13aedbc10bc3f53838da7a8d58b9304957b6cda2a576fcd735f1360b88655c12f5344b561a4c471752
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:PQRQyi36YOcPQLvw2gAf+PN3NLm
TLSH
T13D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0e78e894081f4588194627b00fbdfde20ef9048e17787b59db0b6da2f22df391
MD5 32e389ff0f4fff4c1e4ca221c231f6aa
SHA1 9784defd10bfa5053ec502521f84727427baf7f6
SHA512 9a409b0c47e41e2bd5917048eb7e99382f9a63c244b2a72f58fd8fac906287efb5c5fe2af818107fcabe2f5088fa6a6a6bb16a80fa275ea13c7212c503861d99
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:DQRQyi36YOcPQLvw2gAf+PN3NLm
TLSH
T123667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d9fc7ae5a1eee59c1427dfcc7ff73a8357f3b1b6b9c683d2c3d5ba70212de655
MD5 d217a217c215c15de2fed08b56c89034
SHA1 c47c804d3669ede4e59b2ea31dde46aae42e0e49
SHA512 6d3b6d2f1f7d82c3aa924e79894f0992745d8ee2cee7e92ba31182dbeca8d1b4a37918d8175dacebbb184fc7e3ca96056fcd3ea83ff7da26b6a6a277d9ad1f4c
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0NnQ/tbw/2Mkjy6C:p68Qg55nhheWu7PNU3/EQ/lFTjN4
TLSH
T16DB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5dd18fac81b8fbe059f2bfc6d2b571b79ee5712ce4b9e030d2ec468b64bb5129
MD5 9c5e8959950e06a908240d7d360fa073
SHA1 ee071b4d23439adfe1c5f99b46303c9e2a58d8bd
SHA512 489b5df3702400b0060ea9f1a935ddf6454a091f2c65d3ea5de4dcc762efeb1712b9887ddef35dd1b8fce3b3439756b4e3e040e3fde5a3e3b70ae4f2d5a237d0
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:uy5112gYy5azzVvL69nLKnhZWLm
TLSH
T15F167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ca8732494f2e48034112f2e437de5679de18831916f095eebea690f6f8ac8362
MD5 afaebe4cb4f88959b917e8b905ebe71c
SHA1 9384e628a9c069ff276cbe49c28dcd909c37291e
SHA512 d4fc79864306ead81b12c79866e073ed5d70f4c148b923b3584a7c525a2c102a31c54ea4a8469e0e96f27521c7fda9d9f35418917a460e018e571d2935e5b368
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6Q/lFTjN4:Yu6JmVxd2d1Lm
TLSH
T1D1D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cf461389d921c0a395d2901a15d2f75f1bd0953a5f94e32504b15513120b4d15
MD5 ed2aeb357937c472b6040e412370197c
SHA1 b5f682dd225e3865d69795dfcaa8fb0eb9bc2f6d
SHA512 606eeb960a6a2cb6a50aaadf99aac84f0c26fdc8c81782a73c0cec2af8455cedf1a72a93b25f602fd1d7d18e98fb3966ef4149af489432b3e267f170f1f54495
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xeQ/lFTjN4:XmifPbR8Lm
TLSH
T1E1B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a46866795c6b76346c075d16c941e422dc0766d6755c6fb7e6d691b615035475
MD5 7782f03c2bc65d8ee95cddfac6f01f2e
SHA1 9104c8689ee177e17a50e69b3811d2e139b6439a
SHA512 ab3564978120de7bceb3ca83e9a433a763a6f632872e55eb27b9d4208ef2c78d7f0cfe76b6ba80ddd485b5914e95f69b6ce863ed1fa46d9a1b6afb600931676d
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqdQ/lFTjN4:G5dKTi61SLm
TLSH
T1ACC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 813b54ad8a9bacc1de2f9c5efee80944a1914fc7437078584ff221f87c3f7c36
MD5 9b045e1bcf5d368ea6eebcfac6fd3d8a
SHA1 f08e36621d02692891d75bd02f09aa4776d4b95b
SHA512 ee119b6aaa0940adfd0d11786f5e4b8edb3f8d347bcbd1e600932654a51af3fcf252c620ccc7d92a360331820616bf7709b2cab775e82158d6811fbe63b71111
SSDEEP 49152:ehtSn8EApI0figngiDn0AP5wKQ/lFTjN4:/X2iyphALm
TLSH
T1F095BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 244f9a37fdd20bb5fbc09d3bd14fcbafbc93a69cf61fde1e9a9ef9674f98fb9a
MD5 46558c0df98526cd9ecd66fa1a06799a
SHA1 36f389e1e2d9d22f1db90ae1bb188c71513bb9b9
SHA512 521c582355a23a6ce01d50544b622e8947c80c9e3963fd6afebaec1a2684365956a600c711a960ce1f0d0d07e24c6752b49f8d205146b0fe23d016a02ae47aa4
SSDEEP 12288:gZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:gpnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1455523697964F98BFA1706F18C828182A77F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e43b1dd366b7fdf63b2ed3dac03760c1eb0b003266b67e26b2d0fac2bb1a2816
MD5 28d256c1a97f1b745d7a735cbd2a07c0
SHA1 1162a5ffe6680671785384b40cf3b4304f0f9016
SHA512 e4bcc7ddc707e7a8c61f0dc2d86878289289b6a12f9194e9a2b3c22805697142d98c510a6bd35371ce6bc33cf7203fbf3ed7fba002137bebc335040c7f563d7b
SSDEEP 12288:7AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:7gnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1745523797965F98BFA1706F14C828182A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 11cac886113af319dd2bc70593fddbcca2cf5d341124160e89ff3b09f4a4e5ce
MD5 72a9bec55672b9328ff7ecb187a7a45f
SHA1 869032f4622764b1ac222fb3665a57e5d07ed2fc
SHA512 9ccbb87ed2388702e4843dfb22589a2e11b83027479c8f29a0e512abdb75c87f8acd3323644c93fc22fda3e57f87dc710e4d4a26c22622aace3a584535269717
SSDEEP 12288:s2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:sWnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1AA5523697965F98BFA1706F14C838182A77B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8e495e3953ba1699a300747f87de10a236a1319b5e77562dce77d4d553e3c9a7
MD5 87f86b3125d5cef3b8620e20c165476e
SHA1 96e275c5ef09ec8c42805214e3a6860a155ffd65
SHA512 5ac90d37b42ebdc4afde229b5267de31cb8f9a757f55e2b3c8475fa5dce6d42012a52636ece75b34a61a0a9003aa863c1477aae12390910dc083ee1536a9f745
SSDEEP 12288:9V3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:PnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1425523693A69F4C7F92742B4CC938142E7BB3DC5BBA1A3CF6B00111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 160b48693f1f959ad91d99afcd878aa84f9ef04ba67ccabd86e14d431d5121c2
MD5 52761314bf8c4a0f3eb5c47afd933ca5
SHA1 9a3417ecabd11e077ce4206316f1e5001bf54b2f
SHA512 73405b903b003b6ad89e028f92717f55ee83cef5b54f746e67fafeeffd635b9d8815b8fefc2b500ec593567f101e076dbfa91a45cfbe165f8dec01c0daabf6e1
SSDEEP 12288:t/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:tfnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1395523697965F98BFA1706F14C838182A77B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6e25da85301b7cce2b9a338577ba6dbb8522502e0b6451b503688dda378bfc24
MD5 d5e50ab918c1d15c0b1586c8d2defb5d
SHA1 459d2407365de44036310ae1a69c813157293dde
SHA512 e85fe182638613cba45571871d7646d925ffb9ad94d87ef1926f2ebe538ad1e09bab9c47f5b132a2f23e78815ac1339e328480cc74b30d3d5f840b751b71d395
SSDEEP 12288:3MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:3MnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1045523797965F98BFB1706F18C828182A73B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a27cf8743c74a5b7cc4639a47d40e11a8807e95fcd8ba73ce578d65afed959c0
MD5 14ddad777e2c5649eef4d396f47f22c5
SHA1 181defe183e37f439fdf66f1875de5f268a34156
SHA512 efaa2f77818a9c627e365561bc7d6dee686f898b2f8ee19ee30ba5dbf0ee2fab9e24513e046e8626c92abc275220068ae0e6ab6860646100a1e89f4abd1c83ab
SSDEEP 12288:VIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:VInQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1745523797965F98BFB2706F18C828182977B0EC6BFD1938F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7d90be999cbf941b02f242b3f9431563ab8e06c96f59d8f4ba0a0cc015235349
MD5 041826c8308e70eee09c764d1d5f4161
SHA1 c22996882cea95c0f5d338e7e3f9b413c82cb3a4
SHA512 794cbae0f0fa68e93b889f201047cd2c69f40da0a25430a588aec452dd26810daf84a13d5befa978293298a79435f23176cc3271e421fd7d196947269562ba19
SSDEEP 12288:TiZwbDzzFEoS2cPvygGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:+ZM3zFVSOAnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T10C7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5854478f910aac0b4c1e315d437e5badf9e180117052d5ac5b71dfdfd2e4d474
MD5 8d413aceb7719ed0d658590834448a9b
SHA1 98ee519e75ec19ccc26f9a49ee2a1d89ac5b303e
SHA512 109e38f82b5091f5fbaf847824928f80dbab07785ab751ec9df0e015ff1667061b503a483696626565504bfc9a6bc36e405f293f45295cf4183b6448b9ac67a8
SSDEEP 12288:bNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:btnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1895523697965F88BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 92089528d1b3e61703b07c06210edfd4426649a45ef3b9399f88dd6d29770085
MD5 5faaf8a964e7930b6c03b93a28a5bf88
SHA1 685399b34f55f0b4e5be6d92b33bb363f95cd44b
SHA512 f146e812850809f0c7ded2a043478d6f310e27be65515f1bdb9ad7d0cd8025e71a3dd2b75961b798a8bb03f878c679bf40a5c8ec1308366f8b347bb7f8b9de65
SSDEEP 12288:oxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:oBnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1A05523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 878ab1cb824d4dfb56eb04b9bb3936773326b1be9fc1b74398b624ebec47db6c
MD5 2e40fcad8487c7edd1172102d1dc8a2b
SHA1 96bad3fa51b4a27aed035cf2e2c0ce6a63f6bffc
SHA512 401d19d65f393374e109b0f24861f003bc6bb95645645c9479caa226a8cd66a4285984dd6c960ea572a694b045b027f5f108bbfc6f78573cf709aa99cfbb1efc
SSDEEP 12288:byPz5L8EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:WzyknQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1DE65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 daf2e7d84cd5d692f6ff4752843445468847542f31a28d500a14fd821e89cfd3
MD5 4d9077ba5d5b0523dde67065025b00aa
SHA1 d5b62ab3f974e64998a8549f84840225d1b5187b
SHA512 068f9f715644ee73675753aacf400825e9638a89f5dfc9c69671853ab4c28c4df103f5ac6e79fbf1aa9df5bf546dd71ca642f0c1c7f4578e5f3edc8dd88344ab
SSDEEP 12288:jNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:jtnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1565523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 feb16faab8d5508af761a643ab31be0d6c3e91094194afa95201499ddaf37c57
MD5 27e06fd6c799dc4b5ba40529cbf3eeb7
SHA1 fd27d9eb09def07110d97fc47755669d13afeba9
SHA512 a28808c69b961f57df4d6ae50b5a89efa17da0eeb2280860a067c25624fad89aa462782358850645325b44323148af3dfd0f67126aa875dd69b686b47259ed34
SSDEEP 12288:6NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:6tnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T14F5523697965F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 dd7b3ffc8e2f82d7f3841e4326569dbb59586b9f84eb1f776711375130b1b362
MD5 66f782e0432a0b2a53a7053d54c23ac6
SHA1 a66d4f628fe3a95f4f4fdecc4230df1d292a8366
SHA512 a819dba565a8bf5d399d3ab8a8c47c396e90b3e9c51129bb49a3d87e54c8bc6a20f02130903630ceb16c96adaaa22583eb9587be0bae64927699d29ddccf1065
SSDEEP 12288:oyPz5L8EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:pzyknQ/tbw/2Mkjy6Fr7g0oS
TLSH
T14565021B73A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c8842608d16193046c93ee317f2a1c2638b4a7578b66feafc2e4937c482ca0e0
MD5 f0abc0022cb607c217ad26b41aefd4cc
SHA1 d8826e1d52ce20dd2983de73da75d5d22a8f1f4d
SHA512 90fd1b7b3f7abc066b1c9b565f3b648a51e01a7ba841d1f049848ea1e5bdf3470c1e69f192c1e74ea862ec9c206eb3891a9cb00d3fc81febc97a8fffadfd8be8
SSDEEP 24576:LT0aLl3z0zDGnQ/tbw/2Mkjy6Fr7g0o9:LTDLljTQ/lFTjN4
TLSH
T13F7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a84b7b79fdd00c0a910798bf9eff7bbd0a7e8da76ca96204a60192311a532d1e
MD5 da08a0d50e1d3683caf5ba560445167e
SHA1 cd7ef0357c0b1f795dbfab96d1ec9690dd7bb260
SHA512 fa9d2d8afc957c027ea5ffdbc59fd5b07ad5c2542be2d8b253e5c5ca1f3f0c5e3945e6957100220bc6c0a3eaf7148b582f7d006dd0842c7e1885e59c294255f3
SSDEEP 24576:n31d9CHKy7GZinQ/tbw/2Mkjy6Fr7g0o/:31d9CHKyacQ/lFTjN4
TLSH
T1C385CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d76ac554342c3294ee735c8b0acc15227b0b83154515e14475a84043fcec4c8e
MD5 28194bf287ded6e62c0713887ea491c3
SHA1 911b02affffc01b4718b9c6c6f32eb876d2cb7a0
SHA512 07840d0201c75821e63b9c1bc0dd8c65ec0ac4f70a70a95bcc53ec8f8c2d63e7d339258428d9987f7c504592c23f12ef3288fce6b645485e8ba66925c6fcdd8b
SSDEEP 12288:xWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:x2nQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1F65523697965F98BFA1706F18C838182A77B0EC6BFD1938F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 170594aaf612a17e1c00078a705687ab9e920511b954abc4123e21db5e56e5bd
MD5 34673985cb6100cad4efefb08390c28a
SHA1 c0c5f5273df7d223a392e44355ea028c310571d1
SHA512 d66dc0b093b8196361e9b1f4712ed0875609c6d709b892e204a30024a31306d1815d141269ea06c23f100f43dbea3d4734f7dd19b63fcf78e8b7b7a7655bef38
SSDEEP 12288:XkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:XEnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1535523787964F99BFA2B06F14CC38182A77B0EC6BFD1938F7B481129967D39406C6784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7b5d050d898f26db2fdc654f2125fd3ebce720ec3206a2e179416fc41bc5236a
MD5 e3afd06cd223943a3d50aa6fe5e5a878
SHA1 f55ff7c289b4b2b3b849b2bae71f6c603c4c2efe
SHA512 5978af83f601fcf3dda772fc0a8e9819d7efda0b009305e49b589c1ca3600bcd33a9e00646f48d0a2c4708502697bd37aa500308683e8864ba46f14d87439c7f
SSDEEP 12288:QrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:QbnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1C55523697965F88BFA1706F5888281829B7B0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c3e442b598cee78c99a29683aa111ed01c3493b48f8e028bf90141903460351e
MD5 670914fa100c1c7e6fcfe426954d998c
SHA1 75df656d852fa21610582b63eea5c9f1a0905866
SHA512 dec128a3a99cfbd67ec69e47d2eae93ef85df898d17bbedb930f11ac4dc09072340ac98acdebd311ad4a706e4f206499d913383d776fcf5fab9125e613b4b8f3
SSDEEP 12288:4NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:4tnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T11B5523697965F88BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 380fb1013eadfdc4392942f259aed5102a5356712df98068dcb58bcd8fb445c5
MD5 f2e8ef96d787609d9340e0eff46609d0
SHA1 d45b6a653146e189c502dca142d709560ab4b0c8
SHA512 50aadfb8eafb04b1b88fac40c71a1543f7d0692615f28a89b77be6176c238df9216e57e60c65ac076618dd69863d56403527109da9082000a624d02e85db7b14
SSDEEP 12288:FWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:F2nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1C55523697965F98BFA1706F14C838182A77B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 744c1028931e37fe8525d7c7a10402fb31e232103f1d3383587430b40d0f07a5
MD5 d98c7133b84bfad91ca3d344b6fea108
SHA1 2e984c4edf4f7364a858dc15e97145b5d92ac5ae
SHA512 89d905a3575aae71bf5d82837601fdda9a79ab3180560c46c85e46808b6448e0498b0d6e800f3b97f9bc9c04bee4b1f9bb455d6a3e071497e0afd5bcdc40a6d1
SSDEEP 12288:11GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:1VnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1275523697965F98BFB1706F18C8281829B7F0EC6BFD1938F7B481129967C39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3da6b6b0fb239c5a287ade0429ab10da49a11e50f00a4612829467d977fdfba1
MD5 970822d8fbbcf23f6b77e42edf8dd365
SHA1 a885f272e7a52dd0be1b8afa70c90500a553a593
SHA512 a40a405c0220fb328b47ed4b6eeb61a54eed6166930b3b9f8a3e5f286b49ed58f2acc6d4a65afbb0f19dd19c18ae8f97849f81550e6bd63ebdeab2c687c0d097
SSDEEP 12288:+/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:+fnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1B45523697925F98BFA1706F14C838182AB7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 fc6be273b00efa9d8eae33625c257708168c40bc8bb71fbbed660744d948bdba
MD5 0a2bdf1a9adf3133faaad981e0eb38ca
SHA1 b1ccde49737b08b67485f347862bbd76c2b37473
SHA512 9ccc2e9a56e80d8e33aaccdfc8d5d5f4b1090e72dc0cc8a6f0a25b4c821854ffbcaa0c9f8f8f5e4647adb30a05570661506fccc8133770a76be6101f05a9f8b7
SSDEEP 12288:7OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:7OnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1AC5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967C39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 db624fbb4e66df0747afb88d7c05693ab37f1699efd7c52154402e5652d49a5d
MD5 5cd843b7447f5394306828ed287d9949
SHA1 817a642d5ffbc852ef6490d3ee7b06a1185afd31
SHA512 b7f58cd23c4a7c84870154179fa9486a00ab3453a8358d425c76503fb345d9d9fc06d06911b404183943730541602415b73a24e957acdec12435b2193ff4518f
SSDEEP 24576:qfwv/k9RX6wkyAIRnQ/tbw/2Mkjy6Fr7g0o1:BMnYIRQ/lFTjN4
TLSH
T13185DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3ea6ab4f17d92956ccb04ea33d436a1c6db5b81b0cf8df301c6a5697b9de290f
MD5 c01333ae7e501654cc376df51fcc62b0
SHA1 67bf41ae04850c0bc9485bf7c377978b6ebfcc41
SHA512 f9868a59e60df9d2570f2f02eb5918fede41323af6781f182f0725725e2cea109155d7187ead25d5bffbf9b2de9c5b033a181745b36230377bdf895b38a9a8b3
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qQ/lFTjN4:MySzPtLm
TLSH
T108066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3ee18b5571e8d30f48940383993966c4867840987fbe1824b68bc1171df644b0
MD5 51f8c925bb1eec3d691c1a2d69bccfb9
SHA1 5f524e74b2196f8a1f2e97cc54268cee98920447
SHA512 ca2840328512f50af1082e666dbc5e61807b04a8315dbb493c8425c77be5b12d44771b1c9b159893101bac26b4f8bcbce6d3f4938e75c18a4291fda2fda648ab
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYQnQ/tbw/2Mkjy6Fr7g0o9:k47JUQj1irIhCnDHUPfF/6Q/lFTjN4
TLSH
T1A265AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7bb9f0c1afe2b5ab200620e2332f41a3d6f125838466dd384eec23ac63159a87
MD5 f387841123760896a7dca8bc871a5d8e
SHA1 3732cd20cad6aae53f76378910e6fa5e65e201d7
SHA512 ee3e0ddfe84bec2ef421b8b81b05c40f77dc36642ea661c1e1133f0b92707136fb3e8340900727a2e23849840eeae282c9b1a0895a59122ba24aa32a151baaa4
SSDEEP 12288:nssf9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:rdnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1AF65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 22c644c69e5c503e54efa08bfe8a99c23d81ef32c66215779760805b7ed869b3
MD5 07c6107e5e0903e92696801401dd8021
SHA1 cff272f96a189bde65afba5066a675b65ab6e047
SHA512 3ebbc7e6c1ae04f3b3a604e654bdde45e66b7de0a86d951df1d07719e96a5e1e121aefe57b77ce21f98befd74437c3ab77e2f9bd419844404162787c8dee9152
SSDEEP 6144:OUsBC2naxe8Mrbi0S21NCvotMx766iU3fZk2C+8y7BwPYI1EI1vF5AYcrcK1fR2+:OdMWbKEU3f3C+ULFjc2CU14XN/AarR
TLSH
T17B351740766AD75FC6A940321E33D1CCAB707D41EE05AB0373C9873FD576669BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d1983898a09ffe7208ef100448e1ca3bde4495cd4cec49351f9de1427751f297
MD5 91055555390ee419415f5d1e0f39c167
SHA1 e0c2aa4f4a63c3fa7baae8b46445eaefcf58eca4
SHA512 021ce46210b19294680da725cb64c42a12242bd05cbbf892b902c300211281d3217dfc90dd6073fa6a3fb89c3e789991d93df5d347051b317c0217f2352199c5
SSDEEP 6144:PLWOp8R2R4xllS5mGMaI1TrG7oQbW4C3tMxh4C3tMx+AYUahh1TYXSXcIX7O3:PLWOpCnrE7fO3
TLSH
T19F65D8815137E3CFC1F76032072A5B4CABA4DC56B7096F26B3C8453AD82A725A4F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 649bcfccb75c18eb0503e488050566adf1f05317488b89e6ca8b6673a63bab13
MD5 b94b682046f640161deab3918c7f3e89
SHA1 a35f9ad0768c9b8196c49da65e2982d5a6b9d84e
SHA512 35bd647b098f4788826f74290e2b7add58e11ce284c3a55cbe277e1ffd9a6c4e408e9fb7c3908da3d7aab6e01431e5dd2db4889e1e67edc9cb2a0d3aae9a736d
SSDEEP 12288:r67lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:yFnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T16E5523796668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 30859caa5f333a787beaff6dd3bea34fafc41f5bfcd8d8eb91c0a392dec71707
MD5 3c9d4078eb1dfeaafd3c7e1b66881786
SHA1 15a19efd5b0164b4080b7fee389b473720818e35
SHA512 333b1be2174801018b086217966ec1be6d7341f084066b358384c5af5d241eaf362c29c0704386f76b49415688d4e99a82bacdddb05f900ae974af993d76f7d8
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYTnQ/tbw/2Mkjy6Fr7g0oV:ygb4mBIBhGFQQ/lFTjN4
TLSH
T11F65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 c5b7460517dcad166429b509f4065db6efec63d0d28eb451f4234df5d6c0c118
MD5 982eaeaf83cdd6c1ad1e61981366d93a
SHA1 02e9ee4a569d45bdaf50cec0f7ede0f881965d92
SHA512 172b8c7012c113aad4286d1b7f9f2b11eb2185ea2609be63642c3ba2096ec684fc6f73ce8d4c1220b487f41637b10e83085e81f3f8530ad2fda8af98c92414b0
SSDEEP 24576:NG88u8FpJqH1Qzria7/mAnQ/tbw/2Mkjy6Fr7g0oZ:A7ZFPqVva7/7Q/lFTjN4
TLSH
T1AB85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9bf358bce509190bbf1452de474e499e8e94753a33152bc4632ed428084ad900
MD5 95daa9e5b6be921aa2d13c500ece740f
SHA1 926052f5f16bcbba4a154ae9e2aa62ba2a981b73
SHA512 d111a18297a56923295949ed0773ef74d622aa3f3865829c92c5e5df2c22e2471c6dea96ee71c548a522a8c86646e3cceea402d366354e2aa9b4ebd9c7cc40ca
SSDEEP 12288:SHvUrBFrEjwaQcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:SPUr+NQcnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T17765E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c31504130fcb5382448d7441edb71d44d453d08eda802e387e32b7f5edd44bb7
MD5 833791823f891ee45870988c9566e031
SHA1 3ddf30c3f7367ddb84cd351d6b4378e8f891f2e8
SHA512 4e5fcd92a5c580772611c6d619958dc91b06fd2ef4316e873bb957b9d2b462a0a1ee8e3cdb5f512176b3d0a7ee8dc45b0e34a0d8875d5ef4d217ed8f471852e6
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMQ/lFTjN4:mG05lO43buLm
TLSH
T1FAD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 62d690e03ec4bf08dfcaedd7da8e29a5631b28d172ecaae7197f5f4c8edf5534
MD5 87fdc8c699acb824ff0270dac0aa0572
SHA1 33b6b1cb783e05761ddb4af828182776b9d082ea
SHA512 07abd8c6cabd00376929b701fdcce14a1e5ec4aecb08be4b7221601e8a948df34eedc804b4257cfceb7dccfb20cd14be692a690910cc635d00e5acc4746c6362
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqnQ/tbw/2Mkjy6Fr7g0oi:Ca5POZ3+Jt2pasx2+mEQ/lFTjN4
TLSH
T10A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a479fb3c6d41e467be0c7eab73fe4d521d3316410647c328a1339369cb861bad
MD5 2bd604b1efdc36dd94562ae97ae31bce
SHA1 87a82677c442044f4b5c89894dd88f0fe23dc97c
SHA512 b6a685e700ac374bb8461f1705f5c99a8cdf23943b22a0fc168572459b9643fa8f350da9f6639e4e5634e9a4c963469147af12aea3232e7e3a9f48c5f064ee4f
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7Fk4nQ/tbw/2Mkjy6Fr7g0oT:xNc/zEOVHFbQ/lFTjN4
TLSH
T164858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7ce526d7f49200a6d666c153aeb6e8fc25540e701c83153c191659895e1a9ebf
MD5 7124c8443bbc47f58ee146a61cfb8805
SHA1 b2da44c70f02d8d1ac247379a975960bf2731cb1
SHA512 fdd72422e4a4b7c0a096655a20c54550f917d58d746f7e62849ef1331881e98fc86f6c435efe053763dbc2a4d12596cb75dcf257728869f6121bb13aeb8b89fc
SSDEEP 24576:u8kNvNnaFeYhJNtmZBmOnQ/tbw/2Mkjy6Fr7g0oE:u8MwBtOmOQ/lFTjN4
TLSH
T1DC55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 69ffb461d58d35cf2c75640d2df97c8441bdf7a56ce7918b150aca33cdfb5b95
MD5 f9db1219f20a6307870a64d9808d84f8
SHA1 96be904a1c4c91123334ec17f8c616ae2de83933
SHA512 c6d852b5daf8820cf5fef27f35b29b485b72af284ac830fdc563079b164d19d3c8052b52f6d8f7f649f9035e08cc9f4be3e4c2f57f260e506be6598f785798ff
SSDEEP 24576:yD3FHshBIYQgAJnQ/tbw/2Mkjy6Fr7g0o5:yDVHeBIAAJQ/lFTjN4
TLSH
T15175E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-380-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/52-378-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/52-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/52-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/52-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/52-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/480-15-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/480-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/480-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/480-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/480-23-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2820-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2820-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2820-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2820-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3592-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3592-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3592-86-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/3592-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3592-319-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/3592-316-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/3592-0-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/4172-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4172-119-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4172-113-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4172-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4244-293-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4244-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4244-66-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4244-72-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4548-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4548-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4548-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4548-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4968-77-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4968-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4968-82-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4968-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5204-132-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5204-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5204-137-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5204-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5292-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5292-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5292-276-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5292-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5640-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5640-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5640-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5640-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5640-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5684-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5684-312-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5684-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5684-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5684-100-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5684-106-0x00000000007D0000-0x0000000000830000-memory.dmp

Download