66dce74dae3a9426f26fc79b34c344e34968373b19f20f3d6d8b1ee9e33e72a2

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
Size 1.7MB
Sample260805-sg8qjazalg
SHA256 66dce74dae3a9426f26fc79b34c344e34968373b19f20f3d6d8b1ee9e33e72a2
MD5 f1bc01f60839be6667aded08bad64d53
SHA1 5b2bbee4a63cf9f065c175a65804467202e787b2
SHA512 ad9719405467f26cf58504d9443e92662d484ec3ebd2de45197b59350eb568fdbd709933391e5d03c636a9f66be8f743bd90cc579eb66084c4ac7badd60b4b4c
SSDEEP 12288:MHDmD+0wJ1BwM+0ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:MHDfaM+g9Xozsr8zbhN6GwXOGIh4
TLSH
T12F85F043F2AD7CEDE166823449714591AB32FC351780968F13B57B662E33293BD2AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4836	elevation_service.exe
2908	elevation_service.exe
5892	maintenanceservice.exe
4276	OSE.EXE
1392	PerceptionSimulationService.exe
5684	perfhost.exe
5784	ReFsDedupSvc.exe
4408	SensorDataService.exe
5212	ssh-agent.exe
2824	AgentService.exe
3364	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\88c8444f83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ab3b9521ec24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eba55422ec24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffd23c21ec24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ec56520ec24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e03e15dec24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000835ddf20ec24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4836	elevation_service.exe
4836	elevation_service.exe
4836	elevation_service.exe
4836	elevation_service.exe
4836	elevation_service.exe
4836	elevation_service.exe
4836	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5448	2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
Token: SeBackupPrivilege	5784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5784	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2824	AgentService.exe
Token: 33	3364	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3364	SearchIndexer.exe
Token: SeDebugPrivilege	4836	elevation_service.exe
Token: SeDebugPrivilege	2908	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2724	3364	SearchIndexer.exe	100
PID 3364 wrote to memory of 1216	3364	SearchIndexer.exe	101
PID 3364 wrote to memory of 1948	3364	SearchIndexer.exe	102
PID 3364 wrote to memory of 4080	3364	SearchIndexer.exe	103
PID 3364 wrote to memory of 5844	3364	SearchIndexer.exe	107
PID 3364 wrote to memory of 2120	3364	SearchIndexer.exe	108
PID 3364 wrote to memory of 4072	3364	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_f1bc01f60839be6667aded08bad64d53_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5892

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5684

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4408

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5212

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 15a2e443f6cc66fb75c9b1243048015dcf7216473a5592fc9964fd18d123f47f
MD5 25474dc520ce32b9e53f76908c4e2a93
SHA1 c09e197ec4e41b714f1477fff630e5aa3df13d66
SHA512 26a1566bf9f0d654c194deb8b8aa3ed60b671004b3f8ef86839c81fb8012e713bf24d2d9282d86bceae05ec7949c0844c42a66d4686687537af06fc980736629
SSDEEP 49152:+b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnRXozsr8zlLwJIh:A3q60jBcwFRKIh
TLSH
T197D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 eda78ca0ae6b5827f5cd13dece489e3a54e5aa9c6422ec85b14a5a1b56348116
MD5 652d5fd66158ee88ecac45a588acd180
SHA1 666ec4d1e4725cd518ce59886fa224c8cced05f4
SHA512 e2b3adf5a16f42a87d7ca1e7296e6df8e2312f0815d11b3307b894cf901a107cae5c690fc5f6dd0be98a3fb896a673f303f3bd2aa2e60512c66b6fb9ef46f850
SSDEEP 12288:b1XLsswWkxy2lRq2czA+ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:hXYfDtczAy9Xozsr8zbhN6GwXOGIh4
TLSH
T1E1850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 7ef0e7f95bb0683ebae1f56fde3683abf66e6749c57c642817f943b3d061234c
MD5 5ce443a1ec31afa1ea7a23e86eae3302
SHA1 3f863b0169b518b1a3dcbe3d54a99d458ea0b606
SHA512 c3be280c1e7aac3c07902a69e78225758c64f78686b7f911038af4ab5b0b296ac0964b8a6e44903ef717863b65cd0501c86efd97c456b8ec62282d83b79de165
SSDEEP 24576:j0Le5ji0hmx3rMz9Xozsr8zbhN6GwXOGIh4:jPji0AhuXozsr8zlLwJIh
TLSH
T167A5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 58d28f7c044e5fe8eb84e9906c123ecf702b0504981f79d8432ef31002b4a640
MD5 a5a2ac7105a81bc8cc574740435119e4
SHA1 81e120157de70ad5a780c6a7ead8865b2c691727
SHA512 5710a10d7e1af798c7ba3325bc6376b191789410247a00b50ef0e3f7812c830654746d0f1c4e34b7ebf18c8210b53f8b0b7db385f9b319e94cf27b879bca2d28
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWr6q8wyu59Xozsr8zbhN6GwXOGIh4:H/ezSC6vUzPviHjyiXozsr8zlLwJIh
TLSH
T1B7755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3ee268690ce7f3387a44ba3009f61ad92b55ed275cdd89d4b8bb2c02aefd2938
MD5 1d12a45400da989b77eab9d9b08e893b
SHA1 a9913af83ff94ef95e21f2c76009bb963a282290
SHA512 e5da2d1d5d3f527dce32e9b0f6f8366cba516713a94c911b14cf23323189398d15a3934ba623db2d38088dbbf2a556ed52b4e202880dabfa42801a5a78886b69
SSDEEP 24576:WVbqPb88hv/l+bO9Xozsr8zbhN6GwXOGIh4:WVO88hXl+4Xozsr8zlLwJIh
TLSH
T14255AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 7af1860d1df6d8406fe9e04e05192104c08c89f3c649c1f26fa30a3407a5706f
MD5 da9c87c2e12e6d9f918b1a40b5714790
SHA1 b2edc5dec09de24f801dd74218e7331a87a77bcc
SHA512 05e33c0a9b81a20c1fb3b1ac2b9029cd23e99f9b35f7e30e81e433c088e356f26ddb93f31e3f0e59db4f2c350c954c66e348075353eaa359279855d22a330dde
SSDEEP 12288:3RBksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3Rf9Xozsr8zbhN6GwXOGIh4
TLSH
T17C6523F7E691A442EF671F3139916AC4DAA7FD9E49C11B8112382186CC7E476FE21332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 d44221484e42dfbdf55590039a1a6dd2e8a2d969db167e80000e8e1bb19dd18b
MD5 ea28ba9f87fa8e1fbc487f958ce8f443
SHA1 789a4011136014a78276bc2b52e8082325524248
SHA512 dc5019da9d9e782e57dad47dd7b6c5d6f9815c97204093355f2ad1c35fd54e3e585dfe8fba4c1cbb58a36679b11c631e374aeb6e6698e9d94cb28b0b450467a9
SSDEEP 12288:meBNUbTVO86UiksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:mJIUG9Xozsr8zbhN6GwXOGIh4
TLSH
T1A285DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c26651630ca8c3a351dd34bb888f88b7f123f58990a77e352bdaac3b809064b8
MD5 9b0f53debaaa263ab24ba3532b178d30
SHA1 f9eb4d7eeccd96a16682c103fb4b9de9fe12a37a
SHA512 7bb7105de7a7a9c439e6556baeedfe971cfd77973f1ec18407ec60da362eb01e305b69bd01cfcd911a4335e4bed5113c0fa3945665994b5d21b191f1c5227c65
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THj:RQvGAdlCEL8c/RRNw5CbwFRKIh
TLSH
T124267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 7a1ecfcd9d1c024eed76693a481d06fc35e8e7b1daf807a14404b0dba5796042
MD5 a60b66a98b7709f26209abe5543f7fbe
SHA1 ee9cd06dcf3879a00da7cef375bc454ad24de898
SHA512 98889f8ef1872a01c97083e069f47eaeb3d1872d935207bf3e7b45f05e0009bf93dba620aa144b0c0342c99c15d64e7daaa5b57940cdf8876f106c81665d726a
SSDEEP 12288:GAwSfxL/2Dc3VDLLmt0LDQewsAjIksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:b4ewsAjk9Xozsr8zbhN6GwXOGIh4
TLSH
T10085E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8c77575972b523840beaaac74c6584232a17e3dd2268c41605a227ce5c42cffd
MD5 dcda4e252cf4afeecf0c6c387b494cea
SHA1 e38f7b8174df4ee6bff3f925a1c267501690b2b0
SHA512 4bd712dbabee5d814c64e20656bde09eef2ad80fdb3f2f2880d7e4d60445978da39fda2a1a34db4c86ae4980567a05e66c6876c16711ef05799413e1d7033d07
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH5DKI:oUEtQevvqc2W1cpV2RI325D
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fd519956c58ab399ffb39aa6bf9afc4553420be44426de2abd095faec6826dcc
MD5 4466611d316e14de5c3d326f82b527a1
SHA1 fa8662a49bc38463ed255242726ff2586fb9e897
SHA512 8d3d90aee15f2639c7185ee29182ce8fbdcc8ea8aa2c94a8d19fcc903ce308488263a553449f1b7912ef0fab0a9da2f696eca19dbbbf1c9d3f097d2bcb04def8
SSDEEP 49152:bCbRquA/m2yL5zifFiV+XenmE3/z+Xozsr8zlLwJIh:EoqHVjnmfwFRKIh
TLSH
T1C9D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5554c1359d92b964f68239c8ca86a5bb959c2beccdc8d721abe28165266a5efb
MD5 153cf1e64f3936e93fa5e1fe0aa089e9
SHA1 4a68dcc112062c60808cdacd9fc8116daffc3287
SHA512 b959433340e09c0b98934431185c50f8ec8b0d6c1b6403a468e61a65cef2dffc5357223aca9978f942f87f8118bcacfab2ab929b8fa235398e17ad620b6cdb7d
SSDEEP 24576:8AhGL2IFoiwtA5l7S53d9Xozsr8zbhN6GwXOGIh4:8AM1Foiq5PXozsr8zlLwJIh
TLSH
T1E7359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 bb8826ee9d786c2a38115d45adc81a307ecf44f6a4f461ca372c83d4123d197e
MD5 bee2ba8b0bf398f4c41cd6525641ae96
SHA1 669174f333fc9e54f446a1b14ff1e46607486903
SHA512 3c4aec5074e682e3e5d62f52739c03c8df766139b2486a2916f499aeb5d206d23dc4642324119a95afa2037f9538fe5dd1613dea09e287e2eaadae889024b793
SSDEEP 12288:Rmw5HEjsChNkBFgl0WDm+CLksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:MwuVOWY9Xozsr8zbhN6GwXOGIh4
TLSH
T12C85F14677A41CF9EAA7863985878535E7F3BC062A21DB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 bfd13cbcdd7df875da2b02e8a2aa7bd298a2845482f13b4a1cc841022108b288
MD5 0a60e7bf79a5f93624fe1899b1594190
SHA1 bd62bf5dc03478a5cba465d0f873f826fed1a69c
SHA512 52f64c8d18deb526aaab855645b6d54a96cc9d6883b8d8126badd0f5293c98b503f848d6b9a6f7a34bc0265e714a1eac6155b6741df82463bdc6847304d54669
SSDEEP 12288:NZZ1Iy4ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rZuL9Xozsr8zbhN6GwXOGIh4
TLSH
T1F17512AB73E030F5E6A3473998E15A44D7B3B856577203CF1238029A5E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 88d4b89ee324432a754f90fd02a8cb6ec1611ed790b0839d426ac26e6136804f
MD5 942847d649c131c4b091f7e80510a43c
SHA1 1cf706929c9b05ec68aab31a4982bcc1d589f0c9
SHA512 1b50fcf7886368f1ac922c0116d5ffbb686a8d26a53f268e1e09a803a8789f33379846ee1b4eeb062056e20c41d13a94715b3375df841d152ad8c0c4c2abe238
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U/:kQRQyi36YOcPhLvw2gAf+PN34wFRKIh
TLSH
T15F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 aeedaaf12af1c0586d7a4d11855f17e8d516a588f2c5a05e2fa08155e4ca01a5
MD5 8fbb0aee3e6d4eb5f30df465e3f2d669
SHA1 ae5bc032737471edf1b627d8cc88004bf8f078c1
SHA512 506fea544be9773a520a68174307e57c34683df4808333f53f79beef90cce7771294307006b58e02e6f00502e9053df7ba64ce07f47b0beba290e4ee770f3444
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23U/:RQRQyi36YOcPhLvw2gAf+PN34wFRKIh
TLSH
T10B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 92a171d3e8cc152a4d89b7cafe23e8c53e3228e97396efaf8650198b30ab5164
MD5 027b8cdabea35ee7e76dd37c1b962afd
SHA1 f6198e149f1fd65b95249a27576dc4604b6b2756
SHA512 7abd88c179b451aa2e3fcba05ac7924354c603f4bb83d7d21e4b3feb78f6845c0f6dd23bfd7d709f70175ddae4624447d0dbf58e402d30cc13b8e37829182e15
SSDEEP 49152:m68Qg55nhceWu7PNU3/uXozsr8zlLwJIh:EthLRc/KwFRKIh
TLSH
T1D5B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5a1dd9dec7e3e0433b53e3865db7a34952b05214d4cadb2da3d785faa9eed8aa
MD5 7cf29e665fdfe9c2c41175775c7627c1
SHA1 c1b6b98d8dc9173a41e13d2fb024fdffbfcf6506
SHA512 4eb47b2f270e4823f56f42e662d88ab9e9033d5f50c9684d5fbe18bd7fc39267cd75f68301685a5b346cb91c22a7c8e40351b45df8795e893b3fd8b26b9b0b39
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99R:xy5112gYy5azzVva69nLKnhZ5wFRKIh
TLSH
T14D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e1d5a560111ce683a10c64c5f8c9defe2b6a1e7ccc660b88ad182585633f178e
MD5 d6897f082f422690f5011955c5b52318
SHA1 b3ce14ad664e7f4aa9d2dd342b056cbe5dd96e66
SHA512 becde2b0d452f9ac29d45cd7aae145305d8264940239226c86f57db9676bd32699ba964519eda2f1dd82c2ece9caa713b661db12e99a19fab3c31f3073a72bfb
SSDEEP 49152:LB+taZ3usBWOBr4tEG20bqx0z+n217aau1glQXozsr8zlLwJIh:du6JmUxd2dwwFRKIh
TLSH
T1FED59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 436d08296358844a55f9a27992ea0a8e019c0471da37017e2e4bd88c05f1f5ad
MD5 565aaa2297a0eb7505ffa05c1c9e499c
SHA1 d3b868776acb3cd2fab197b0f734e5761399dae1
SHA512 d989230e3f723520d9c94b7d314bcc83274171914586f3e85b7ad8a6b7a25cd32e60e21f184e9d0b66a596331863710c7cad7db3575f70cdfad7cc8c76f1a581
SSDEEP 49152:61hpsNoJpF1A6BU44CwH7R4x0Xozsr8zlLwJIh:6mifPkRfwFRKIh
TLSH
T1E3B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 eab18546421d053a67cb848a0ef8a9dd21b475e14e1eabbaa39e80edf95014c7
MD5 e0cd3e25dc838525a1fcf79e22c56abe
SHA1 885b60f09ba75b38326afd6260e63d2dbc11f882
SHA512 23c3bf413b81dbdc2e26298c2b7dcdb48617b338405830dfca2bf7a136169d352322df02124cdb6183b73ae559b2f7f58f80f44c754464afd00e7a6b578c6e0a
SSDEEP 49152:3SuZQIY0Be2KNRVtOnks6NMHqBXozsr8zlLwJIh:t5dKvi61lwFRKIh
TLSH
T146C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3c5bda00bea17b2d89d16a79fc275f64fac1b5217aff4c7da628d95421a04925
MD5 bf77c8a9a57aaa197a8921f68af048db
SHA1 d069cc9fd7ddb2708cc5a41f16291dab248748ae
SHA512 1b29b4610f0edcae29e3d57952f5b50d96b4d2b37f51b08d631c2e589300cca8086a9ed80e263293b39abfc662556e88ecfae43248e2f21bb18c9a9cbd4800f8
SSDEEP 49152:5htSn8EApI0figXgiDn0AP5wAXozsr8zlLwJIh:IX2iyphDwFRKIh
TLSH
T1D095BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 80a68cd9509cf9c577dbdfe54b9106dc15e0d661d8f4d39c3c670fa4f69232a1
MD5 01865f4a32fc8268b1b0e0276df5cf4d
SHA1 3b2ce21d95c04225e23da24bcf93e193fbb16fe9
SHA512 8ab7f1425a9bc9b4e59c8d71c9488c8ad59187aa261212a6146a721415180663e5c8a9b133c7a76e8d6d0c7bf2613781ebf548c4cd1626e7ea39a7d9dd372785
SSDEEP 12288:CJksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:CX9Xozsr8zbhN6GwXOGIh4
TLSH
T1C06523B7FA92A442EB575F3129811AC4C9A7BD9F99C207D1333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 695c0c55c7fb78bdc7d0c607829a7371ee303641faeaea998fec5a7bdf2fed9a
MD5 f6c68e6b9994b73c0fe8cedbdea17a6d
SHA1 363f5a6aeaa1f64decd1203f15698f796e9b58e7
SHA512 f78dc99c7dd1553b0de52569b04e2c06af58f8878911a4c3f3f012bd414965ec3068805f70591fcd978c1a944d14b7c6edbd2bc230aa6174213f83dce3f236a1
SSDEEP 12288:NUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:NA9Xozsr8zbhN6GwXOGIh4
TLSH
T1CC6523B7FA92A442EB575B3129811AC4C9A7FD9FA9C207D1333C1042DD7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 764a75e71507a64b93e2619efa9c03c9d30e3b0820e9e9a2a2332f46b3b3deed
MD5 49378ec18563afe6e625d9dba73a3a03
SHA1 d141e6f269b470efdcece58ce4529da4bbc846ad
SHA512 84030110b6ecfbf7332999f59322b967159cae57871761e2fccf9a9c64c8a2a9a7444ae993e857cca8daab6f47865813f67f138732619a8da4a59c12abab244f
SSDEEP 12288:eKksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ee9Xozsr8zbhN6GwXOGIh4
TLSH
T1A86523B7FA92A442EB575F32298116C4CDA7BD9FA9C207D1323D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 9be0d059346652f27a77fc1e1de77fad4dd9ef8470fd11d7e7bc78a87317958d
MD5 2cd6e42563ad15817d95cdf9c1125f44
SHA1 d26d1b10afee3de20e149a59416ae39ed53e6da2
SHA512 7637ae11fd8fce1a4f3935247f1e5091fff033aba5adf05806a1d5a6c1c885b76736acc24307eecc8560a7a7968041194f383a3b3fcfa0a406ad2e5ea25f6ee2
SSDEEP 12288:7VvksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:r9Xozsr8zbhN6GwXOGIh4
TLSH
T1306523A7F7A550C2EE679B3198915680DAF3FC9F9B5207DB232800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 a906399c1bb509be96472f76b2039328d127a66c5a895b9d43d5fe59182ad4fa
MD5 a25319859d6526fd3ee3363413d2c922
SHA1 8081d40f50da53fd8cb13a072bc4caa3e7398552
SHA512 97fd723a61c81384a67a09f747aa8991e3724d9c7b341374a9891374a65510d949bd9c5bd6ebc2acc2ba10855c13300307a346ac0f2761bacf6340effd1b8295
SSDEEP 12288:znksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:zF9Xozsr8zbhN6GwXOGIh4
TLSH
T1676523B7FA92A442EB575B3129811AC4CDA7BD9FA9C207D1323D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 1c42ac1c5936f616e91606ba51252a1e714cc421c26351ef64d05fec0269a761
MD5 0842ed623e6268e65469f93c63d4841d
SHA1 db5641b2336cb9a3ca0058bd64ba82b6f0f31dd9
SHA512 b0bf3aebd87e2812c490c44747b51d1c015688b322a9d5606602cf842752155656700674b8afd293ffcedc77ee2635e78765c65fe78b91d9b287476e12d41228
SSDEEP 12288:wQksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:w89Xozsr8zbhN6GwXOGIh4
TLSH
T1DA6523B7FA92A442EB575B3129811AC4C9A7FD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 89996acc908da07aeebf7048a74e1267ab61a6d7a140d12649e1b1db014345bd
MD5 e9bdadd5e6aba4a9a71ccfdccc1a7fa6
SHA1 5d92f9f074cbb19b4d571100f4741b65366c300d
SHA512 220148ef6f580e93741361e57cda3d3032181b0c1e4b58c596c92ab92451731de6a24afe95c4d9f224ad132d46c76a2367e80a140a81171161a578886a2119b5
SSDEEP 12288:VsksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Vo9Xozsr8zbhN6GwXOGIh4
TLSH
T1376523B7FA92A442EB575B3129815AC4CEA7BD9F99C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a242afb575f59e9e8eb15a5b131c5a9d33d1737d792c9f6d9899d8b55f71b3b6
MD5 58839cecd003ac048ffbd8fca2d3f2ad
SHA1 31b78f11149f908207d993214d51a7e835984671
SHA512 a70323fbd1a5f41c719de0b510636088b9c3c04d6ee982bf121e613976cb78ffd9cc2f9bbb7175c9ce8d89a53c30ea4ad0a7f629994af2dccce2c94dbd87568c
SSDEEP 12288:+iZwbWzzFEoS2cPvy0ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:hZMWzFVSOg9Xozsr8zbhN6GwXOGIh4
TLSH
T1D08501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 f476b1512931ee8f24e1cfa669b1ba613fad74ac01c5a757ceda72b7ee503e33
MD5 084843551e521457513f7d85db65f22f
SHA1 f377c16dff912f8a5fa403992eab0f354e2b089d
SHA512 aa9f7741740639becc1f7f09a9331f264f10a88d05f55663e7ad4e61a2b786d6828fb846aa08c5ff683cc3814a26a2774b134ef0d969cc3f6008b80b0a932579
SSDEEP 12288:ANksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:A79Xozsr8zbhN6GwXOGIh4
TLSH
T18F6523B7FA92A442EB571B3129811AC4CDA7FD9FA9C217D1323D1046DD7A87A7E20331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 99349ab1f2d3195bf097fa221b8c9a440f0b80d4ffc6992207061995d5a670c2
MD5 02f4da0f9f4e45593fbc6f1420f0483d
SHA1 4bdaa87e7625dd79bee4c0698337a4c4d96f5a8d
SHA512 044bf01bf15106ea7438e2951f248579784ca92a777eb28803d8d39166f385b11be013430688d6b95ef393b55e956c48170c1f20494643fa4a6a81999ea717be
SSDEEP 12288:NxksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:NP9Xozsr8zbhN6GwXOGIh4
TLSH
T1206523B7FA91A442EB571B3129811AC4CEA7FD9FA98207D1233D1042DD7A87A7E20331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 f478e70a09cff7f1e1f7a1163f02eb50dd4431110b2830ecd0353877b05ff4bb
MD5 81371e39b7acc442202345f9522344f7
SHA1 472829872ff3cba48582c0abf5d58e19203d198c
SHA512 ab257face7cd2c439fea86699cb6fc9f12790eda6cb82cfed54dfdf0ed884665ea23ad884f8a219e6cf8373e003c63d1bf72f3e5b20481afa44c41befcc74b6f
SSDEEP 12288:9yPz5L84ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0zyU9Xozsr8zbhN6GwXOGIh4
TLSH
T153751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 e6029a2d232fe9b6a3b5a4714ea70d5adbbaad42f9585272471a039fe35ac279
MD5 7dae77fe8fcfdcc1d07618de116413a5
SHA1 e4e40ca52194ad10d05713e9df020c39993c165b
SHA512 3e00ab5889c1bd762bf129783c1db50345c3d919dd59a631ade0ef14e344d939adcb08304a249365aa3f8de8a50fba2c0a7318f9011cd38f591d42a1c1e19476
SSDEEP 12288:qNksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:q79Xozsr8zbhN6GwXOGIh4
TLSH
T1186523B7FA92A442EB571B3129811AC4CDA7FD9FA9C217C1323D1046DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 b2927f1b2842ec65ddebde7b1f987329d44c7236b0523b8b6e4d4c7816036e07
MD5 5f495de7df528875365ef740bacea9f4
SHA1 001e46ca611d8584e41fb45c804e475c3fe88075
SHA512 acd125cb1653405b052ed9ef8cb179e414b4d68657cde0c3b085af9642e2a8a0c47663d2f1516c5424ec6468d7d3ff3e69f576c50882e737d6622e7f8e3d666d
SSDEEP 12288:tNksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:t79Xozsr8zbhN6GwXOGIh4
TLSH
T1026523F7F992A442EB571B3129811AC4CDA7FD9FA9C217C1223D1046DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 9daa050cae5ce025a15ceb29cff87fbf0eab595f11fecf5851da9a43ac2ea4b1
MD5 089712ccb8facfb9704014d976eb7be7
SHA1 37513ffbc0acc52eac65bcfc011803cc66bf50cc
SHA512 687276ad67d13ad32789028c65ad3d5a3752f9368a8053cc356a3223e19cea61136cbdb52da7a86e90d3d934963626cbe8b7c376eabe63f4210546170a89b6a1
SSDEEP 12288:QyPz5L84ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:hzyU9Xozsr8zbhN6GwXOGIh4
TLSH
T1B1751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 05909cfeb57e0cee3923c5e0cea09311b236544f444a47ca22833b5e8094ce8a
MD5 c17cfbfdc844fa6daf7a66fa8bbadbc5
SHA1 ed551acf947237b4b867c56e94215675fcb5138c
SHA512 ca6f68dad9eca23dc078577e55f7bff62b955a57f928879b6a2ea13ea00c649f78c419505ed9829060644a4626135362e04970b07202a553d0ad641e5693c242
SSDEEP 24576:5THaLl3z0zDu9Xozsr8zbhN6GwXOGIh4:5T6LljbXozsr8zlLwJIh
TLSH
T1AD8501A5B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 1464bac029e413d4c26b99b30d85e9a6c5b04e69b38bee1a565f1af634736c34
MD5 381855df45065a5018909a7442fd7f5a
SHA1 ce97c134db5f6c8d64736fb9d5ee0c6b20eb2a72
SHA512 6bb198dc7f255850914900e66a8a7c4db75917d6e946ddd2383757f416d320797b00e4a5c146a990264c4e0a9d05f363a938b60567623be66d6f7dd293c5213f
SSDEEP 24576:N3Ld9CHKy7GZK9Xozsr8zbhN6GwXOGIh4:tLd9CHKyaWXozsr8zlLwJIh
TLSH
T19495CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 0fb31800ebc4ae7f0a948369866eb50f35cf1577a587c16f9ccd676536fb6ecc
MD5 0eafdc4b471955481249df656e49a1a3
SHA1 029342c48aa8056d77a4a1a1b496b478771e3d77
SHA512 657bc73730061965e153a1798cfb4c08916a088f6316d0cb42c8cdf6cba6fad51e0e3815b548c84401d6c3a0b05091b8f547a6b1f2aa4eaafb30c85e4596f3f9
SSDEEP 12288:0qksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:0+9Xozsr8zbhN6GwXOGIh4
TLSH
T1616523B7F9A2A442EB571F31298116C4CDA7BD9FA9C20791333D1042DD7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 27db327dec6d8b08d3ce4d51a8cbe8bb149a12654f15fe04295db382319a1c4d
MD5 55d9c352cb024a703629753d3e06242d
SHA1 49a2051db52ce2bdaf6f411cb14e1d14a4ec3215
SHA512 000b630b546b53b3d9d956a70e70cf2e9132398fe4ad0d585b6b7ccd5586b69501db4d01649dbdaa533b0baab440240fd42113086c636192bb0561da4e1532a6
SSDEEP 12288:0YksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:009Xozsr8zbhN6GwXOGIh4
TLSH
T14E6523B7FAA1A442EB575B3129811AC4DEA7BD9F99C20791333D1042DD7E83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 b2243e5fbe1c2455d934e29081b189fbb95dba7e1fdacb12ae0e1ed5fde3ae61
MD5 334e9c6168c795c3e92f01ec7caea987
SHA1 41715bf29941c4f6ff12b1f49818d3e4fa729471
SHA512 f521459b7e1e8b3bffb6e5073aa6c41489761b92430b9e60662d65fd3fba47ada60a2137a9520fa6010f9e5f976d3fb538306354a54f8eb02a4b66b1d8bccbdd
SSDEEP 12288:ZjksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Zh9Xozsr8zbhN6GwXOGIh4
TLSH
T17D6523F7F9A2A442EB571B3129811AC4CDA7BD9FA9C207C1323D1046DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 f3f59099407a30dc9d3e936fc09813abf2604e016e755cf84bcffb16b385a86b
MD5 c5cb193a7cbca0fbd6dfe87b6f75c38f
SHA1 f5855d7b304273dd4600674169f1d7b25793d537
SHA512 ac36c66f74f3caa7b0090df31e9f79d7901644c9c849da58c438b5cd8c09b43daa8c59e6c763e56061d4482dbb1190c89fe7f4813bb0f2c64b212e8d6383d836
SSDEEP 12288:WNksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:W79Xozsr8zbhN6GwXOGIh4
TLSH
T1BE6523B7F592A442EB571B3129811AC4CDA7FD9FA9C217C1323D1046DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 3b5957bd638cd76d1a5cdc7052adf622a2a4487fb8a3368aa4b61c4aa1f8ecdc
MD5 e3781c12741e30c94b366b4c7c99ac84
SHA1 283a3708543f0a86947116cb4e136bbd5ff41fd2
SHA512 3cd41c424c9f3f66cf7a94889741ac7b32496c15c47b1dad746c8153d7e6bd39b7c038fd663790abe21882f2894796df194431861118f78e8fe949648cb74b1d
SSDEEP 12288:+qksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:++9Xozsr8zbhN6GwXOGIh4
TLSH
T15E6523B7FA92A442EB571F3129811AC4CDA7BD9FA9C207D1323D1042DD7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 c922d0bc7261298c78792c91149d32a1d494dcf52a90216b5ee264e8ad9c3c47
MD5 97b2e519b1649c51e2f74d50e16fbfdb
SHA1 8569b50b0df816593fa66dc5ed4f2aa4b5438d0d
SHA512 0a6ee347365329258125f36f9a55a81ee13e827933e67f6af336b955cf888510c9a57e9578b196a21b0bd9744bc2419f5bcadddf53cc1a0b9160b4a6147d804c
SSDEEP 12288:OlksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:OD9Xozsr8zbhN6GwXOGIh4
TLSH
T1146523B7FA929442EB575B3229811AC4CDA7BD9FA9C30791233D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 449912a70bb9b4ce51f76144060fc7f7ca6de4c06f814bc55ae2e67978146cbc
MD5 79d2755b4c5816495617ac77e58b8236
SHA1 9cf0764c7e9af4eee3938998189ac52686101f7c
SHA512 bcec4f86ca5fa3e032719a80169d290dab4a4232aa226766076f7a7b8b8d8564451722b9fafe2fe48659cfdf58b0eecab79510d34461a2f68a3c840f2b665a61
SSDEEP 12288:3nksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3F9Xozsr8zbhN6GwXOGIh4
TLSH
T10D6523B7F992A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DC7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 b9f0dca8d550f77a7eb09842533fe63d7a66e6943a63b22b667c193cf9874df8
MD5 0b916868a9c2336f41a17416a2df648b
SHA1 c26887b49cd6793b10436dfff18f81eae78af8dd
SHA512 16ae9c79da4c6934cfa5c1f4b637e312b5c534a6f14fb2f416ae982383625d0f0acb6c2d33e6617699c53d04e4f670b7d0d7ccd2930cc37abb4804c95897f4d9
SSDEEP 12288:6SksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:629Xozsr8zbhN6GwXOGIh4
TLSH
T1716523B7F992A442EB575B3229811AC4CDA7BD9FA9C30791333D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 b3917e0e1049f6b382b1ffb64fd1f1bd39a6489cc4380e120e768465bba3c534
MD5 4dbd0cdc57d3e8363eac87669311fc4c
SHA1 2452803dcae7f1c4a9f35d0ed49b25526c9c9748
SHA512 cc8c0ca1f332945a0228a60bbf156dbd7efff6f5d8b0f4e0916e328e87028244dc289f90b9be70156e63190f87fde478ea10fd77a89ddb0d229070df76d56e32
SSDEEP 12288:NnksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:NF9Xozsr8zbhN6GwXOGIh4
TLSH
T16A6523B7F992A442EB575F3229811AC4CDA7BD9FA9C20791323D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 c6a987efb0542f69efae4d7840b2901cb920e0d312469fea363f30e27d9df8f0
MD5 575729c9ad6d1d4ff40a859096c90d24
SHA1 61e80c852fc922d0d15c0a20bdde826831a37cd2
SHA512 f9a26a52d1ad2b15af0c8be21bb12dcd18a673fe72452746c1d827f7d1beb24fe522dfa6d8df21e46050d8b65100dd7bc4d5315722bb7e8f7229a12af88d8b23
SSDEEP 24576:Zfwv7k9RX6wkyAI/9Xozsr8zbhN6GwXOGIh4:0MnYIFXozsr8zlLwJIh
TLSH
T14295D02AEBD844E1E177923C99B3460AF6B178591B31C3CF125A53AD0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5b5ea315342088c551f4d64e3aaf2d704837956c38e1396d69fece8d3b264d7c
MD5 a8f147d1f7bf2d861e7253ce5d9741e4
SHA1 0b06ae0e4f27c15048402fece5fd21b6b4400790
SHA512 e93bec55567e5e151f13d19dd7d5a3ec877a1881b536d6974c344703504ff0955211c57762e0a29ebdc09dec5c2abede908ee555316dc2a27522af7601298326
SSDEEP 49152:GYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gXozsr8zlLwJs:iySzPYwFRKIh
TLSH
T1C8066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0ad720c42b82a0d73da3ecd33e8c097031f9ee34cae47f4d8bf8b6716189672f
MD5 179eeb78e93bc5b090697b13f34c08bd
SHA1 53099ea79ea39da722b2eda38943452f1ab6792c
SHA512 7bd83f04382dcfb106f048a84ef1040d0a08f1ee8a8470b483bab98c498e6842814bac969c9a231a5098a09da5081f65819819c13f82847845ddba69ae79a744
SSDEEP 24576:M47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYQ9Xozsr8zbhN6GwXOGIh4:M47JUQj4irIhCnDHUPfF/QXozsr8zlLT
TLSH
T10365AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 80d44ba33c18c9bf1c5748d1fa432a2d2510c33429cc8190b1d07a65b82bdcbc
MD5 e3cf38571240d94956ab9fba2b34c239
SHA1 8a7fc0e125e238af323adf40aba1b152f995606c
SHA512 3a41329faf6b5eff9c53a0a680a58b060ebb628eda7e4e80e6e51751891544aab30101cec4a92d10525d7e6075468fc45f833b19e4b6f7675815bd784ac6876b
SSDEEP 12288:/QsfdksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:PL9Xozsr8zbhN6GwXOGIh4
TLSH
T18C75F15AE29411D5D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A6A0AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 22e89344b32d626956127579074e4567fb50400a5cb5dc20a83667edd4233296
MD5 3587c50b24855eecb0bb9d6e3aaabc6d
SHA1 77d8e4dfa050dc413d51f67f18762505eeb73d32
SHA512 81d1e70d9300b847329bdacfc6280de471a74b968192d3da06a2736bd91147bdb7299090b571ad6ffefb89bbd5d619f203e6c32590bfa9167c3b4d7a8ea7c133
SSDEEP 12288:TKGqTU3feIlo/75thUgoj2KcHO/Hu7aF+2YQLUky+C:TKGsUPer7DWgojY+Hu7ac2YDky+
TLSH
T1FC2507507A6AD75FC6AD40321E32D1CCA7707D01EE05AB0372C8973FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a4f850b914c6ee6e7072badfb2864dacaebc663a2ed0739e41dbca933ced4590
MD5 44f27f39a9b01d667dfbcaafc6160486
SHA1 39dc89c7ecf8672d2fbb3b4d960bdd230c6c0332
SHA512 0891c5daf58f1a2d28bc0287ee314e887f3233d2fd2dd860fb62f6f3ebf2fff954cf903b823fd6dce02fecf304c3cf6f31711efeeb456b90eb6ec70dbfedd3f7
SSDEEP 6144:FX3xDadky7qZghx7S74rBV6o2kooZh/vEDbktcbVtMxzcbVtMxOLY5ZRcTUEWp3Q:FMhx7S7h1s9Q
TLSH
T16065D8415537F28FD1FB6031072A6B4C77A4EC06B7096F26B3C8447AD86BB25A4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 73b97a1773303ca600d748a01464a5511e4abccad5222bcf8ce77087e02cce8f
MD5 0ab070b341c209726da47a60f0437e51
SHA1 a13a2bcb75281e11e0e05bfaaa2a0ccf862960a4
SHA512 05ab372e8e486fdf082de08b675071b726c32bd06d7424cd35ea38a42ca117aff963a99580a00548f0086f39ff23d64d7424f8f9c2194082a71981a3c278af1f
SSDEEP 12288:Sd71ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:mT9Xozsr8zbhN6GwXOGIh4
TLSH
T1AD6523B7E795A802FE771B30288556549A5BFD9E4F8107C332281186DC7A8E6BE31336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ae942bc76dbcdfdae38bf0d4bd937fceaf7d3b1654f29cf8485596326c2b6f95
MD5 05df6c6f804c3fa47ab97d17d513a404
SHA1 c3b49e1e8334ac4af2cfc5537f980341f0ac7107
SHA512 73dd4bfc4b288b4e544481e8eee942d2b7bcb65fce14a6e75f574534d516156ed68c1ab44ba8818440288516e9f803e43baf53766c0db29500e0ad4813a5576d
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bY59Xozsr8zbhN6GwXOGIh4:ngb4mBIBhGFqXozsr8zlLwJIh
TLSH
T1D465AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 b715cfddfcbed44bffe93d1411c8af9c724502ab6741d0d1f76fd06561e1df01
MD5 1c444bec5d38adf37e58ff0e164e5f82
SHA1 43d67c8d4ae00b3c2fcdc34f3f61431fe41031be
SHA512 0adfa37e4c0f0b02d01cdd628fada3b54f0938a4d133e5f1856d7085f2d1f9e9f99b1d3c9fefa8b14e7cf83f86862692349794ed9a3b8e616cdc0d2dc28ef348
SSDEEP 24576:QG88u8FpJqH1czria7/mg9Xozsr8zbhN6GwXOGIh4:D7ZFPqV7a7/zXozsr8zlLwJIh
TLSH
T12CA5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 13dcf6852f22e7fdbca40c8005be41f26aa19c5e92135e596043618f822ec4af
MD5 47a53a4dfbe0cb27225ffc56e1129f7b
SHA1 1be68bd1189d5edaf52cfff024c54f74c4b1ac2d
SHA512 f68b66d8dda77fde36dea6ff4649a5ab69f067dda02c6ea66858e9e5cebf3b6d99e6ec29f40f8b8065b3dd7016a2f387c23fcab9c09661881489380dba3b2b3d
SSDEEP 12288:zHvUrBFrEjwaQAksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:zPUr+NQs9Xozsr8zbhN6GwXOGIh4
TLSH
T13985F26F72E918D5E677A13D89824709E772B866071293CF02A0817E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a1804f857d2e2822c707d8bcf01f86d4e1a8a77db1d75ac3f0b3d59d89173c0d
MD5 7535015945a1de03a25fbcbdf6356d02
SHA1 4ec506960d55f38682e6d9edf066912b972e2686
SHA512 b32e5d520a18d0a9a86d2aa15cd2b0ba5f13016d4dee27858a639ad7fc8c0cacfc2912a9a5d8fe605727c30efeaaf28b9444f1c518e565090b1a5355b9fae359
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmXozsr8zlLwJIh:2G05lO43bBwFRKIh
TLSH
T126D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 13a42ae7c580443fb2d9bce24fa7a62f8dccd823233fca696c7e1e52e332d993
MD5 783687f8be8c1efa26cba246a3b7fff8
SHA1 03093a8c2c603c6add208e13c8fdcd90c5f80e95
SHA512 afc26cf0795dbac217cd6165a8c382bcae14b9e401a4f59ee94c4b85f378357ea8046fda9ff0f1a7f757925c7d225d8f9e9ae73c42eacbde9b8211d8620dab5c
SSDEEP 24576:/fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnS9Xozsr8zbhN6GwXOGIh4:Ha5POZ39Jt2pasx2+muXozsr8zlLwJIh
TLSH
T1DC65BF5EA6FC00D5D579D17DC583461AE5B2342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ff2746c7fa11318af7738a63ec8962e3cd2c7f6ba46bbd0d6371931646debd1c
MD5 67b44e074f71fd78cc9b98927d3ac55d
SHA1 9117e603367bf5c4c8e08ad410f3e3392398aba6
SHA512 7f3e488f5adb465fea9fd6b1379293f2b7caa5d0da591a314c0c761dfd3dc30aec1958a046eb05c5329deb7d41da36a42c450290d4b8427787ad71e6497d8856
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7Fk49Xozsr8zbhN6GwXOGIh4:hNc/zEOVHFTXozsr8zlLwJIh
TLSH
T1B9858C6623E901E4F5BBE1BE89679546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 40a5c8b361009bb1e080fb0adc3822cd06e670f14817bd5dbfb8feb28debcd82
MD5 aa9406cbc9b90105d924e741227ec971
SHA1 7a354a07219d6fbfe89aa3114f08f09c519c097a
SHA512 e0aa092bb715a935b9e32a36ef053a2481c1a37ed17a9238453c7104c7fe2eac097029d7c82e74fa085ad5b34dc2b7443f8b94085b4e2b663b6e83c54dfb446b
SSDEEP 24576:dtkNvNnaFeYhJNtmZBm29Xozsr8zbhN6GwXOGIh4:dtMwBtOmEXozsr8zlLwJIh
TLSH
T15055AF6EBAF845E4D1FEC6B48D238512EA727861073253CB5290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 b40d7635510524f355d2e5a4577bde2905884c442b55687c4dadc4fba6ecb1e2
MD5 1875ab70ea65dc73afcee201b1b6899e
SHA1 a3c9de911546f31c5e06ae18cd447c8e8a6c8619
SHA512 c9f4a536ac1631493ce319e270930aa458626fadae488827e5d6d171716a8a302a80645af699b1c860d88cd91d1f3999d2762c7ab3748bfaa731c2a381136788
SSDEEP 24576:tD3FHshBIYQgA39Xozsr8zbhN6GwXOGIh4:tDVHeBIAANXozsr8zlLwJIh
TLSH
T11895E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-295-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1392-67-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1392-68-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1392-74-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2824-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2824-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2824-129-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2824-140-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2824-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2908-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2908-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2908-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2908-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2908-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3364-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3364-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3364-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3364-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4276-62-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4276-56-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4276-55-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4276-279-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4408-103-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4408-109-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4408-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4408-365-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4408-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4836-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4836-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4836-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4836-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4836-15-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5212-116-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5212-122-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5212-114-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5212-368-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5448-1-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/5448-8-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/5448-296-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/5448-0-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5448-7-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/5448-299-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5448-78-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5684-80-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/5684-350-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/5684-85-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/5684-79-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/5784-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5784-364-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5784-90-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5784-96-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5784-380-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5784-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5892-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5892-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5892-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5892-45-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/5892-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5892-52-0x0000000140000000-0x00000001401B8000-memory.dmp

Download