f4a14b0d28aaa81a857c0bd62348e1b8f0d47a6f0fdee5cd752b46bf2639b5c4

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample260807-vm97nasyfw
SHA256 f4a14b0d28aaa81a857c0bd62348e1b8f0d47a6f0fdee5cd752b46bf2639b5c4
MD5 d4acca484a7968b8e103ea263612852b
SHA1 de54acaae147831d9415b506b7c98d96bd25d3b4
SHA512 80733ed0b27c3a8c31e0ebaf47ea942b822156b05e9611387fe5f1cfd1002f5e45ec4b98f54d1de48f3693a307571492ba70fa5eb938159f9027ae57f3642ae7
SSDEEP 24576:+M1mrPSIwwcYqenQ/tbw/2Mkjy6Fr7g0o6:+M10Xw0Q/lFTjN4
TLSH
T13175F02DE3A495FAE5B7D13CC8924507E6723C959BB1D38F0791195A2E333E08E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5108	elevation_service.exe
3352	elevation_service.exe
2352	maintenanceservice.exe
4732	OSE.EXE
5944	PerceptionSimulationService.exe
1104	perfhost.exe
5064	ReFsDedupSvc.exe
5560	SensorDataService.exe
5860	ssh-agent.exe
4240	AgentService.exe
596	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d24b453f763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bb4694a8f26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
3352	elevation_service.exe
3352	elevation_service.exe
3352	elevation_service.exe
3352	elevation_service.exe
3352	elevation_service.exe
3352	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1840	2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4240	AgentService.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5064	ReFsDedupSvc.exe
Token: 33	596	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	596	SearchIndexer.exe
Token: SeDebugPrivilege	5108	elevation_service.exe
Token: SeDebugPrivilege	3352	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 2160	596	SearchIndexer.exe	100
PID 596 wrote to memory of 5924	596	SearchIndexer.exe	101
PID 596 wrote to memory of 1400	596	SearchIndexer.exe	102
PID 596 wrote to memory of 2244	596	SearchIndexer.exe	103
PID 596 wrote to memory of 4472	596	SearchIndexer.exe	105
PID 596 wrote to memory of 1924	596	SearchIndexer.exe	106
PID 596 wrote to memory of 3300	596	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_d4acca484a7968b8e103ea263612852b_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2352

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5944

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5860

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1a2119a6cf769c3a6d27d94404886b3a9ff09d9256f5e8c2146cdd0f0ca760d7
MD5 6c60e48842a1a6efb945149cba97593f
SHA1 c322b356358aa547a3c17d21cb5064ccad758c7a
SHA512 5eed4bc6556dae7a4be85caf6c2d1c1752ecc1447bbaac2845ebabfb40dd1a7944a5e24ecab4e14d5cb28d095d192128bc4db6f1ed0b554ebece01cb8f041da7
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn+Q/lFTjN4:W3q6HjBqLm
TLSH
T16CD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 fa730fcf19475bb0704fa8689efe4b27739a34d057ae43ec60c164927bb52ddc
MD5 c6999fefc48342405b52e1a02988734e
SHA1 94fc42247d5006e7bc3658746d73ab54e70bbd8a
SHA512 68381072a270f4c9167c4196114e1804ed78feb26871acfdeb3454cb122ca72d1d9ba178de034b0137d3e5505eb51beaa90b595e69a833d584f87d009c7831eb
SSDEEP 12288:A1XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:WXYfDtczABnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T13665F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 188ff1ea2ba7ffcbd0887d79ccd84da249d1805d44725a9c3a45c50946c3e81d
MD5 4501baa9adc97b691510b6b355645ced
SHA1 c558ad51fe331a4f2f197bc8d146c57b088a09d8
SHA512 f28e307415f3e0f99ef1753edffefd7e95a667ef3437c1e71803dc91d766a5efc18a197e08236a73223f54e5334bedb27dfb6a5cd1751af9960c71ce6690b710
SSDEEP 24576:90Le5ji0hmxLrMWnQ/tbw/2Mkjy6Fr7g0oF:9Pji0Al/Q/lFTjN4
TLSH
T1A2859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 adf796bf30d507f79beaeb9a0dca591d4e5ff10002c2622164f19373b6c8d312
MD5 9b6ed5ffee791d25918d2afbe31a408e
SHA1 55cccf27512a08039b2c93c16637daebdfc592ca
SHA512 daba97d53582f7b7c1d20725a3ba6ca267b8cfaa481597f78409c0c3f046ee51626e13a096e743e61202d4c0cfa7243c0e6339dde43cfbaab7c7e761ae2eb959
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWE6q8wyu4nQ/tbw/2Mkjy6Fr7g0oa:v/ezSC6vUzPvxHjybQ/lFTjN4
TLSH
T1B3755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8b9dd09ffda1acded5686508d9a3cef37a50c99032d9b47a61de7f01c5394541
MD5 47e32d5201988996db1c54422b672d1f
SHA1 2c7b956becc7bed6dd017ed4cbafc7d0c545e610
SHA512 1bb3e6d53a2cd94c9e97eaa7681fc7e61c2de1be906c661aac88b76c5cb0d4263f3c46f61bdb40be65f0e4e8e0b73289cc8b89cc1bfb316297c11f68cebfacf5
SSDEEP 24576:MVbqPb88hv/l+6VnQ/tbw/2Mkjy6Fr7g0o9:MVO88hXl+SQ/lFTjN4
TLSH
T115559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6af9ad680bafea38634e2382de9f29dc5f5e8ce88e50225acaff39a7b21e9ba7
MD5 7425e3c45cfb007147ee09b2df7879a4
SHA1 05d80f719030b5a9a260ef08e57bb9681e8dd4f5
SHA512 a46b3c054126f5bdddbf6285e976b1546cee46b7aa02388f9632db316ea7b380c6cce445c501ad51a8315353dcb37e1b75a429fd842ca64927d64784526c5ac1
SSDEEP 12288:mzaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:mzanQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1D95523796A14F897FF2B06B15CC285826B7B0EC1BFD0AB4E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c84e10f8025a43a293ffab410e0d034112e0da34547bee51f2ee517b3484303f
MD5 cea5149e7e80b19ee25302edd7cad3e3
SHA1 4be7a703eb2a7399186d268801f4e3f39e8eb763
SHA512 324ab0794daccd4cce404b2864a32cf4ceea5146ae7ddc902d6e7ccd8a606d49878a688ab1db7413435d6b4648f3d982359b83dd85f595652ad927c92dfaf94b
SSDEEP 12288:ReBNUbTVO86UtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:RJIUNnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1D875CF3BAE28FCD2C27E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ce8f1f88e6beafeadc78f8d6771577bebf00d757a9bac1574a8e5afa38cf94f5
MD5 7c34ad45986b06d94b34297ca8ef9135
SHA1 37c8eaed57e00effd8da08a63cad4575f5ef36e3
SHA512 6cfcdcc8750f6c703a63ae9f385a7dcab89cb36f98690c39349b9c49e009bdfff9217e3554b57099e1cff26d8717b4337942d38d86a884b11946e22496592904
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THF:4QvGAdlCEL8c/yRNw5CrLm
TLSH
T1A8267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ce9c3662e3423cf00b100c6e7c824b427f8f54d546187f47670c0c61baa2de5e
MD5 546372ab1e1efc561b9883afdb76cc62
SHA1 442b8b3a25610aeadf52982a080746e2cb88486e
SHA512 1cd58e9b5b382fcd32fe096e36a83224b61e8e87dd5a271c7c84410396200c07d181d53d25ad82f773c6513cacfca9dc428f1ac99a2482537c7db8d589cb3b80
SSDEEP 12288:2AwSfxL/2Dc39DLLmt0LDQewsAjvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgi:LQewsAjPnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T17B75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 99dddf8a24720c5310dabc83e585e6ac5d34eb696a6b9b1edcdf2a9316e1eb5f
MD5 42882cfcb6779adcf8563fb5d80ea26f
SHA1 03bb614af2fcb82a03964eb34fee918f22665a30
SHA512 3b7166623e9aa76c4fc81fccd0c185274528fcfdfc66969a6dbe51f3c351d8bf86d23b3a994d8d6483ba4c4cdab4b298f587eaae7a4854d8f5ab85ca030eed97
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHcL:MUEtQevvqc2W1cpV2EI32
TLSH
T157474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cfd0e80af5856c12b887fba4c271b90ddf45623bd49ce1dc7bee94753debe716
MD5 82d01124fad19269c3963ac4c7a6fc77
SHA1 978c7ee5fab5860383f92883481db1d265a5ecda
SHA512 a1036bd0c5b54bd398beff73e7fb62321ea70d2f38782c6a551dc121fc9327a58438b0204936608abf37226a16e98815255c2671d2df38115b12633af1fec3e8
SSDEEP 49152:9CbRquA/m2yL5zQfFiV+XenmE3/zvQ/lFTjN4:6oqtVjnmnLm
TLSH
T14ED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 92bf11a2344c84d331f2211aa4958da5a90bf62b9ab5242fac8f252c382b4f32
MD5 a31e6ae5bd76e7921de24f5c934cc266
SHA1 3b471c7eeb22aed9be4276bd88bb20632533e785
SHA512 3c14f7ac898092b6971db16340033ee11cea0779ff82501a26ec3dcdc2671eed0f5ca5c8d482072f9f78283dbccf5951319257fd19eac39198a16193f2fec955
SSDEEP 24576:YAhGLJIFoiwtA5l7S53UnQ/tbw/2Mkjy6Fr7g0oZ:YAMyFoiq5EQ/lFTjN4
TLSH
T1B335AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1fdecb7e7fc488b1d612dbcc97078176f04f657420ad47cfce101c10cf1be637
MD5 8f96caccaa8f63465b7e21e8bb440758
SHA1 a55fcd209a62d89e00b79c94bcd57f154ca854b8
SHA512 227bba351f8b91c7a2641d4cf2ccce8dc21ca22abdbce3d69b524bd379fee4c4ef17c311b90135abdb93f991b2260a34e85a114921ba14b3afef7930b2f01f6a
SSDEEP 12288:Cmw5HEjsChN2BFgl0WDm+CYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMC:bwuHOW7nQ/tbw/2Mkjy6Fr7g0oH
TLSH
T16465F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fb9cc895e3094fc94253f38e40a00e90c13fb16608f159a02f7b21356cc7f424
MD5 ef220bc44c8c929837767b69a57cff5f
SHA1 45ae5af3ef262413f7f4b2b9c7ceb93fe36de2c0
SHA512 7a6856df23419204153f2720a841f7663fa70e734a514f65a5248e9fd09019a79b53d5f88064cc5838124ec5a9fe3f37be02a3778245bc3bdba794f575822b30
SSDEEP 12288:0XZ1Iy/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:0ZuOnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1FB55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3aec9aad1eb0f74c8f32620886c061f796064b708faa22779d6101b482b21658
MD5 93cf84b66d471443f6f6924416750ac7
SHA1 b76f135b6f40e9f0f71870b7a491e6518266fdc6
SHA512 8d28da38ff4ae58ee69d9bd287f64759017d549fbd3bbd00b111c128c8af36f0969cf106fe317c94a2b80b4143bde030d5811acf77de362fbae8dd6f19487e69
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:lQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T188667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2edc37128c797ff8a0746329141fc54cf26bede9bf6bc5c1ef918fd153afa6d7
MD5 91877d13c75f1775d3f647da8f0d44b5
SHA1 3be95dc42ee1333dca4a9c0e413bc26c6332baab
SHA512 2055bd9302239872e24d0d530caeb84b5552d7f219d17a1cb3065da4e6ba72aaaba801dc087fafefc53747110c31059d6e0941f6c6990e16ac0a0c096b8c7457
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:BQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T1EF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 367a4fbff425e6a9eac5d694ef37683ee3426e300dc7da795b564c4b26bb27ef
MD5 1fb62cb81a016faaed5712ec3a49598e
SHA1 cf15cd069c2b2077819db32c7bc4b2a171109abd
SHA512 1b2aba67405e1d92521e912a66d6b44c837b8e4068046d039a236ed7f2a2c1a0b680ac0ada40faa6d19cb41f5433b73171563978313416f2efd0b342f93f7588
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+nQ/tbw/2Mkjy6t:Q68Qg55nhheWu7PNU3//Q/lFTjN4
TLSH
T165B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 83614d99e8d7b7b794d73bcd0d7a79fed84c3543efaa275d618bf5939220e67d
MD5 7bfa7aae9660e436c4ead001bbbaedcd
SHA1 aba9c7ada781b6cba115d7b7ea88d04afdd222da
SHA512 9753f90364d3b4b3318f566ba4c364f9726b900946a98884641f999d8af4a2d3014b12c1ef560bf02e2beabbb4be54be9f35f678d5ecdd901e6eba8ecbfcb641
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk993:Jy5112gYy5azzVvL69nLKnhZVLm
TLSH
T1E0167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 67418a63ca71e0dbf01b844aedc075e0f6c7ba5c1098b8d2935dab9e6f585546
MD5 21a3a2ffbf9e92e102a20d33e4c8dfeb
SHA1 64d1da11bb5220446c78692c0ead663bb6a072d5
SHA512 5fe6f30a7d93a13a9bcd0092d0707cc5d1467b6075b044e140df1cf2ad7ef20a5842e30207c38a21900222ca62ac2434f368c80445f42e426eb26b946371ecca
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glxQ/lFTjN4:lu6JmVxd2dWLm
TLSH
T152D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0ca0d61d64eb2424a8776b841161648813bd18afe4d09cf97cc025154ef6c1ea
MD5 8dfefb012ecbe13a6c35a99b3c527306
SHA1 e744158ecaa62b4d9d0639895ab6370943f6fa94
SHA512 8d1aafa4fbf3a854ecc9b46ce35d57fde74f8c7915f72e65fc6f2c8d9a4c7e61a3b981cd6ba185af37b070e56ec0222b07d53c89c242395bc4f15edc9c2fb1e0
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xtQ/lFTjN4:0mifPbRnLm
TLSH
T17DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 39f97c04d57bac4f3557f46b3159a77700c02c5b5f32b920f9fca80636da26f9
MD5 39ad005808893f389fff2b5460f09442
SHA1 8096654a8764bb75a1dba213458cb47c976ff008
SHA512 1d7974d170ac31d465fd36a0b78ea2d6df239a6a6761f0e1a269f93a7d16811b84930493803bcbb9ab8385e5f6e0514e0793d6fdaecc61b927053e51192edec6
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHqOQ/lFTjN4:R5dKTi61pLm
TLSH
T1F0C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bf00a4b90b275a07fb185cb1fb9576029446c70383a136a40bf8869a1f37c644
MD5 734e0e31e7e2f10fbebcfc6c9355bbf9
SHA1 45454b04ac3aa55528f87a8fec633b0fbcc08027
SHA512 6d323f517de5c623d212e5fbf2a45be56496805357ca32d226b2a9ab8b50060fc2f74ad2f4c4862c912244e1f22aaaa137b4c4e93ae1701da23a7dccc3d2be14
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wBQ/lFTjN4:SX2iyphDLm
TLSH
T17595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 dc9aa38ec037dac2ac3b8d5d4b2398729d415246cb51ee030ad29ab34cbeb69e
MD5 02a6880139b35d8d4334288886b985ff
SHA1 ff1558e61d3540cab76608a1d42b9f77345f2d7f
SHA512 e8e6a851aa9bf25537fe780e583018a146267773d583e263d721b8f2245a2016eb74592287095fda4b91a62c6ca44d907e2a1a144c30b51952d8e9409c9bd38f
SSDEEP 12288:ISGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:ISnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1805523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3d30b0f7e37291e41e7c424b9593396da99965be4b96c27ce7c2073b337c0df9
MD5 2e9972316cc98681abcf9731bf09d6ad
SHA1 b5d057dfcebbe6fdd13b9675fec2a8926c4df9ec
SHA512 537c11174b3a57725c14aa7a3887e383ba60fb8647a6ac669a75e3ce1474189cd2bf83a1fb495aa9e0b6df9021f1b4f470389136ca99c0bf4e3bd94352e5a5d2
SSDEEP 12288:zTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:zDnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1125523797965F98BFB1706F14C828182973B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 456644b4e1616e101881ed9c8eae6788e7c26102f451069f38eb97419d96c820
MD5 a8423a554df8febbbb8a27ef20a55dfb
SHA1 6f6eb7712d6839030182c330cd925d4f9750fb80
SHA512 948a08480329fee346206b414072c981b29074efeed06fcd38f76a704c6d785f22c640cc5c4608b7a6c9609afd04fd5364f24634d59d6470e39a361ba9814bd1
SSDEEP 12288:slGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:sFnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1215523697965F88BFB1706F14C8281829B7B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9879e9dff5a01c7b321a164c12006ba97448af17ab43f72071097caffcc9221b
MD5 d2b9ad6a2f97158a89441a5ec83d3a4b
SHA1 ff89c84bb0588184bf2bfd14b4825c576db00a66
SHA512 3e47e94986858c17ff20b50175559260cabedacf6a1ee34a3abf93c216af9a137e439bd987ca22a043444d270a6519deea5776dc0c19fc15a85aca23914cc424
SSDEEP 12288:5VUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:AnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T18E5523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA9B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1f3ade614bb398f5bf658d5435060bb6f24ce2ae5853fd465e22e7ab3d3b929d
MD5 db7c8fe2a89ca9d4b6e858d6e756d504
SHA1 d65c894077a3c13ebca4e56a50d4306005790fb8
SHA512 7a0d08ba8e6e44f020ce076e268a972c76afce259edae5b184857d962082a6e4b94954c0223074a0ec1f0370381be10489eb70f38759e4f9a7a6a55a80865f9e
SSDEEP 12288:fcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:fcnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1C25523697965F98BFA1706F14C838182A77B0EC6BFD1938F7B4C2128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 584ce64fe607b4e4246d69098eb01f19c237bc934970689f055339b60748a0c1
MD5 db0c78cfb3186c894b6d201496fa22ec
SHA1 7a54c691d73b9b6e07241721ec620a83a9fdc126
SHA512 96a50a02ac864d0a1efeffda73e9ab55c26b6cf579b2bbb8b653333e7c5d1cb1b44b2299092e491f39e367f39a8c499a1ce0b90fbdbc08ffe2ae8ea8d067b0ab
SSDEEP 12288:DnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:DHnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T10F5523697964F98BFB1706F14C828186A73B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f37b9f54944b7c75be41000e93ecf27f9d0b9c6884b0a93714d10fbdb6764c20
MD5 289e5df448593dd845340b364ee71d8a
SHA1 87f3dcb7c2c8cd2cebf2606b4aca2fe708f5b906
SHA512 21a36a4073c0ca36ad9057f33a2788d55224c0c08e90d5af516ae45910b448db492a092e398ec4a42c53edc0d98e733b40f210683d61e30e3d592e9805c99907
SSDEEP 12288:27GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:2rnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1A55523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 88aadccd3b6dc2b816f400861863958870447f9ab3a9f368fc837b15b9205297
MD5 cf3f10fe3a7572a6fef365b4a98bcd57
SHA1 5caf8d4b103cb5640b4c3edd0e935fd79e92ac09
SHA512 50f8946b90c62f3962f268dcba787a0faab3a1061c97517ae77f0820015a98f96c6052ea7a8d2bd52858fcbf7f997124c8d274302c0e7fd5808775f9f8ef2154
SSDEEP 12288:+iZwbDzzFEoS2cPvyzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:hZM3zFVSOjnQ/tbw/2Mkjy6Fr7g0om
TLSH
T12C7501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 668dfdd66bb96bf7c27149847f6c4e8712aab7cbb3e0e71ea4879b10bd0d9886
MD5 8e92644481d837ed7431d887373e505b
SHA1 3f3f1f40a033f2fbbe8221f37da86b166ee52167
SHA512 ce887b46f9a2850e701f3e5572474465e4a4bb524b7b76d907c8e6e88741063059277a9db599dc6224096d4823142ea472f9e69eda8d47a00472d46a78f86d9b
SSDEEP 12288:LeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:LenQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1AA5523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 73e4fff5ff3463368324aed011cb4dc7ec2017666dd7124b768af39bcaad30d8
MD5 78ec87b8fdb0e7c6b2fa735a9e7d424f
SHA1 48fa1a06d566226b73d7627c8c4a489e5ea3a766
SHA512 57e4b6064ec4258d348145ae100479e11899b6287bea4d9bf63fba013c3f9cb21937b619524a52117b21f542ee681842fa47e91f18258d235380c89ad2d9b3d6
SSDEEP 12288:DqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:DqnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T18A5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c2f1d9acc8300ad39bd74f54601783179bb96c18b713990bcdd1f57776daf32d
MD5 45b24dee33db167628f334253d9bf4ac
SHA1 df20034fc57e28e6a5754439a1f030db079c6ae2
SHA512 ab8c4ca44b4c78da39e666ae4c60a14b36f4647d53a18241698f1c17f0d59a794a278c579af1b4594450f51e6a0fb4516136ed06b7b5f0be88fcb96a0bd095cb
SSDEEP 12288:+yPz5L8/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:jzyfnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T11D65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8ca690808530cae27e480cba7aaad175789533d5c2f2ea8d4378e7d4f5140f46
MD5 0b20731e1ef2cd557f99ecf445668f57
SHA1 1405ad4594b7b0b45bba2e0d56890eee185f6ab1
SHA512 34db3875f310f6bdef0b34d9bd462b764fc32950074821f9befcc8cf75c4f9311ccfd2c42d2797316ede4fb62d9fb1cbc1d22c1cec0c1868f0977bf5b237651f
SSDEEP 12288:MeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:MenQ/tbw/2Mkjy6Fr7g0os
TLSH
T1CD5523697964F88BFB1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 32c88a6024d97a7a238b05ab23ca5a827a69d6670982c810f0dad9d2e09bd556
MD5 e26d7f86de0235e9cf570430bc81aef4
SHA1 889a486bb0c9f859b905a249722a00655c35d91d
SHA512 f807fa313bdf57d1facd1d46ffb4f5793f7b012eaf180dbfd406480a67b0271e57be502cf479b6288acda7cee0d317ace843943a087d83263705bfd8f60b69b8
SSDEEP 12288:KeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:KenQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1EB5523697964F88BFB1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 301c96fcc488d6924295444310cab0f49840bb5a8747af6811958df9fed1e85f
MD5 cd6509f1e1e42803f5ebbcc5eac509c4
SHA1 601c3e0be9c5310c6115ea89e1519b4caca6b170
SHA512 f68de1a62fd374efd5b80811736b942d09864620fa7d9452898e71ce8e35e25651ed7ab64720a1de1b5fab38b7e65e350e203ceb173f461bef0ae090a92c4d10
SSDEEP 12288:JyPz5L8/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:ozyfnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1FA65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6f164adecb75e8a165d561456c308cbd0e70c1a1dc03209a860764dd72da3852
MD5 4582222aae8cdf8decacb2ca44adca72
SHA1 ffc24095d66fec5530a45c1ce138f86c6663cc12
SHA512 21cf5bc56452e5e887862cc2e17f117c976e8ad827119cc0440f0bdacfdcaf04ba1571f63c9ca05900e7652a0810dbcda804347d57314f44fcd4b1f4d9379a83
SSDEEP 24576:dT0aLl3z0zD1nQ/tbw/2Mkjy6Fr7g0o8:dTDLlj4Q/lFTjN4
TLSH
T1967501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 26a2f7aaf6dfb0fdbf67da6a1eb2c93b618d794692bbe97a16026bf65f3ad30f
MD5 25f413d2516fc52da7bf4f97c8babaa5
SHA1 dbeb1cda5655d5882ea938d4c06105a277d2901e
SHA512 d7c12b0376b29f446145860f1bb44e6ce0b1fe6ad8a7804a31ba35b3d3ef36e57d9c397b8c378f2c4e5fafa137b9e33c3866b12e908a846c5f7ea57a80ecc513
SSDEEP 24576:l31d9CHKy7GZ5nQ/tbw/2Mkjy6Fr7g0oC:F1d9CHKyaXQ/lFTjN4
TLSH
T14585CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2e00d13e734599807d53b59e5673cc6ca5af0e58a4791b98313464ad21cd3b2f
MD5 02f7ca883cc7da78b8cb4d5ea204748d
SHA1 bb8f878485dbefa030f40845669af6b3563ceac1
SHA512 dee59fbe222bccb9f195aa081f85b2330771acdda1d61d77dfd8bf1b4ff70ea26725ac957abedea56bc49377dca649f04171d2fa67710fe91363ca801f8e6a98
SSDEEP 12288:mFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:mlnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1AB5523697965F88BFB1706F14C828182977B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 79448d7b192ac9f65652ca9ef932f5dc6e67968f9ccbf0445f18005621a1badb
MD5 da110068a90e3dd6c922388909385659
SHA1 7dbd6039fa7f53097002647521f87d9557470e60
SHA512 191b6328d02b458043af0305349ef4d263c1e6cd86a5d19073808c710ba8e15630cd1adf388c2f955f9a06ee710c2f4d6910c53ef9878971d07bcfe3a4e16edb
SSDEEP 12288:AfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:A/nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1555523797964F89BFA2B06F14C828182A77B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ff36b9214f74888f9e1cc99bed787719d16dba419ff036e5e7bb455e7e5c3b07
MD5 7b4b02c423a5ee65f6a550088e08ce5d
SHA1 7f1f5b0e7fb72fe9fe7ab702fc3bb494545868ca
SHA512 606b77e0010ad0a32fabc331ad567dfa92bd48d28d472235f1ba73a85eb6de22dbe704f3b03193bea663e3d53c9404b35a66e1f74d35087840c56373802adcba
SSDEEP 12288:EgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:EAnQ/tbw/2Mkjy6Fr7g0og
TLSH
T16C5523697925F88BFA1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d4922f69dd8a669bc4bac6d801598492d833d234cb72468bf6eac3f3b624f92b
MD5 a79777a806c4171ef96dc5830eceb76d
SHA1 d1ccc19f705dd6418e37226741fe0b2cec0f11bf
SHA512 3f55334336b178ca4191e4f5599f2634f8585f05fbe78847c5b1070719965b53a90a32b6df47d7136895be9d15a78aae09f6c108386e489b1c1ba074cf1148b2
SSDEEP 12288:BeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:BenQ/tbw/2Mkjy6Fr7g0og
TLSH
T1F95523697925F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f378bcad9517b26474a393f2e29cdcee129e0f76be7248aec1f01fa397033cba
MD5 8a49fe713252ccd4b3dcdf8f6488654b
SHA1 88e7d05270335e6656c89485e626c06175759844
SHA512 b70175ecec0e121358bc58135db4f4018926dbe73801d8ab4eed447cc9a96c1ea6c07ed879329e09ac3df2122825871486a7b5019d47ad860953ac0137615c81
SSDEEP 12288:1FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:1lnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1155523797925F98BFB1706F14C8281829B7B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3a4f8300f7ac322cbf6b120c329fc6cab8a35f46e7ec507dcaa3a94a8e270de8
MD5 58e4a2cb370b39bbb2ded566c795a923
SHA1 6cc3ed496ab18e72e5b38dae2f2aa6fffe6d56eb
SHA512 31f0a72910ea105ef67138ac1cc947bc9d34a42c0627b2f0756573b784c8f9928fd2424dda458bf3e357e03794fd3902a424f5f768bc09b5fcece78dd40de2fb
SSDEEP 12288:9mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:9GnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1F45523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a20fe9bc77769995ac1bb30b4d7d850db355c7c326d0d6b40c9e4cfa8e8288a6
MD5 d63f47753259610dea2d84264ca13205
SHA1 b05305e0945020fbc1406210ebde0a399c91c469
SHA512 5709bdc1dbf91fa039f654a4f7f814f116d2f7fc1bd96d4900a67127625a98a093506fa0d337340350798ed4b51599a4396858ba43f621cac26a320eb3f4a348
SSDEEP 12288:bcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:bcnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T10E5523697925F98BFB1706F14C8281829B7F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 8d8a3fb1585eb29169872ae71eced66c86150a7f4698417c0e0eb5739185208a
MD5 9b99a340f842173d5514099c2c2f4757
SHA1 10c1a7d6ba9b3651c720ad8db24b745b37cfa52e
SHA512 98c05a0fe392422cc6e7a6443054220a22e08564f1ac0fe42b7565c8ae6261c443875e41ef0bd3a756787ecf6e0233c8da1ecdbb323e35001582665a5cadaf64
SSDEEP 12288:g9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:gdnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1C35523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 100076a89de8f8579f073423860afa85622e1e7e6d294440c38875d91ae57dd8
MD5 c647aaffe7b74101dff29923b54d3556
SHA1 5273cc7b06c315b723b32a5e9520a6e4ce4f9794
SHA512 b9b3c938b38e0da110f39974db8dbafa17c69a3d88264aaa1d016d6228d2574cd7ae9acc60a59b1050f3d80f0c4c943b4fb594ad57376dfaf7e6c74aa1b0a525
SSDEEP 24576:Wfwv/k9RX6wkyAI6nQ/tbw/2Mkjy6Fr7g0oF:tMnYI6Q/lFTjN4
TLSH
T1A285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 02a85a36266cbf54aa97b3b4d4bfbc2a3e6c53cb4ed108bd5e8d4844d185033a
MD5 18b9e77e1d9374b0299f32df4fae6d91
SHA1 e69dbd17e71aa4dcee961e2efc62d32ea127ad1e
SHA512 7287e1a893ad989b0e62314865ee183b21eec30adef322ba6d21f91dce67ed07420e337187ee167286b981b6540aeed78024474f4a98f0c9e446e6c30154332c
SSDEEP 49152:KYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hQ/lFTjN4:kySzPuLm
TLSH
T13B066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ba73530b4c7dd36a46246ce36cc7331bb34e45abf659aed890a5aca10aa13208
MD5 1b9f2015c13a8db4229cd52671031365
SHA1 9696a8927327e8d0bc790bb1422b3fce2259597a
SHA512 35ee3c19585ea044b6bd97b5ae3d30baed745ac891dc854b6444cbf9e0daf5f97f98020e6b0264879bc7bc6f407584f9cf7f6233c8575b7c3ee0035af2dbec41
SSDEEP 24576:t47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYznQ/tbw/2Mkjy6Fr7g0oE:t47JUQj1irIhCnDHUPfF/xQ/lFTjN4
TLSH
T1C765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 12ecc01eb28ef0f146cef6ef4ad8d48107f492392236c50c9a2ef3af9484bbd3
MD5 061e6a3e66cac0387034e81f5b9e409a
SHA1 dc246f1217caa5db201973b173e4d585a24f9639
SHA512 5b5cebf9cbf2d871c89d4d40acc9e292437f70f0ea49426086822746d34f5cb28b4dbbaafc502d52127eb1f7e42175c5a747f46ea8858d9f214a7fdb00373afa
SSDEEP 12288:lssfOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:FOnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1CC65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 73786c37c713ea113f95e98b37745ac34b99bfb06b23346c188704e3adb200c2
MD5 3712852741c8de17014af01ef4bea20f
SHA1 c9f87722f1b4bc548dd3bb53dac7a51465b0ba2d
SHA512 b0e8247601a7d70bcafba5eef8b35c6901439532239ea50572cad0cdaa70f7f743bfae714057300f939275b9233bc8e16890edcd0a5ca349b3d1ea90d59eb332
SSDEEP 12288:uh+RAU3fscIEVg5sNQi3BoPbMavYzg36YgfsBjbEc:u86UPsXkUiRqbMaQgKjfsic
TLSH
T1E0351851766BC75FC6AD40321E32D1CCA7B07C55EE45AF0373C8873E8576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c35363ed9ad97d82524aae27fb2d235d3f65229ba1f088ff0991edca82565226
MD5 59139a7e18d65f6fe8f66ccf1e342a27
SHA1 d16ac8c0ea08b61f83aaa938646337a9417d8f7f
SHA512 2d41f01c8db82776af06c687f12c4022e309d8f0afebcea4958b2f61b2798b9647eae5f979d9b37c8c08513c9675798a804a7fc567625a0a1ddf4acdc75a2d98
SSDEEP 6144:GI8doqRtEJthvnsBRgRjRicB2ZpbOLo6LoMk23vtN+6fZTx8wMytMx+MytMxhrZN:GJchvns3EFicB2ZpbKz+6fZFBXv4IWge
TLSH
T14F65D9815037E3CFD1FB6032072A5B4CA7A4EC16B7455F26B3D8453AD86BB21A1B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a45eb11c224b48a84ca3e542823afe36a3d68d4c3ad00dd1b431c4109e4ae808
MD5 8de04f558c37269dceb8ed58a0916d77
SHA1 d9ce21304e74ec9513c2d8c2fef5ac28a81b04b4
SHA512 fe7c183d2d6f8a423bf9a171609953ba3d33ab0e26474030fa1cacc54653f5911febc0481aea0b2881060bbfbcf57a744c5efd07234d51b0c5b833b7a7c01b9b
SSDEEP 12288:e67WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:x2nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1345523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ba3c261380210bb8f439e9dd152f7626d7be568c4c87f5b3063da87413e6aad5
MD5 e3bcdb15caa7436515b8c157d7244c3c
SHA1 8c6f8a69e1eac5fc319ba53297202e8c32aec058
SHA512 f7df1907f390a6513411629914b894ee7594e91b1c14a68a1fac721aae36f60daac4a2a358fe4ca9b530518b4098d1adc129470aa92e8e5f4ef69435a56560ff
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bY4nQ/tbw/2Mkjy6Fr7g0ol:Xgb4mBIBhGFzQ/lFTjN4
TLSH
T12365AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9529730e4d47f7ca3df6d218d7aea30bb0f581d4cd9aa025d7fba3d1bf020346
MD5 0288e612ff72058d95e1c19665dceb87
SHA1 31c7b12bea28176d9b692251360d78500ed000b6
SHA512 86b92a1b0d4419a124a46685522553c3c0c378a3e7a7782dadc276f71d46061c60aa927c5a5435f910f41656535aed0da0f2d771fa8142c1e8acc4de4fc9e3af
SSDEEP 24576:CG88u8FpJqH1Qzria7/mjnQ/tbw/2Mkjy6Fr7g0ow:Z7ZFPqVva7/gQ/lFTjN4
TLSH
T17185F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 30d81570f6a775d5036584efaefc4423d4b40cb9751b062fc869c8780f5019e4
MD5 84e6ac33cde681cc65ecb601fece4ae1
SHA1 81c2ce46d92ccd7b7047d18382d4ae4b1fca862e
SHA512 e1b5a959dd0bb33a640b12680906dd26c7f09238e3f0376fd6b3a1053695789f6a3f353f9dc21110779fbe5901936010d6dad85b6b2788b1d0b4accc3b63c2a7
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHQ/lFTjN4:QG05lO43btLm
TLSH
T167D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eacd0270b4c1c3c93ca3ddd2330690e4cf8140fc0c5ab6b17936a1c0407d35a7
MD5 09c30bdd7fbb549f490e1fb906209ddd
SHA1 d905961b874f29f00b76ed4a55846a46288ece1a
SHA512 cf453e8eb74d58094bd80c8a5c83671059912731e4517d37a2ba0890028172acd39a932a8da26bedfbe382d6730fc78e1e3522570a4fdd4fe2e6353088699d11
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhnQ/tbw/2Mkjy6Fr7g0o/:Ta5POZ3+Jt2pasx2+m/Q/lFTjN4
TLSH
T1E965AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 02d672362b7a533d348348c3acd8f5a6dd2cda3dbaef9eeae88aa7cc5ac910b0
MD5 98f4a12523e701c5f8875c942969ef84
SHA1 0e871f54e0f24fb633bd15c1bc716747f3449b05
SHA512 68d8deeb8704abc55ea73fdc64976c9b634f47f5dae61fa3e422345973707c4ae7b4fedea7620f54b704a4e025372163877e254b1e64483e41efe627f8988311
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7FkbnQ/tbw/2Mkjy6Fr7g0oi:CNc/zEOVHFAQ/lFTjN4
TLSH
T13D858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7cfb95a9b5878e71d030d7cf648e58ba4d8a9f720cf0658a180b45b890d47f7e
MD5 9b4907a34ecc38803c23ebd0819f9a69
SHA1 43c575eee1b76be90111c8c7d02ab9539fa3c0dc
SHA512 b24ac3cc94aa50dea2b7ef0169073d7ddc025e490ad09a351a49391cf9a0b2fa98020546ba5f3ca1d4983d6f5a28cf96c5e4192e59abf94e5c11f08e08599049
SSDEEP 24576:P8kNvNnaFeYhJNtmZBmdnQ/tbw/2Mkjy6Fr7g0ot:P8MwBtOmdQ/lFTjN4
TLSH
T1F255AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6ef13ad31b3bd520d9df2ee9b99f187f196b07644040ab24021d1d270b2869d4
MD5 7a3e5ef488268be93ebdc4d39410862e
SHA1 c8366de555ddedc2b319fead7eda245fd2e22af3
SHA512 4199825b47bd2637ffd9bd7ea4944965dea208ab2dec7794e4e2ee2d1db12b54648850103e016e40fd2b2ce87a7b179062e51850dc552092ac572c9ba13b720a
SSDEEP 12288:hHvUrBFrEjwaQ3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:hPUr+NQXnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T11965E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6c17e343714b515e2372120131a087209855eabfd5adb6555be74acffca1c02b
MD5 e563b45bfcd3d7ab12f202b68eaa027b
SHA1 7b21d8594fb3b7e9ba7ed5fd3694943b81402c13
SHA512 57e26af3e3e9ec27a8785e9d44dd90d8946adad07c19bc62f7603f2df7d702a37c411153cbd0fc6136dc7e1d3fe50f4e9650ff9400de141f159f07217f47e554
SSDEEP 24576:TD3FHshBIYQgAynQ/tbw/2Mkjy6Fr7g0o7:TDVHeBIAAyQ/lFTjN4
TLSH
T14475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/596-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/596-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/596-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/596-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1104-78-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1104-83-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1104-309-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1104-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1840-317-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1840-320-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/1840-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1840-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1840-8-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1840-0-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/1840-87-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/2244-379-0x000001799ECC0000-0x000001799EE9B000-memory.dmp

Download

memory/2352-40-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2352-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2352-46-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2352-50-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2352-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3352-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3352-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3352-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3352-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3352-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4240-126-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4240-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4240-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4240-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4240-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4732-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4732-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4732-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4732-289-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5064-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5064-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5064-383-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5064-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5064-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5064-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5108-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5108-23-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5108-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5108-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5560-312-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5560-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5560-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5560-314-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/5560-101-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5560-107-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5560-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5860-114-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5860-123-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5860-120-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5944-67-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5944-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5944-73-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5944-307-0x0000000140000000-0x0000000140176000-memory.dmp

Download