0adff469d4255076b09b5965db0222a8e9bfafbc933dfb6b1c29703ad706d93f

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample260810-a4pbas11ex
SHA256 0adff469d4255076b09b5965db0222a8e9bfafbc933dfb6b1c29703ad706d93f
MD5 cbdf885e868e91bc202cf35019433715
SHA1 410fb14fad3662801ca668b1a2eae6911e67d2b7
SHA512 5d1645f9c15be18cb84b6d1903ad98223ed9d21a5a6005a1c0b55c60d6ca9f6e494678e4e15491d5ca7061cdc770ee9266a6f08b332c084ec60ef2f731f1c2e9
SSDEEP 24576:sjo3QSVL5jqcY87AfYLH8AcevDN0FImbwQuq3Wia7gD:sjorVL5jxAQgAT76sQuE
TLSH
T15B75F11EE39954FAE5B7D13CC8A24506E6713C65CB71D3CF03921A9A2E337909E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4148	elevation_service.exe
1376	elevation_service.exe
1864	maintenanceservice.exe
2680	OSE.EXE
5896	PerceptionSimulationService.exe
5868	perfhost.exe
2760	ReFsDedupSvc.exe
1496	SensorDataService.exe
1508	ssh-agent.exe
5240	AgentService.exe
768	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\68a12f2c238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071ac6db06128dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb1dfaae6128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d30858f16128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000628701b06128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e84d6af6128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d2c1db16128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001f6c9b26128dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5856	2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5240	AgentService.exe
Token: 33	768	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	768	SearchIndexer.exe
Token: SeDebugPrivilege	4148	elevation_service.exe
Token: SeDebugPrivilege	1376	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4628	768	SearchIndexer.exe	100
PID 768 wrote to memory of 2316	768	SearchIndexer.exe	101
PID 768 wrote to memory of 1352	768	SearchIndexer.exe	102
PID 768 wrote to memory of 1308	768	SearchIndexer.exe	103
PID 768 wrote to memory of 4152	768	SearchIndexer.exe	107
PID 768 wrote to memory of 5612	768	SearchIndexer.exe	108
PID 768 wrote to memory of 1732	768	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_cbdf885e868e91bc202cf35019433715_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5896

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5868

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1496

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1508

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1888 2716 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2728 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2728 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1888 2716 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 001ae6c413e865ba71472f5e3e488312e71e225de7daa8fbfddb26168beb28d0
MD5 e081c6fa485fd1c8d52cf17bb93491b4
SHA1 61c2857e0a5c02fa22b170e04bc6ffb33b50e4bf
SHA512 6d38f42379604151c47ea734a3ca94a3112d6841d34dd8f2e8e722afd1b65b51e882019131a7d256d0a47fa3ee20e2e97745a1d7b579f77bca58617ade387739
SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnTAQgAT76sQuE:W3q6sjB3qGsQr
TLSH
T1B8D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5437f2df001917830c9c29679131c84d98bb573c86a581ff91c6dea65d96f0e1
MD5 0b2e259710fceab8cfc84e370d270d1f
SHA1 84d5d94f13233ec6464bbf50803b42a78826a4fa
SHA512 14cb3f4f290704703a62f32e003c4decc46a3e744086f33591577035e2bd5a7c2d1e3bed7c4dbf96abc2fd7748d95ecdcf4140e2c939bce86739438dfd6ab310
SSDEEP 24576:8XYfDtczAqAfYLH8AcevDN0FImbwQuq3Wia7gD:7tcNAQgAT76sQuE
TLSH
T16275F12963D408F9EC67813DCCB28521E673B8954360E7DB03A49A6A1F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e9604b42ce8794b98632fd05c8468ab514b4857620f17ddc38b1c1f1bdd52bb4
MD5 649c3d6d96c097e60f6fe118831cb93d
SHA1 f8c38a2d6055dece8eab816467ce3eeaf29ff17e
SHA512 01aac7f0c986cbf8a076fc43ad0f3e82dd89ae99252639659898325a43c7151dda53bf72e1fabe2b5a886097072d483d302a0aa077c39702d75903d5b528aa82
SSDEEP 24576:t0Le5ji0hmxxrM7AfYLH8AcevDN0FImbwQuq3Wia7gD:tPji0AjgAQgAT76sQuE
TLSH
T11785AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b8a5aaaf0b4bed00c26ea0be12d7ab169d08f5f67451ed885d56a36aae3ec447
MD5 f38e6f3e7bef666fe67c913dc9d2f840
SHA1 a47ac5833de497327b45427c2288e870cbb216d4
SHA512 8efc6891a1e3f17ebffafe7d7bb999b0d160186628a790c0b62cbe2411c6c84c55bce75f1aba46e7af942c0e63b3c60c47c72e4e489bcd9c28e5d631dd2410b5
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWn6q8wyudAfYLH8AcevDN0FImbwQuq3Wia7gD:x/ezSC6vUzPveHjysAQgAT76sQuE
TLSH
T1CC755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1cc500c03c47708f9afc4a85b2737f09b4553780e969e682338f71de6697be81
MD5 5aa9fd4df84baec266ce6ef0248f27f5
SHA1 628b9a04e7e3fb0579bc8075a36469580bd3a1a9
SHA512 d03a8983931e22929b0f8d01375c74d15e73c3f78174aa12d490557374047dafa791354b83f4a19e793441c28bf9678b9ba8db591e82f7c4ca86caac1af9ee37
SSDEEP 24576:iVbqPb88hv/l+YOAfYLH8AcevDN0FImbwQuq3Wia7gD:iVO88hXl+1AQgAT76sQuE
TLSH
T1A0559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 372eae5b71677fec559509af4a13988de1641963b5a643d4cd86e6c9bd716f17
MD5 87c9d76b9550b13b8c771fe896f211e7
SHA1 4336f33532524e987ab14d052a2d094ea308e2ad
SHA512 230f46296bf1e84fa115af5b0a4c22a922b17ac3e3822815fafc92203adb7cf978298fa6880bdf3deaf6eedbdb881aa0219378d07a7ea30480ddb3674e3eecf0
SSDEEP 12288:MLPAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MLPAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B3552357864C70EAFEFBD1369CBBA9B963D1BCB88244979A04063BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 68d161f22057667071d3df0d2017c1b64659879c4a77031f8f60aad4f565d348
MD5 aa2e28c8b0419c8c50fc633899dbe54e
SHA1 58db2de6ac290dae6a9eb8b69a4bdd16d3dcb447
SHA512 73636c8d413363aa662bc96b2abb374ac758356d0ad08ecdfb8202d11b2059bfb80a49dc4d98ff9df9fde4af495f9bfccd4ee35482c8aae5dc90363ce34ed467
SSDEEP 24576:vJIU2AfYLH8AcevDN0FImbwQuq3Wia7gD:vJIU2AQgAT76sQuE
TLSH
T10675DF3BEE28FCE2C67E8D795A918600D7B278704B51A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b110ebb31a36eb3b56b9eec4c4e3a403f03acb92a27963853c6b3662999013f9
MD5 e1efbc0673f61ff15fffb95303a38774
SHA1 e421dcbff07a092af819ea8e017f5082f85a428a
SHA512 0e1ec9818518a93a46a7f1bac5eaff5b6be7691ddeef7051d412f7370420a2b793fc2bec3fa720d9cd8066ced340e41980012e5ec8dfe48e328f914bf061da24
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THx:/QvGAdlCEL8c/DRNw5CWqGsQr
TLSH
T1CC266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e2c52a667d302fb17aab8964184c950d41e107ee7357918acea05e93096facb2
MD5 b4c2756e60155d97ae559958e63dcc4e
SHA1 6219b441da4a339d908fdac0fcff7877a9e168f4
SHA512 53ea85c2bb08fa9853b49b1c8cab7e40929c0af1d7aaa235725b06044e10f507671482a6b27fdf7d58d68cc4bdaf1b954b650ee0f48c82bef78f43789327d144
SSDEEP 24576:m0ewsAjwAfYLH8AcevDN0FImbwQuq3Wia7gD:3ljwAQgAT76sQuE
TLSH
T1EB75E031FE74E036C6BF0DB61B36C716146CB9204B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2054b223a25b42884f312828d9e33c108f0269b9514a4f6b8652556003fbb89e
MD5 7d6d48ad71b2cac978c6f934b1d6f9af
SHA1 c0b0d1c8dc129497000c0d56023fec73aea9fa94
SHA512 2ec2f39be8052c87b9e742a974de4df3b287b95c43c6c3b832628dfa64888b498a67aa8c988aa810c4c576443f1424ff731545216f1090bf1bcf2bab9e184adc
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHrj:IUEtQevvqc2W1cpV2tI32
TLSH
T1AD474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ac9b61ec50d5bbf64e7125b8ec70fcbf324dcd7d8cfda32aa6f069b78f0d149c
MD5 5bb06166f9d16a28b33820587184576a
SHA1 10648579aa04f23b3ebf8849dc0cd18899671ea8
SHA512 1230b4ddc5a91fe53df52686c9e68594426df0596250b89b2da4cade70ad6a6e8f53acc8b91d9cb969a8990bc404192c6d5c49089b10539b2796d4a4658958e5
SSDEEP 49152:uCbRquA/m2yL5zTfFiV+XenmE3/zQAQgAT76sQuE:DoquVjnmiqGsQr
TLSH
T161D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3726372acbe343bd960b678137b0b9bf6fcada34c83220d1d05dd12ba9fa9532
MD5 d155f4da3b607e28c14a18e8dd246da3
SHA1 47dde76ae64ab856edd60043ed1874d1b7b5e74c
SHA512 449851f0b92d2a314fe4cea0039a11bd93d4c050a5d6bdf9f6a11e982ad6c3e3c2e82b7bb1ac9a92a6e40158615e006987b8c13f45dd84ab5a210fd3df7c76d1
SSDEEP 24576:rAhGL3IFoiwtA5l7S53ZAfYLH8AcevDN0FImbwQuq3Wia7gD:rAMUFoiq5JAQgAT76sQuE
TLSH
T10E359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6c7273018c25f4dd0f75cec0208d265fcb8131ec719155920a5b297af4604b1f
MD5 af06ba343928ba07f14ae05ac4a9f22c
SHA1 2f44630a50f87055dbb8e30de049b68d6b769923
SHA512 e91a6412bd3d545856d6fd3865a198763c3cb62d861844c0e6d6d4c25109809c8c170e12414a26eb88cd64416c23d5466a43cfae90584a110c7a875baa3c1dec
SSDEEP 24576:Fwu4OWMAfYLH8AcevDN0FImbwQuq3Wia7gD:FwvOlAQgAT76sQuE
TLSH
T13165F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 84d96550f7aa5a68c9750722159e7d307198949f4694daa2bbf47a8a3bf14acf
MD5 048f92099efb1cc54d6fbf1d2c536bd8
SHA1 7032cf3ada390dcb452409255b3da12773982819
SHA512 d37c1547999a069e814e256014895ff3c1c5de851eb1935c4ba06ba65ea31fb750887262cf1b9a8ea30b7d61a3716a4b354ea23298546cfec720379363a0bfb4
SSDEEP 24576:hZujAfYLH8AcevDN0FImbwQuq3Wia7gD:WAQgAT76sQuE
TLSH
T17E55125B239830FAE5A7C239CCF65659E3B278A6532183CF0115079A2F37AC59D78B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 26f4e7bf6c11dfc0b9903b39a9fe9779e50355a54daf881b29860161cfc67543
MD5 4f82b056606b38f1c6cce3b717fca4b4
SHA1 e8d5d669b978d4922dae9e81b20dcf929580547a
SHA512 e92fe2c5b7d24995bda36d2d1ededda69da92dacda94d4a1a05ce2b8a13f691b8656eda0423bd8d29d6d0d44dedb89926bec9d4da1b066ab25176f2056b5ad99
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:+QRQyi36YOcPbLvw2gAf+PN3LqGsQr
TLSH
T1CA667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d036d0c1fccf8a42489df14ee7b1d3cf7e87a78e3068f3078815e1ec25f6aaad
MD5 97201461bea3198c429b49d085bd2434
SHA1 ab1a93bf398b017ce0280d90e2329eca35bd05c9
SHA512 921bf091ac37d4de8c34f7ab67741118b47bc77326a67a173c9407bdf01f7ed2bf62f34862a5837c1ac6a41c61bf8f58dc3f3b90b3297f2673105168d7a9f28f
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:YQRQyi36YOcPbLvw2gAf+PN3LqGsQr
TLSH
T1E0667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d037cdad8f1ba656d5df65290f72d30a7caeaeb7407aad62bd3339bfc9da642e
MD5 fea4e6b4973dc35c2ae074196f946a9e
SHA1 efbc6b5ca9158e0c0fc3c310a7ca7d6a99bffca2
SHA512 8000659ec4935f6d9203f91ce8a6d59f438ee6bd51f8c011fc928b6a494bfaeb87ccefb7902592d127c059cf6ff68bab993c5f3b859be74aba3b47184205dcd8
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0TAfYLH8AcevDN0Z:H68Qg55nhceWu7PNU3/gAQgAT76sQuE
TLSH
T1B1B54933B2F600A9C45DE1769F4A873196D17C758FE0E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b915575ef2a7cf99749a8e9e436b5efc8d20f804bda0136315fbea56f18b780f
MD5 63b931a36b6e4280ce27d68bcdf119bd
SHA1 c54c76628697c58c7c04dfb85d4b0a3b107519ff
SHA512 904dcafb37cbbd93e15a67733fade7d27ff4b0dafe649c8b51a8877530e30591f27137d0b496ab8ab4865b7278f9978a3d777a097dc6860aa17e4c70cc7227c0
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99P:1y5112gYy5azzVvt69nLKnhZ0qGsQr
TLSH
T18A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c9d7ae8f28d299ef082371ef1c12788146ac7517e47aae3f69dda125458a7ff5
MD5 c8bcae8403fd2ca89a1ca019e1489e4e
SHA1 02776ecffecf847ebf7b6b33898ab94a5eeded39
SHA512 67f9aeecda787a842349cff5a2adcbffd1cda313a33d9574e790d82b5dce1d06d9ce30589b161f15e13c5d38a82d9b16fee30096b688b79c3a1ca4a9f0c10b03
SSDEEP 49152:2B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glaAQgAT76sQuE:Eu6Jmdxd2dTqGsQr
TLSH
T11AD59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8b2146fedc3b4cc6786ae383e96d43ff9d3d46b8097afb13072e7757fbe6efaf
MD5 af8a622e4f0bd416059fdc0db507be8b
SHA1 fe6eba99237dd85e4b7443249fd21fb35ff36309
SHA512 24082cb2ddd71902eade0450fca9839e65d31193cf2b3dedd36fdd8019e5083302232e6016a90e12432708865eeabaf70966fe9881a667a2c1a1d309ebec37a0
SSDEEP 49152:A1hpsNoJpF1A63U44CwH7R4xWAQgAT76sQuE:AmifPWRiqGsQr
TLSH
T185B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ef53fd694007c283b9f16e8d468a9ca36897e0a14452c50c403a20aab9ea3754
MD5 e091acf40d150d54ffd8eb73a2ff5d8e
SHA1 4366ae8e98d66c9c03598d183cfbc5ff9f4da9e6
SHA512 5c2ccfd4b23997e6bba7afebdf7cbf8f105bb00bbca370949a0b6a15432e7ff8f7c3eea048c255496cb1271a37742c1c60f30ee4e94bc0b7753d510539d90162
SSDEEP 49152:TSuZQIY0Be2KcRVtOnks6NMHqjAQgAT76sQuE:R5dKii61oqGsQr
TLSH
T1CFC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3e705af8e441e31c6137de8ed7f1474830e92f10d65523342b70e7b7e31e72a0
MD5 bdbced43267cc9a7f3ef92989abd3f78
SHA1 81047e442259c24a0467f91bcf866f1c4fb73811
SHA512 f7eb3ba5e79cc303ac1c41104362ec2fab7967939aba6917aed56a7ccb68cfeb3f94f63082fb052ea6ff14affd04a22f63628f8983773334fa15f70f67424c19
SSDEEP 49152:rhtSn8EApI0fig3giDn0AP5wqAQgAT76sQuE:qX2imphOqGsQr
TLSH
T19095BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 af8d518e2aa2a808deb83617925c481108e4d1adb5b44c2733b3c06751446723
MD5 f80aa2a7c9a0a4014312f6c77f98722d
SHA1 f71fe1117ca54a5c5136ee61d80a864c8de2cded
SHA512 5308ae0575c9474657160dcc34b1bc836f8355b81214d73352ed8ca9e9f6fb84b2bec5320bb86336dead1a4edd75b42b3c86a387c5908276cba5b5bdd008df0d
SSDEEP 12288:M3AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:M3AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17E55235B594C30EFFCBAD1368CB791B9A3D07CBD9345939A110A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 918680a5a79dfa93980cf67e6e0170240601eaeb7a0d2113ca7ee84426a95204
MD5 72e24fbe92a6e574cf59a9d80aae4cea
SHA1 be587e516883f1e1ceb2534c83d78a943caadeaf
SHA512 04dc6bc62ae011cd2d1286743371d4eefc04ad4d8e697a1f13dcc1df3d27fa75a9a7527d9d78c8570b2d1299b27aca93da2fe12da3806a60399fbbe578234710
SSDEEP 12288:DkAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:DkAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15255235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A150A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5c4efcd8cc4935004de733ff5fc477c758f5da3a4ada3eef5c2aed79eef2c649
MD5 b47c805810067ddfce63d0fdb6dc45d6
SHA1 0ed298187b1948b6a36f17c8e6100d300d7d2aa9
SHA512 82ff77d2687fa1247ba0f9dbf9bec0528744c33e8a137b3235a387d19018999d212126e9843c3082fd8158fab3cac48acb2025945494c045ed66efcfc6d0e173
SSDEEP 12288:4+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C055235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 da807a40696206b5ceafd4fb64aa561b40affeec5b2f6328d796e0d92b52de79
MD5 6fe78a34aeead673663958806510d986
SHA1 b0af6a2db9c9af083f7944f106d7521b7019deed
SHA512 8efb81dd6c7267add6f345e36d4deb342be3ca4b9361dbe8df6f949fcc5078d223ad5f831ef41a6f44c4c23db0e271923274942a178b2ef0519222048d4314cb
SSDEEP 12288:yV5AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CC552357165C20EAECBBD135CCB79179E3E1BCB9931293DF06011A8A2E3A648D1F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f4fa12e550e2d2a805af093726f2281e06542007e5b469d959689fef7f9fde50
MD5 40a3c8bcb289a4e7dd45ddabaea006eb
SHA1 2e058a7d425afca52bc320637dba91c756cf88a3
SHA512 b45ecaecc2a1fafe2d4ec2ce1c5a107535892341c5f90be53d4de21456f3d89f697bc131c63c9e4030a4f51c89c174ad4135387934a894c1bd7f0fb7e62e339b
SSDEEP 12288:gRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:gRAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CD55235B594C30EFFCBAD1368CB791F8A3D07CBE9345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d6d3abee41a0fb16ec98c6b3a728a18804bde5225ce86d6dd5707aae65f2f6fd
MD5 51f602ddc4f5c0d5891e8ecf5bba8984
SHA1 a6e0384ebcfe7b910b0eace103e506d57f87479d
SHA512 67f55549e2ced86b6b37390e3bc9ff2fcdb70e1be70e829fc9e51b66541a1200a920cbf4f7ebc91fe19c04dd3bb09f7ea551ea753bd900e6b576c0a2ac478df2
SSDEEP 12288:24AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:24AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AF55235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A150A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 55a989111821647678fbdbd8fc19974ed6995fe7e0178cf6f933a6d0eef46fc5
MD5 4bd018a0ba98082fafa119e35dcf2e43
SHA1 5c8218d5f908a27fe4027bf7bc356515a2c8f31d
SHA512 84247e1e945e7e0695331f399874c53858f4970a4a54aa8ee920a64c12c6c45593bbf879804471d8c2c195b3db8bf4b0b9e6ba8461163ca362f408a4e4d6df7d
SSDEEP 12288:w8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:w8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17655235B994C30EFFCBAC1368CB791B8A3D07CBDD345939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4c5a5aee0acc2da7f102426cac3215957a877f1a1f69b64894375e76d7471fb2
MD5 3da283fca376ab10ed8274dbce0048cd
SHA1 eaa9712853ccd6f092b29802bfdffe10faa36c1e
SHA512 16478cd6da3a1cfce55946d8c39730b4b62a361d9e91cf4877721cf0f55de4c5bdd5dbc44d69eb1249267519928e624273b483c26def9ae54e90105bacbcc68f
SSDEEP 24576:GZMRzFVSOEAfYLH8AcevDN0FImbwQuq3Wia7gD:GZMRzfIAQgAT76sQuE
TLSH
T1EC750195B39018F8EC67813ECC668916D2F27C6A0760C65F03A4366B6F373A15C2DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5f7bd1d6212acd5289006d92850092ba8d27e92efa48f758311790bbb192a307
MD5 1b63b64747223ac188477f1565aca469
SHA1 f4ec901f520fc30ebbb31944dd5bf571e541b543
SHA512 b23ca684576562b3f4467239082b2c9bde44b9c34be259393c4fed4d627568a72b1590a2a03caa3be505d03e0cf2f8195f33c25d6941a80be4bcd26b7011523a
SSDEEP 12288:KzAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:KzAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11B55235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 afd693766f6d60a88974e377355ea209eebc0de9e626744271c9d7d58b3bf7ea
MD5 9986eb27081455faf2c971762e14f4aa
SHA1 0c85cda17d572f732e880e2123157242e646c413
SHA512 f3b0190ed05393d7dfce563b83a291bb7cbbbb2b5bf8099f6922425ce0243ab734205e8d77cb86f8648115772f76e45d382e1467c1e95630e2d2b3394a5a5ab2
SSDEEP 12288:QfAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QfAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13055235B554C30EFFCBAC1368DB791B8A3D07CBE9346939A150A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 398e465fbcc53fbf6aca0f1f3709268b7f72d12be11eb8d75c9be429d9ba5bbf
MD5 db8a1a4f15c077d00a670ba290dd2bcb
SHA1 a05d146d66c08c6cfd74d4d838a590256a350daa
SHA512 e251913131a195690fd205dd2ae7b5d129462d14d537c8361e89e53f19b7c17acd371ee61bca71ed4b452e006602199057b7c2ea1346ae255e547b2e15033708
SSDEEP 24576:TzyAAfYLH8AcevDN0FImbwQuq3Wia7gD:TFAQgAT76sQuE
TLSH
T18C65021763A530F9E477D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5c62cb868634e6e67846257bf5ca46d34f14139fa1a1e8d985dddbac396bfa0e
MD5 130aba746cbe6113a12987b91aedbf12
SHA1 70542f7585d7c5046dd6cce33c142c9f94cf9ddd
SHA512 576b70d49ec6a67b453886b1d6e77064e615baccaba89bce617dcee3ede516e16ad02c0058f1b4fe7b973921814018c4625a7fc5bca7d93a4a20122b543d9762
SSDEEP 12288:AzAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:AzAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13B55235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b5bd8a86dc4deb431343f3d2b302debd368259725aaec8195de4405806569a93
MD5 b9b3a4771fd93bbaa30bf139a41cba83
SHA1 9c5e109914f1ab4929a9222bbf4500b365f028a2
SHA512 375bc4b8b455e800c16930244473ef6347a2fbcefd90965545ec2c5ca60ab01f884065ca4b9b66a5eb3a0c54e908e917daf6ff8c9e055812390f37d942227e45
SSDEEP 12288:czAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:czAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F955235B594C30EFFCBAC1368CB791B8A3D47CBE9345939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 568f0b12247ebe5878bc6852a601410baeff3b56dca5d7567c6bb8afc3850576
MD5 484334e558ab8b095e5503626db829fb
SHA1 fcd4ea2346c49fdcd8148705a9012a1b6157757f
SHA512 c1f672acff55f2fc9acfd0f8e9382b4f80d3f445d69bf0c5360dca07d317d133d334fd955c20b56ac3edbe245509f40bc0597ee51f4f97a49ab43a836b0e598e
SSDEEP 24576:lzyAAfYLH8AcevDN0FImbwQuq3Wia7gD:lFAQgAT76sQuE
TLSH
T14565025763A530F9E477C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 30af716147beda7f1df39201b756bc9801944ce91f4422635730f947ff6dbc2a
MD5 7beb89a72010783e3446f3dcadf148ca
SHA1 73655fce6013419ac1d923faa9555b52e0b0482d
SHA512 0f1ec5d773492355a0751ee4601c968a1fe223fbbffd14c5ce8cd3d4bc08d0f64141ca7aeca0c15eebe476e9f34b3dbffc5de80e422871dcc4845137caa01722
SSDEEP 24576:XTDaLl3z0zDuAfYLH8AcevDN0FImbwQuq3Wia7gD:XTuLljdAQgAT76sQuE
TLSH
T1E77501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 7f3f5e8b6f79a0165bb6833a92cb87a4e8c1177a46c386f0dc2415978a52d651
MD5 d39c3474b0e10b8959fd25ac5aaf14f3
SHA1 a6b87558940ec723bbf3352a1f1c008f73009b4c
SHA512 949ebb1531f368971385b008442c74cea4d71e9a10ed70e82293e6de1107f1fe2fe0ebc5b32b743c1898e8208f96d6183fed5180e1994caddad43885b4ca42f9
SSDEEP 24576:P3vd9CHKy7GZyAfYLH8AcevDN0FImbwQuq3Wia7gD:fvd9CHKyaIAQgAT76sQuE
TLSH
T1C285CF91F3E810E8F0B7DA35CD765511DAB67CA91B21DA8F03A4265A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c18117942d93e3d8f2720fae8ff0766530995f4235d918c762676ed78c8c18c6
MD5 4c7266492dbcff15120e7b6b0159d05b
SHA1 4338ee116b85490f82a32d281441bd97b24c482e
SHA512 42115cc4e7ecd976d8b7dc8f5d6c01244ea12be43d307ea4d0936418313a237cf797a5928bc295633df8438de6a88ad1cff7f4ba87229950310f162d4898da0a
SSDEEP 12288:9eAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:9eAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13455235B994C30EFFCBAD1368C7791F8A3D07CBE9345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 694e204ad4e345943bb32b98e339f5e02a2fc385873cce283b839be2a2b48319
MD5 0d64f0776b24a9eddad51b45188b2044
SHA1 04f00ccba00f9dafbb05fdc3d545a79b51e9768b
SHA512 d1aa6014e49b423145de4111eab3d8e690c077d9b3c31e8ba733077c471f18f8d6213bd1ba24356c7de9bb1f4d89fc201c79194202f7f94f1eff9c62342e1ce7
SSDEEP 12288:XgAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:XgAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E655235B594C30EFFCBAC1368CB795B8A3D07CBDD345939A160A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 018690a9fd4b8747f1436e49136fa34a87743748fc8459fd38b49494ee6c5ec8
MD5 10acc4eb5d45f9f6b138c1a8219dd61d
SHA1 ca917d69f7824ad6c84824f048e8a692e7c436cd
SHA512 9e8922baf9b9f24e4f2f0ff7437c8130af54e522bb031fa5a91ea9677b7f8cadab0cee1a6d309157686fdb20336e4d274b92eb20b5a5f3138917e524b5cd7431
SSDEEP 12288:BVAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:BVAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10A55235B594C30EFFCBAC1368DB791B8A3D07CBE9346939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 57820a4d3ef4052c8447669262efc34bd9cc96974967d26a382e44f0475d54a3
MD5 e14b6bce1c2c3c1180551a41df06f407
SHA1 7460cf109ca5a065ac0c972e89e852c755ef0226
SHA512 8ec19531dd83f8d2a810a0993883c670834d849649bd6a34ea3dfd54f7df8ab16494c07426eacf8523172882e401bc9ee99a02588b8ae1c4f19c8a3ac1c80f3a
SSDEEP 12288:pzAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:pzAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17955235B594C30EFFCBAC1368CB795B8A3D07CBE9346939A150A2B897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 40d4c130e89b148ee1084c1071d67586aa2623dff9d54949027d6c06127a6643
MD5 d388489672bb8ce710a6eacfd1d0964a
SHA1 a14e5685df0662ce2b9b4ae0909960c389be8558
SHA512 b906327988d8cacb5ef545cfb8bef49e6aa0b616125a54bbe6c7cbc53c6694dca54a215823e0e63d1877c4fd431fd67fef2a005a1d3bb98ae0b3a4993ef05b25
SSDEEP 12288:QeAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QeAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16755235B594C30EFFCBAD1368CB791F8A3D07CBE9345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 964c0a58c63f51ce94a237bcae213a5a39a476aef83c14330640ba98a9de74b2
MD5 ba9f5375d1d2bfd9231c6b021598d7a4
SHA1 75740049a324a0bfcf864e84ec6a418777d13665
SHA512 463bb1a60334a7bfe8f9d89e17a3ff370f2d9ef3cffe82359e8a66c946dc83e59a27b21f0897889bf7e6577b34e660aebe5e554c2f3b103ff7d7edfd2a162a79
SSDEEP 12288:crAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:crAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13E55235B594C30EFFCBAC1368CB791B8A3D47CBD9346939A150A2B8A7A3E409D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 cf724581ee59d00357107fc531294f6824d68e3e1d275b21e1bc84d5bcc941ed
MD5 7e5418992c509d446bcb529691f1e6ee
SHA1 5a9ce6783755c584d8dcea17ff9fafdd72bb63db
SHA512 42edb3437cf3e3ce5ee42c579110f3ce7412c5c4d80106c52081790ed350d6fbdccb38a711862417d10a13c58a0e312cea3b89a7251e2740f6bdd2bb386347ca
SSDEEP 12288:hRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hRAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C955235B594C30EFFCBAD1368CB791F8A3D07CBE9345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 10248b73a1ad4ef6ed9338e0d09059e6ed1d2bc501c5a18db1a3952d693d2379
MD5 880f2bd0577b72aac3b01060e45c3437
SHA1 9aad2fb74a50f73814bb23301d41a82bd8620ff7
SHA512 450b1d1a2370e8fe107f391d5ea0044beaae61de38f800ef8cd59c23f74109818f3c710c53bba8cb859d895a58c687c2411321c80be39869204a681940e27703
SSDEEP 12288:HGAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:HGAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16655235B594C30EFFCBAC1368CB791B8A3D47CBD9346939A150A2B8A7A3E409D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f8a20adf9435542777d5919585fcef2d2fe1c793beb1db7cbd3e93a33c72fc84
MD5 10ce2744cb33d082a75f3d3f1ff4d2ef
SHA1 a6d75937b8334cd00ff120d3e8f9912b66a432e2
SHA512 e3953824dadf2f0a7f0d708da154ffc8b8fdbf40ce992c4a162346ffc0c7e20b690048cabddf1a4504a080c3ab103b806919043ed587f09c31126bb31218caa9
SSDEEP 24576:0fwvUk9RX6wkyAIvAfYLH8AcevDN0FImbwQuq3Wia7gD:QMnYIvAQgAT76sQuE
TLSH
T19285CF2AEBDC44E5E1B7913C89B7460AF2B178691B31C2CF025A53AD1E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6c3707a26085fc223eb2fcad5fcf04133e8d84b5586b6daaabf83ad59153c357
MD5 3a34f95b1bcee5de6df610fcc4324d49
SHA1 28abe6248ade9bc6fe7e8ec5a622c6986ac18011
SHA512 6623a7aaf1e718bf89d65b4cee753d47db1485e66d09eef8316c6274c07fa12d61dea8ba9210e010fd0f948789e6d83ccce5a2f7f1d13f61c3ebdaa27aa972bf
SSDEEP 49152:2YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KAQgAT76sQuE:VySzPrqGsQr
TLSH
T1E4066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 952b6c9174f899131ec89fa638d8dc9b9308ad987e7a5bec3cc84b4206391b52
MD5 9b42c8a7e56acace1d50207c421da7d3
SHA1 5374a4751adc2beb1471edae630858096f601f37
SHA512 b0c5b756cb948acb1988143f1c5bfa3703e191675aa4c8bd5bb98c468a6de6c84db2e1f8257af0230f98a7723c81dff922270ed5efec9f543fe0b26fa63a3fa3
SSDEEP 24576:H47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYUAfYLH8AcevDN0FImbwQuq3Wia7gD:H47JUQjTirIhCnDHUPfF/aAQgAT76sQr
TLSH
T11C659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 efeb32627557cf681decc8e7a5dda913b98f368e313765b643687d957a5ed52b
MD5 647afe492534d48f63c05a6e46535df0
SHA1 9d3155460b0defb073307f623911309cb637a45e
SHA512 51fbf033eaae0edd42eb3495f3bee41b7d3b84882db67603ab7b5b4c0879027eb7b2f5698f9a4664455e30faf21ef467f96dbb7afc0456e8b3a1571271cfe5fd
SSDEEP 12288:GbsfjAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:tjAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15F65011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 04e6b8a3fad71bc86eca9efcb05530d97533acc997cea48aa40a2ec3f69fca16
MD5 9744b9a8e9052e135cc72defd80dff29
SHA1 ff036bde7a9e1dc101cd62bad1c4603b74500e8f
SHA512 bec5cd768b3886ff6212ada8646ccef0a47b33d444023117d9c72c9f96ea126d4840072f1bc87f93e29f783a18b670023e0a0b8be6771bd08a6c214fe08b80f2
SSDEEP 12288:QjNogy5OZkytuPLIlkBXlQA8vFZBxWzxSmcaRMbCpU:Qagg+CmjvDB4NzcaRMuU
TLSH
T19C452810766AD75FC6A940325E36D2CCAB707D05EE05AF0373C8873FC576668BAE2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 23784ecf37f9c4e12b0b82b2a72c277f76c4afc47a726a3aed5cb00084e97552
MD5 9f589ffefed9028390429da7762a8976
SHA1 f1c3808c753f26be85f4faf0791da58a6aecf272
SHA512 e78089024677e75208ca40357cd97f8a8f8826f71b95db0b142a47600a2b02e11f60037c09c314a5c50ea3565a266650cc7f8447998abc11eae964ff15cbb351
SSDEEP 6144:bI9uGwESpVIHjZk0bRkhOKDexHVSX6J1lFEYYOKDexHWZi1l1ifqkomrQwOa9ZU7:KljZkaRkh2cP7Z1xg8uXsU
TLSH
T1D0650A819537E38FD5F7607203296F8CA764EC16B7055F26B3C8053AD82AB25B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 df025500865477eefcd5a18a8b04d848f495363da097e2046570ed1dda2ce74e
MD5 2687d7fc8ccdbe321da6d4e37fd72abc
SHA1 56644e69a829c99e349ef1505ecb82d983283d61
SHA512 fa4781d6a327ca6c31aef295339df9d489669d6232e8fb9f4252166a9374a1e6ff2585f7ac3deb5480ea75868a2f351402117d8805c2ec36a815ba3c8b1b8e97
SSDEEP 12288:n07bAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:kbAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T125552357864C74EBFCBAD135487B91386399BCBC870092D7640627CA793E8C8D9F4E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1cf96d4b508e87accbae0e9771548db0f607c0c3b69c43a64a6d841995468156
MD5 aa4adbe568b64a207bf1d7019447c670
SHA1 6a37dd70b96264a608523969b2d888f0d77c037a
SHA512 5f2f8692aed6f564d244c8c049a54ce8eaed0708b0e10435bbab089154d7e6a4b33829163985a6ed0236d4b46a947a0439dc576ac3d091ec5563636c27fed694
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYdAfYLH8AcevDN0FImbwQuq3Wia7gD:Fgb4mBIBhGFUAQgAT76sQuE
TLSH
T16965AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 1759c75adc87a2d521dce342d0bf2e6e4fe9491ff120843d2983ffb779c5549f
MD5 14b7888ce96097dca28f594b999b3179
SHA1 c0a5509fe8b88ac987c6e421a1694cbbaab24b9e
SHA512 6f275bc84a59aee523a1b2aad0f55c11ea7a98f9c65f4beccbb7931a6bec18a11c231797a1fba499cb85586b340074c77a399103f3dba7342893ba4767bb652a
SSDEEP 24576:DG88u8FpJqH1bzria7/mEAfYLH8AcevDN0FImbwQuq3Wia7gD:y7ZFPqVea7/1AQgAT76sQuE
TLSH
T1DB85016677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 103dfae05b135c165779e2701560bf2e03577a3854d9f88f570637161b48f184
MD5 9021e3ace04af7e19e283171e2c39666
SHA1 4fe86478afd416971a93a54b68eb8e6d75adaefa
SHA512 6c8faadd898ca0ec609907afcc8f1097661d0f4117148dbaa5111e1d5c766849bea7e977a10c810d8748066fe39e047fe8f619ac4d3fdd58a65c5fe3e167ce2f
SSDEEP 24576:tPUr+NQIAfYLH8AcevDN0FImbwQuq3Wia7gD:tJQIAQgAT76sQuE
TLSH
T15465E12F22AC18E5E67AE13D89968619F771B8660311D2CF0291817E5F37DD8AD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b46eccac2a8b3b4d9e0e53f0885e63c49740b12dff6ffaec9e29c84d2178fbe6
MD5 b5356c8b02810970d44b2459fffd0b3b
SHA1 e6c0f0ae666cf3fa1d2cd020bd3d9c5824981cf6
SHA512 638d4e04de61e352130703ad50371c296f22bde7dad32f5c66816b6212db1d212a847b629ffc44c2602b12258d4dad156d34df0d6363087b6c9b1721b9d712a3
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4AQgAT76sQuE:zG05lO43bMqGsQr
TLSH
T15DD5C06E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1e9ba0917dd2090900d8286b0ad32ef52a731610fae8ad76196c9b060d30ab52
MD5 d7a17f371816336942419833e8b53ef1
SHA1 fd94e437f8ab04bf54ebdb1214097bfe3ff0da49
SHA512 4554102ca60e0adccc74f67d3b10452f20e161d654f936047ce5e4b7b0c55cbc22572d64e1aa847133b502df419b62b5522f8d54c693820a7ae7234334a2c5da
SSDEEP 24576:gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnKAfYLH8AcevDN0FImbwQuq3Wia7E:Ya5POZ3BJt2pasx2+mgAQgAT76sQuE
TLSH
T14C65AF5EA6FC00D5D5B9D17DC583861AF5B1342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fdf1dfec342e649cf9ceda80624c8df9e7e851a5b147b3586b227da564f426e6
MD5 97ebc346f2bd5bc7165b12826f69571f
SHA1 550bebdc969c5793df65a3ae1bfb61af05b0897f
SHA512 b40297ce8f00db70dcabf682cf42cfd40659f4a7ce31f41833aa6adc6a8cfcd25634eaf2d38836e5b37e709a75c3eeb0ec29ffbfdf65830aa27c0f8731797902
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FksAfYLH8AcevDN0FImbwQuq3Wia7gD:NNc/zEOVHFVAQgAT76sQuE
TLSH
T14D857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 71da089c4de756d8858fc11cbd0ca008f493a57e2d51d1bd5dbd996c566ae3eb
MD5 d0ff9c89573dd412851bd004334b8833
SHA1 5e919c29eb3bad85cea1d57463442a13546e35c8
SHA512 6bbf5a5027058fa33edfa5535f41bfcb4eced208c1d953e459d391f6a035fe4bb0b394929e843032c0f825782349ac49a0ccce99faa38939317f8bcfda33c620
SSDEEP 24576:4TkNvNnaFeYhJNtmZBmGAfYLH8AcevDN0FImbwQuq3Wia7gD:4TMwBtOmGAQgAT76sQuE
TLSH
T14955AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4ac1343166561fe5400ce3717c9771f4079d927a99b431f32a791642a2a52a33
MD5 49dacf51583a19f163cc1087ae989a0b
SHA1 82d53e4adfa98532275ad2c53e8ea2c6050520c6
SHA512 4b2915510f1d825fe21f10285fd7d853a77c026d65713ed06c31ccf4ddd3cbc5977197726be0fcf63bba5d0298df4aeda6e9ba317de55a49a6cc4d9642dcecc7
SSDEEP 24576:ID3FHshBIYQgAXAfYLH8AcevDN0FImbwQuq3Wia7gD:IDVHeBIAAXAQgAT76sQuE
TLSH
T14775E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/768-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/768-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/768-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1376-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1376-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1376-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1376-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1496-307-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1496-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1496-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1496-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1496-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1496-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1508-114-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1508-108-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1508-306-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1508-107-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1864-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1864-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1864-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1864-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1864-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2680-60-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2680-52-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2680-262-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2680-50-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2760-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2760-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-375-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2760-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4148-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4148-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4148-15-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4148-22-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4148-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5240-130-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5240-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5240-125-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5240-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5240-119-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5856-315-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/5856-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5856-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5856-0-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/5856-311-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5856-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/5856-80-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/5868-290-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5868-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5896-73-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5896-67-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5896-281-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5896-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download