2e7d31001b76abbb7b5579893b0550c7124566a1a4da8e21db4e161f49540f98

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
Size 1.3MB
Sample260815-qdebeaxbla
SHA256 2e7d31001b76abbb7b5579893b0550c7124566a1a4da8e21db4e161f49540f98
MD5 a7273a0a35f2f1923de3df4183f538d3
SHA1 62a781dd65042a60aa483baeccc20912a2fe8fb2
SHA512 c3eb79d973b7ce42332cefbd860d8d669316ea1adf6cfdbc46f79a8a32e3ac5e3a392c85ac3eeaae57f60fb93070316ee5224c4330cf4f4f0aeb878622d78e13
SSDEEP 12288:uVWJwOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EW0NyBo4kx929bL3Hnx
TLSH
T10B55020673A821F9E17B5234C9514605EB32BC260B609BEF47B087B76F7B6D14E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5552	elevation_service.exe
4512	elevation_service.exe
4940	maintenanceservice.exe
2800	OSE.EXE
5884	PerceptionSimulationService.exe
4720	perfhost.exe
952	ReFsDedupSvc.exe
1528	SensorDataService.exe
5228	ssh-agent.exe
5756	AgentService.exe
4936	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c8c58e56e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a76a2877b72cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6b82d77b72cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029010c77b72cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de67ad34b72cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000568c0434b72cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f5f5b34b72cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5756	AgentService.exe
Token: 33	4936	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4936	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4936	SearchIndexer.exe
Token: SeDebugPrivilege	2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2004	2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5552	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 5052	4936	SearchIndexer.exe	100
PID 4936 wrote to memory of 1444	4936	SearchIndexer.exe	101
PID 4936 wrote to memory of 5656	4936	SearchIndexer.exe	102
PID 4936 wrote to memory of 5428	4936	SearchIndexer.exe	103
PID 4936 wrote to memory of 3472	4936	SearchIndexer.exe	105
PID 4936 wrote to memory of 4728	4936	SearchIndexer.exe	106
PID 4936 wrote to memory of 4556	4936	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_a7273a0a35f2f1923de3df4183f538d3_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5884

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1528

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5228

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2788 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d85731e0868705826ee2befc2538a292fda89f078a3c10172219e59ec947f7da
MD5 ed9782a838fb6b2e78f8fe3a71ee9c3f
SHA1 a459eebcbbcbd355171bfa08cf8efc11bd36178c
SHA512 8f5a626563ef3dc7aa4c4deedab6a8364e0ad35fdf96e5d01e91e022b5509fd3bee05178e10a85ec43b5e6f2c2fc4267523a45ddc0bf827622e1e18ec320fcd6
SSDEEP 49152:2b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnHB+kn3Hnx:o3q6sjBa+k
TLSH
T143D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 540e537b8f7b99eeede4beae514f6e392fd4f834508693b31c3719c95b4925f3
MD5 75dfaf9ed4c8749cf9d5fd6921790520
SHA1 63769d4e2e63f350cb8747d760c3ac720c877a5f
SHA512 f62a6cfe3fc8f7b90c2108236703e5cd00a5be4d286e7b712657f95a3312282eb7ec6cb676b8c66b4ebcbd02abb331a45712d75334597f3625b136b72a13330e
SSDEEP 12288:A1XLsswWkxy2lRq2czAKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:WXYfDtczABNyBo4kx929bL3Hnx
TLSH
T15065012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e097812fca5f0d3527b88554a009c282071cf34084bfce725f09c2db495dd6c5
MD5 14a4692ad889cfb96a5f337b764abf41
SHA1 cad15286cd9f85bc8d465dab10b18b95e3b70162
SHA512 e6805a6de323debf4e884bd64f474ac92c766ce7e78e89b6db08cd9e3fbe477f510be01c1247d99580b159de699e7097441a55aa66ef15f6d879ab6a865f8885
SSDEEP 12288:rXZNYVLeyUji0h90ZD0wxpGZIVuArHsfLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:t0Le5ji0hmxfrMkNyBo4kx929bL3Hnx
TLSH
T19F859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8523ef8fbc22fc97f346c4c254ed5a068f0c32ac1822a27d2f67351f9c2ea8ed
MD5 59ccb57c1660e1c21b316029b601ec62
SHA1 21ec5ba4ee0c1e61d56cb523418de56c49f0347f
SHA512 d13c3ab9a8d568beac03a086901a007a844a61a0fd7b1a6195a1f0d380cd0d711033a945ccab1143be8be37427bfd1f70893283e91fe73233824bf59c03f50e0
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWn6q8wyuCNyBo4kx929bL3Hnx:q/ezSC6vUzPveHjyYB+kn3Hnx
TLSH
T1B7755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5cb36f7375878e229fa3ca1dc4602c120502bde7770ef879d6f8197eac9502b9
MD5 8160cb39a96b1b0bcbafb7ac09bf3778
SHA1 318dabfcce874e14d9c899935652bf2e64a01cde
SHA512 d5f965ba10c5e91a1ebf75640879eea151285833b54543698fe07f23a22b7d085578094467ceb09bb9cee4772172455d3c944060cadacd1c0fc662f5fbe04146
SSDEEP 12288:RVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im982LDAptNyvUgXZ32dT4ePc7N29CD:RVbqPb88hv/l+YVNyBo4kx929bL3Hnx
TLSH
T1AC559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e2ac84841385c3b76bdbcef7ca27e57c8cb85c717877653e56317366e6b05530
MD5 599e547b934b6a58dd9a591a40095462
SHA1 0b64f90f435d565aaf4957235cdae8f510f21daf
SHA512 70c66232f2051db3e3b421bf088f76792a33f4829ed1d9105b82aa96a94b9e45fd1dcf2f892033938eb1aa871bab9feab63d676a811a8416a828849b12f8d122
SSDEEP 12288:8mbLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8m4NyBo4kx929bL3Hnx
TLSH
T19A4523124B0C627AFBBD3E70755E8454CC35BC8D0D95DB94DE62ACBB58BC992DA21103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e4b970984c19173422e9aa05cbeee4e14252c77c176e20df0fba89987044270e
MD5 104fe0254c4a4c30677372f539fdece4
SHA1 dd488d8d15437f72b6b281054b07d0cb782d3ece
SHA512 1e4a5bb0fac11b62534fd82f603e50b1de4bbf399570262a77302facad1072c857be772810980fc1fae67cde73099ebe8f69fb7c2d82b4c27a6730f80fbcc53d
SSDEEP 12288:ReBNUbTVO86UuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RJIUdNyBo4kx929bL3Hnx
TLSH
T1B265CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c383f3db41caf87a7eb719d2fa29b72112e41a45476a80056fbbbb8d77e8c80f
MD5 9a21105327f95b4d9b6b96df7bc748fa
SHA1 6c926b080ab2fd780344fe35ff1c6fa5d528d57c
SHA512 f67898e5abcae243a80e8d2ca73ba73dd3256ce86c18f861ad0c62baf34964c87dbd341252c4bd74fbf92d5a78c8b5cfd80d9921f6fb8eccd9715babbbd25a8b
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:aQvGAdlCEL8c/DRNw5CX+k
TLSH
T1F6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2ab3ceb1fd4ca5b44a325527fb236008085bd4b6543a099cacdd401219cbc90f
MD5 3a2dedc485248dacd751b1ffe23fc7e1
SHA1 335d3a8685efc3381ba705586e1ed42cd5e140a1
SHA512 f14fcc3bea0c2930cfc607f48e244fe400d16ff3848e12399c67979bea74f416120b0cc5a27ceb014a226d24a8b77fa900d8643bf08cfea5cb8878695ad46e81
SSDEEP 12288:WAwSfxL/2Dc3XDLLmt0LDQewsAjULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:rOewsAjLNyBo4kx929bL3Hnx
TLSH
T17B75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 edd1972827cecf92c3dceda68b8a3bb5f2a250dc34126c2523cb11bcd48deacc
MD5 930cab8ed7d2d029e8033ca93af4af36
SHA1 ce3939c93b39e0ebd65417a027c9f1a8a3d1d820
SHA512 ded918743bd5f7113523cd40018e7cb23abf9ca9ed659a29a6e51fa8038418dcdb16437a1919b0e1a0139ef702dd472a91fa66f0b1d10758f11e1617cd090e92
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQ+k:yUEtQevvqc2W1cpV2tI32Q
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 142d0ec52920c451f4a7f46d96fb778729f4191b17bdba5cf3d481d7691adfdd
MD5 b9efe838dce7bbed643461c17ef9fb42
SHA1 bd906b92f19cabe5ad8fa294d44abc316ff66eb7
SHA512 7e6ba65f292f6be4bacecf61225de8eee38d338a0dba758bb87993482f05e1933facc293bdfa8ed7f0e7426927543cf0a6c07d01e8b30ad67cd2144e6405d22f
SSDEEP 49152:DCbRquA/m2yL5zTfFiV+XenmE3/zkB+kn3Hnx:8oquVjnmT+k
TLSH
T17AD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f72fbae8da1076b0d0eca1fe41baa01a580709ff53a80dca6b4528a35e09db0a
MD5 462320c4b6bc09448210af7be6bf6719
SHA1 c0820510c017396e6385cd220cee17e6991b9e6f
SHA512 f7886ae069365fc03222bb912870316a554a112f442f37e2568411c4d50b08136a873aa226df4b88d60ce1e2f68281e7f9dabcf66afc3719b32ac072a07b9eca
SSDEEP 24576:OAhGL3IFoiwtA5l7S53ONyBo4kx929bL3Hnx:OAMUFoiq5VB+kn3Hnx
TLSH
T1AC35AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6ed45406b1e726943f65e95736a275d29d24f0e0c08de6937a7dc3c129014327
MD5 d13ef9b498234f4802e5f4d0bc5d5f65
SHA1 cb8405674261c0ab2f0d13305afa148440d1e5f9
SHA512 3041160ba79836ef4432550127961bbe75ab08124a1f44eea210896f974b8f653afcde1e67fc7328baec331e416ea9450bcfb789b2507fa17df65919dbf69e89
SSDEEP 12288:omw5HEjsChNzBFgl0WDm+C9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Fwu6OW3NyBo4kx929bL3Hnx
TLSH
T18F65F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ea65cb4fd9145f75aabd02b261edda760cbcf7503f41c036d832bd4a1c4edb88
MD5 7196399a6face701fc446c6ea98f7460
SHA1 8f51b3e866c55048b6a424ae21112400b83bbe7b
SHA512 f0cf958c7371c52db5b0f7569e4ae74040697d9b313e22069e5b146f7ec5702fbd0d02029146b9599c2099d728835731824b3f78538c691bb206a616775415b2
SSDEEP 12288:ugZ1IykLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lZuMNyBo4kx929bL3Hnx
TLSH
T11F551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2145BA1F7BED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8b734a34795af9acbadbd86f6b36bdef70920feb09c6b07fea57267db472ce44
MD5 295e2f40a5b57c944c2c41e667e66123
SHA1 91040cd8273f6067d0c23e783f326b9b1a734df9
SHA512 1ca8d52bf2b973cabff9d18966a39a9f661a25d489918a1bf1f34c344d8289bd5bd112a243eadf8eab4fb76f19f20271735b9389aea0d5bee042ee0ffba339be
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UY:EQRQyi36YOcPbLvw2gAf+PN3u+k
TLSH
T130666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8c98a500b978f6c75f928951aabc57753949b7705982f94d0164780c4dde9782
MD5 e3fe6d415daa1ce3eabf4ef07981711b
SHA1 163444131fe1a92c2d5051c4be12b1cfa7a98ab1
SHA512 d254ed90b6103e5800bc966f874dfc959b37a10ea7102c1b8e3d229413fcff881009b678d6f5986e0b7bfa1f5235ab68f3769dfc67afeac6b9a8a91e6ad55a0c
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UY:uQRQyi36YOcPbLvw2gAf+PN3u+k
TLSH
T1BE666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3e222418874b65c38903f11301029abbc024afa04f32b10c72520cc0afeeed4a
MD5 41a7096d7dc0fed725b27c787e59c813
SHA1 52e78539598b4aa7fd4b7efa8c837d5401729540
SHA512 08219254e353c4981b158e2c706a9a73fa5f57d4a26549a732d0d5b0f4b0af36cf8317775ee9146cf786613ad964178a3432b8ae97002554e368c603c5b16b3c
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0cNyBo4kx929bL3R:m68Qg55nhceWu7PNU3/0B+kn3Hnx
TLSH
T1FAB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9e51775a0c0eaedf978a164a1f2a90ef73705a1a68df05bc08f98f638bc93a67
MD5 c479291d33905abad89326e8551b8658
SHA1 79f1d51169ba762ec779fbae5e7a52ae5dc69d76
SHA512 3a6e5b8bd6a48013594ef6f17c05e1e4e23de794a8f3d784acebcf805e1753781ed2d8e7e96e4d425ba723cfb9b0494f72d3e6018f26c8b480bd58597f7e8198
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99u:Zy5112gYy5azzVvt69nLKnhZN+k
TLSH
T141167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b760df5989bf892ad75f404584a72875afb78d6c6a9e0fa15cf90d66c59eca51
MD5 66c8be55d65d261f1ae37bf05cd14d8a
SHA1 e89534a3732aba5c0783872a6243812745604c6e
SHA512 a9cb14073b627e039766f23c33b93dc7f4770d03598aaf202b3db6dce83112c6c7998edc10b4f931c7167453eee7b0335b37f99543fe5093534998598c9ef2e2
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glGB+kn3Hnx:+u6Jmdxd2d2+k
TLSH
T100D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8c97eb5b881e351807ea50cf8bcda540812439e987f36e7c598739fa17e62b4d
MD5 812a703c1f88db9c0a9949f47fa95679
SHA1 8f1e4d301850e0682a3cea293410cf09c58e9614
SHA512 a2b974f66ece5b94b6d9a78eb507b9e3cb293b54786e217d805914946febadea451a9cccf453c626a1c18e9687a0faf540c120a810395f41e9e2e0b65080c743
SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4x6B+kn3Hnx:XmifPWRT+k
TLSH
T181B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e59f5ce178c387e49428377ed235a7a4e5ed0224a8463c520cc0fac00bf182b3
MD5 38e5b954e6b09d73f640d77695579ef4
SHA1 9d1cbca479e05bf4991adfc993e99c536bbfe2d4
SHA512 47ff28e5e1b95d9507ac0a734636a98a3a348649761ce84b7a3603f1bb1c53d321476d0f5756e071513aa00da4b26157a53c2b261356c433d90306509453aa9a
SSDEEP 49152:dSuZQIY0Be2KcRVtOnks6NMHqXB+kn3Hnx:z5dKii61R+k
TLSH
T1BBC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 55b02739ad43c52bebfd760ae8d6ab656fd3e3fed77eaefef7e63c1626d828dc
MD5 a21c9882a15e1af03f110bb492e00085
SHA1 67d2ec9a6952d57e2d9f347fe46a6d3fa0e0abb9
SHA512 517ab17336859d02214255b09457023c733fb7580f65b887471c4cf370eb62d38bfd40eef35bc769fd9a62361a9b7918355a311bfe7da660a65844590db0fbdd
SSDEEP 49152:9htSn8EApI0fig3giDn0AP5wWB+kn3Hnx:sX2imphv+k
TLSH
T15095BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3b36941a8d7a626630c92a78cb884e5a01f5262d05cee71634c9ae01baf65e73
MD5 3a0913bd548737e35aad855b3ed75810
SHA1 a4580a74c82968dd4af9beb0c6df3279c084ed39
SHA512 017812fdabf2e08cbace2edf33927ec23d5eb550d83a4eca474001d78359f73af21c72e1e4e6df3c96164074a69b6e2d85f00f4517b8044a4b802228ea43b64b
SSDEEP 12288:pzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pgNyBo4kx929bL3Hnx
TLSH
T1654523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b713e47e84bd81a62d1a72201e64a02b5cfceeb6cdc3a7c41610b93e25f3c3f9
MD5 91cad2ec02bfee453a2af048105cace1
SHA1 b1e81b9e8627899cfd49dc8e58b9d4269c2f6a9d
SHA512 a04755c823a4890876a4af74344e77c12a48b7a094cb20eaca746459d0c3657c2b9c52a97239f1b881172f87868010006f956f62ae07d7b96ca4ec0030446ad2
SSDEEP 12288:EQLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EvNyBo4kx929bL3Hnx
TLSH
T1794523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 24e7a5a622db5b5b0ae403f11357ccf848e967ddbd53ec549a620c44c4841217
MD5 744e1e78a3b28981a725e54ca4a268c5
SHA1 093e88af885f0515c039e24add7381259a6e6067
SHA512 50ef97d68c8d03d657d544e1d854644cbc19e9883a1da7099ee1181e9166b8f5c5379bf523e7b2cffe035f0d2567b9709a28eacdf3d7307090ed4a121ef9f179
SSDEEP 12288:jmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jlNyBo4kx929bL3Hnx
TLSH
T1FB4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 22ceee9ae28a097c32a13d2c0612425677bda0c3cd6330f12bb076cd817ad1ff
MD5 309e32463df74f6d3e0988f4be66edb3
SHA1 654802d1650938391121b0ccac4c5d6e89314dbb
SHA512 ff7d3a2aac333c686e2cf7309dd1429b98f6f6c21312a528432d335e52dd1e3946778506dc4f3848ea0baa4c543a8e1ec0ffb28f606cbf60a31925ea5ff3abef
SSDEEP 12288:HVRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QNyBo4kx929bL3Hnx
TLSH
T1404523125B5C12FAF97A7BB098568054C835BC8A5B72A7DFDF124C7B0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 91f27413e8ac0892737896ec95fc064306d22acbbc7cf12a59bf416fdbd33d71
MD5 c14e01b40cec42aedb49562c3728b251
SHA1 72e7cbbfccb80e144dd25be57efb1293efc65df7
SHA512 5b29f9dc3f118659948655044354d15aa5da6a666c1d2492784e7a53e10ed6fa5d9aed985ff8e76e24a191b765dfa888f6ce12c4244d62c52aa072022fdb20a7
SSDEEP 12288:o5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:omNyBo4kx929bL3Hnx
TLSH
T1C54523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6bdf2b1597c24cb5bc2ef3e4d4ea52ce8cd87750f6bfcfd14c55397417060009
MD5 e911635fa88ad5bb98a446a5ab7cb534
SHA1 044ea9fcaf0fd0f4ced33015a3b7f6dcb54c7025
SHA512 924882637029e6701f77f7db9cccadc49ea79ab7a38633b2f7b821bc147c314a44da64e51507e999704987c045c25da6dcd2801f5d553b638f363450de5e774e
SSDEEP 12288:XsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:XzNyBo4kx929bL3Hnx
TLSH
T1704523125A0C627AF76D3FB0654A8098CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2afb081d9de39dfcaaad984954820e6e4f92c334b547e0d0ef316a0149500bd3
MD5 cafbc4912c78967da269f98dc0322b5d
SHA1 7219e366641e87f137a70e146c09d03814f2b2c7
SHA512 62ff03b89959ef6e1cd4980623bd0f93919606cdcb8035033f81120f8e550f5c7bd7194fd3c5bdfb70c4551a07673765c319de487e9208eb7b7873063bfc550c
SSDEEP 12288:6YLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6HNyBo4kx929bL3Hnx
TLSH
T1EE4523129A0C227AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a49a87e3a96ba6c1b331aa9df96676639c5f753d7442664d3f58397192783672
MD5 b2d928dea026ef6690c07b36dcd66760
SHA1 b6d5ff73d8e783acd13a9617894a0bfb737a244d
SHA512 2792534f0c9d1073cac1d17184d36ddb40d852486468a72456b285b540273f56d39fe2c9a935fed5a20eee0c163bead86abb6f8732cf3c7b068bd5bf1a4b9606
SSDEEP 12288:AiZwbjzzFEoS2cPvywLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:DZMXzFVSOPNyBo4kx929bL3Hnx
TLSH
T1F0650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07A4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a8b047d8d0795a543cd55738144ca8357d3efbf0a5cb1be499db64ffe5ecfc64
MD5 8c714272a55383c9491ba699c4a790e4
SHA1 a495688de4edfc43eaf15b6f55abc35b18c747e9
SHA512 eb96cfd3f8a0f1d48c0ea6b7732f5522595f2c524009c2e1e64553dd22e9f12b3153ac62f105c9c8600633d6555d54203d0c2b0d9ad1d0437d6b4f716c9cf567
SSDEEP 12288:SHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:S8NyBo4kx929bL3Hnx
TLSH
T1384523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e69e85ba368e280561bbf40efc211d7898c7c2c11a7571a14cab42322866903b
MD5 3d03156f333766ea52d4d89b6454718f
SHA1 df3a3f2ff1d544516046b86bd53ff57e92b79d78
SHA512 e13872d7c0030115763403334eabab076868de723783532a7482e248c80945e493c962244becea7ab2d8a661ade33c8e2373ebb1648c1d2f3b2962341e4aad7b
SSDEEP 12288:HrLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HoNyBo4kx929bL3Hnx
TLSH
T15A4523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7bc6d9686d9f46daa4c8e580ca736fbcdacbc19e86f5d7105f168b478643e5d2
MD5 52c08f32f3e4a5cbe2e0e79717a734a3
SHA1 09b56c84c118e37b78c3383e35133b93b2d82d19
SHA512 daf2eec8ed48dd915395c706fca1c04650afe9c92867dfba3e9ec466e40f9298746c1195dab75724eb6bd288ca8560cd99c361ee8c70bdcb0f69e181d71548af
SSDEEP 12288:syPz5L8kLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:1zy7NyBo4kx929bL3Hnx
TLSH
T19455120777A831F9E17A6234C8960A01E731BC360B609BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 dce5c2741e6bd661a92230a4743a4b03591fc82dca3242a527deeeb7d1c57a56
MD5 12a8d292b9433122e72f0cdd4a62044e
SHA1 25aea944ed466ee2cfc2d9bd7cb09f9c0cec06c7
SHA512 63b627566cbc1aa5186cbd9fa3a8f89c4eae68a60150eca6affe811b6d9c05c61a1bbca348576dfdb8a7b79b9c0257d0715c420545e518608dd26061d2b5873d
SSDEEP 12288:zHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:z8NyBo4kx929bL3Hnx
TLSH
T14B4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 acf2fef11e3f85c73ccaed40e0ca9de424896a3b535d33f9e70ba13cbfcbfbed
MD5 9d00e4cb36c5d7fcde370f55b0c86d98
SHA1 52d241e242a23500414f360ef438fbe4b9081a55
SHA512 acf98ad13580a5c95a9fff5a60c2ff415b74e940634fd096ae761bd4427c0f75e562339cf6544d0576bf0e1fb877a41f1c1f212421ed187ae3d30fd71fae5551
SSDEEP 12288:RHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:R8NyBo4kx929bL3Hnx
TLSH
T1824523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 99b1178b140ad1460490dc0d4c292ba090c5ddfb99be5e405620a7a4bf361748
MD5 e6257f2dac409828e270a7950be0fe6b
SHA1 4bcd1ef69edc2cd664591ab3a291e7b5f6e54901
SHA512 fab3b14575dcd0e457a478c33f875650c88db918a27d6d211ea936764d0ca206f7bdf71cf6fd6f4c44217034bcd116e1311b8992cf459e2d642c8682912dae5d
SSDEEP 12288:8yPz5L8kLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lzy7NyBo4kx929bL3Hnx
TLSH
T17D55120777A831F9E17A6234C8960A01E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3f38e9bae33874aa79379ff4f4e2b711006ae8990824bec2a5236495ae3b3e3b
MD5 4777ece7b4f8e5eb772c929f845c3f59
SHA1 0345d5486efd71ef0cdd0167d9f62b0d21cb2563
SHA512 92e8ea952ec492585febf20cc8f27b568f96e7cecb24a4aba8decc58b308ce84a00e87c0ad6ace155372e59ccf31d50e057fd8a084e1664cc49530fb022eea74
SSDEEP 12288:TCd98WYoaLHF3z0z04PDvhWLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:eTtaLl3z0zD1NyBo4kx929bL3Hnx
TLSH
T1F16501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9994c7d6071cd4486027b1154ccd94356f10dfada14f79cab5c7aa305d444457
MD5 12e3db961d19fce9c7438a78556b18e4
SHA1 c0547a51687b7512823ff746cd4a1a8adb0034c3
SHA512 ded31bf6d4afeb968cd4eaac0566e4b326dbf0d0420e2aa5bd3b025825f3fc0f2484f4536fda65f3bf34ac194583d7a0250d0a74146c7e56ce34387e82450976
SSDEEP 12288:Xi4e7ARdTfgwCHKy7GLbbdIvFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:X3ld9CHKy7GZpNyBo4kx929bL3Hnx
TLSH
T1AC75CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 603f91440fa2b239b6f41e04476f1489f98b52bdbbccba2bcc4b1ffcc605238a
MD5 20aa0fa686d3cf3c03ea88a5a5c24658
SHA1 8f372218e9b614e1bea51b7913f6073f53683504
SHA512 d75b1a6e8cd422f93c300d2772ad6bb6febb6e8c0bafe188b915d89279dacb20ca2528e50db8ce48ef0f75f86a25e34b49d3bacf0ed315dcf1da9360a75e91f8
SSDEEP 12288:VGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VFNyBo4kx929bL3Hnx
TLSH
T12F4523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 eb0b7fe5f1d0020c220bf42f3b2e9fe587be5a9d15619376fb6a88fbd64937e8
MD5 e36a282f56408b80338d243c00d0fdd6
SHA1 354c021ddceecdbd4e297b1042184ed471e236b5
SHA512 9fe048924fc8b67a97737dcca0c1f97005004b444b5973108d7c99699a56a80c720316abee470d56ca6a0559bc06721834a9b46d9d95c7f0b557e05de7aeb8af
SSDEEP 12288:OELDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ObNyBo4kx929bL3Hnx
TLSH
T1FA4523125A0C227AF66D3FB0644A8594CC34BC8F1EA597D8EF67987759FCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0de8eccd4d2567c9d4b64e7deb7ba9a59b6498cbae8882db3867bc4fe1f1f238
MD5 0d4ad418034db743978d614839805a8e
SHA1 223909412c12dfa2ade778f718a582391c2129ea
SHA512 f1d2595d8022bb2a95635b9a2b794a97ad3227367c2a6deb28b6c79f5e8d61e90a294b90e2fddb79d5f4add78f9b2da90af187c4eaf19b5c3d162ff534f852df
SSDEEP 12288:bFLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:baNyBo4kx929bL3Hnx
TLSH
T10F4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 836186ee07b74076d4ab205a4503a6d0dc43f421cb5ef85bde4bd9beac402683
MD5 bffe9376492e72f4f655fd4f588c571b
SHA1 dbf5d4b1325b2af2f7fff8ea699d8be9013c4cbe
SHA512 6b13fc0fde5ae8d713951886a68e0f0d67db6a78bc18c57bff7b66506e36919eb8c191eb5b6ab82118e26b5763fa641a21c89c3ab204a6ea0c5b58d136579c59
SSDEEP 12288:yHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:y8NyBo4kx929bL3Hnx
TLSH
T1264523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8941310cbc0205e96de603f9b9fa5da96250e8355a69671b0a18474e9b9d2a33
MD5 29649e3fac3dbbbc938a6d35166e2f9f
SHA1 496cc9e6e6db48952925a7faa016f1cdd05d89ac
SHA512 c194960d06ac930ab5d9bb373556a2535a49d37238dd27062ae86e848eda51567d2b2e26cb3e54bec06f9e931cd4fbacead32ad26bcde49dc58fee7d37530184
SSDEEP 12288:RGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RFNyBo4kx929bL3Hnx
TLSH
T1C54523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF67987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 74c3119139512a168de1495b19fd30b39408b7061bbe784682aed5acbe477e7f
MD5 f42f8b799a893123ecee311850b52907
SHA1 f3903904505fe809e7d8e11d1ef1a441e7111758
SHA512 3d2e267a743d212079467f4fa107ba3cdc5b803e2149d40ed4caf9f2abc308e455bc690383ba05bf856d1c15be56421753b9452970770e18bafe0da386c27e61
SSDEEP 12288:vPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:v0NyBo4kx929bL3Hnx
TLSH
T1EA4523129A0C227AF76D3FB0654A8594CC34BC8F1E9697D8EF27987759FCEA34A10107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 248ed4d5f0f16f732375df1a225f983bbbe14ea78bfc02b2e5bfd1a56689bd0a
MD5 f21b0fb5c87b1836e6ed12701b38ed8e
SHA1 364689ab76b56e0e2ca7811d76f62d33e0816125
SHA512 9f8317556527ab48b695198cb18984c465743fb5932ab61842e82fc133da046755ce514a66049a32516e0b951b9e709651d626a31caf3e291ed86bb6a8cb001f
SSDEEP 12288:D5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DmNyBo4kx929bL3Hnx
TLSH
T1CB4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 20c82d0a215a76f3d49e10ec8943b124365e4e379ace07c95bd51330f2281059
MD5 8ed3e8fce2c2fff028d18b59797a1a9b
SHA1 04c254b78938095727b1bd8294db04707e3814a5
SHA512 d4e0550cda04b878b9f88bd7e69857e56d18c979cdb604eac7a12a9ecfe1a9d3ef84ca6927ee801561e2e8ea7cde1342f8e6e4a1526895a2728c8744401fb648
SSDEEP 24576:Afwvqk9RX6wkyAIYNyBo4kx929bL3Hnx:KMnYIbB+kn3Hnx
TLSH
T1EC85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 48e5ad7048688ce214aed90333bb34549a6e78457a6294f108a8ef39370b6537
MD5 9803289b74d97cb970018b6815c8969d
SHA1 50a9cd1d24ba9e8012d4050ed68f150563bb7f55
SHA512 1043e894c205eb6e39e680da5724fd74924d978c68ce1fe8696b3fe65e8379ae149e973d1508302529cd3a63da27db641f54cd078ffae53b614e1cfc9277d5f5
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02B+kn3Hnx:/ySzPO+k
TLSH
T1F2066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d0c2e833a674eb39afacc1509c00fd463128d77f7212552ced68060aed96ae34
MD5 5978780170d07f7c1f55777f6e1080ff
SHA1 e6d77600c11233ccd78a07420a493e2258a4369a
SHA512 e0114d3fe767ca807c450d6c85be854930850d0409b623acf449a403327f6838748accd1a40370c5d973f7744b37d5a7210e85fc44eafd37e8163841916c54b1
SSDEEP 24576:l47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY/NyBo4kx929bL3Hnx:l47JUQjTirIhCnDHUPfF/GB+kn3Hnx
TLSH
T1EB65BE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5071cea13f21d80e528334a3a912168a9dcf407886861f542fabed5cef02dda3
MD5 edd6dc1a51c3ec6715714c05a5c11b04
SHA1 acdac006e4b7aefc928a9025758765708954e465
SHA512 634b6a4ae86f57a5bafaa31eede4103155180a34a40643b117fb9d95f4ebf6d1c2563f4c501e0a00eaf5dc105a85f73beb1c475f88e10551a2675f1911c0a007
SSDEEP 12288:Dpsf3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8MNyBo4kx929bL3Hnx
TLSH
T14955F00AD25812E8D16E2274CB468A40F7337C5947E1D3CB96D0F87E1F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b39f7b2d166949dced9a353c38ee0dfc3f54ae698ba907b2f3a8996edea47ea5
MD5 fa835852799b64268d191106877a3b4a
SHA1 88f9e8be0826548512a168feaf7e256e23c60b05
SHA512 48370d1d344bd3483f35a3088e8b170e3382bd7252906d61fb4145fd3484129f3e6d7a3974bd14890d03757ce44916a170b4db003b20196858856bd8d89484ec
SSDEEP 12288:J2Zi+SU3fNDvBumUxIVrvXC8d3C6Gi52J2+WJUkO2fY8:J2UlUPNr4HertCvi528+54B
TLSH
T132352850766AC75FC6A944321E32D2CCA7707D41EE04AF0372C8873FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c105946b21ae51c5e92f59cc79fa6484f6c7b527ce81ad8fa530d9a4e20ecee9
MD5 75debab0b5935ef8d346db02d4fea7b1
SHA1 dd7bd80f3e506a89fb469faead43470203ba4c51
SHA512 e3e3097fa8dff878fc1a71900c27a7450fccdf3b37e74b0cc6d70f8f97c01f4a8f83bb2d4cd46a236ac11fe186a80433c678d591879a7d8a9d887ea4bfc2d10e
SSDEEP 6144:U9D7BgyXgXRGIe54+cuN26tMxO7CSSEWgW8IiBV/mayqx26tMxGyThwAmqqKBn8G:Uhzmayqo/qh4LTd
TLSH
T17455C7815537E29FD0FA6031072A5B4CA7A4EC06B7096F2673C8453ADC2AB25B1BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 149c27c1546a7062a1effff6204cab49bf72f42764d594cef8f80a004b8b8142
MD5 2e345f7fa7530741f085e30552d6b0db
SHA1 5e70ea57a40643b9fa1a33f8e65316e446cd6610
SHA512 fb6274e8f5aef4c7aea317594307f6fb624ec56dce357c601ea72919de03daae7eba4364ce99a81874ec261ba6dd02f3159f641dcb71f238455f382804d71f44
SSDEEP 12288:ly7/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:8ENyBo4kx929bL3Hnx
TLSH
T161452312974C663AFA7D3AB0645EC124C839BC490F50D6DBEE1658BB59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 91c21401957bdec3bab4d9e3d51f50b9eb75a4a006059469a4b5accf55a512e0
MD5 2c3ef859ee4429e9cd49d9b5e6aac2e0
SHA1 ed0e86a5f9f79cd85447c260f5f1b93653a83480
SHA512 7562a79d17e7f02546f120a6d24d776db395622eee170039fad487756dd0fbae815115316dd1d81e3e7297b6a137eb8f60c6c15e62d3507b901cc4007aa86af5
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYCNyBo4kx929bL3Hnx:ugb4mBIBhGFQB+kn3Hnx
TLSH
T12265AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c7fec528b1e88e80985cf91a9e35e251524a25e6d993f875ed4a0197375cb901
MD5 60d0ca6f0fcb2ec057e8d23889494c4d
SHA1 5c8583e658c5f5065c4c768ac2356755ebf9bc08
SHA512 0e3a4b295841c242cad583ae576e492f5a0c430c92d748b660bf1468482864300e6b6fcc5e8b6319bacf2ede25ffd79ca40e7c13bef071822f9692d975d5345c
SSDEEP 24576:aG88u8FpJqH1Jzria7/mPNyBo4kx929bL3Hnx:h7ZFPqVAa7/pB+kn3Hnx
TLSH
T10685F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fe93fa26840c9576d521ffb0bde76460708f59318ea049310c37a11e60faefbf
MD5 093c77c8888113071c1683042e5f62bb
SHA1 91a3cd5f55fb3a46412691330f6a7162a2590cbe
SHA512 30fca40d80e62b1b170f34e1ddae5f0e3c1a3b4648a67acf475135743366c0b6116f6bae6a13254a68b84e83082610142d0d84027edbaa4cbaa11a7050ff8a2e
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcB+kn3Hnx:0G05lO43bF+k
TLSH
T167D5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 14d30e8f3352444fd2e2dcb46eae0b9390db81fc5b79ea1ace9ab16e0a362b04
MD5 74f347a0db49ea593485df9f7962274b
SHA1 472e30c4a732b4cbbd4a5a1ec5785d43ebd27f92
SHA512 eb7f443a165c97e4bc76071263025dc6da4cdba2dcc978acf5dc0f52c559542f55b146ff6f9b1c9f67278d84c1f86cbaf163bd8e534b4083875df6b0c79fa858
SSDEEP 24576:0fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnhNyBo4kx929bL3Hnx:sa5POZ3BJt2pasx2+m0B+kn3Hnx
TLSH
T1E565AF5EA6FC01D5E5B9D17CC583861AE5B1342653319BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 353400b00c1f0f620fe995312c6b40e5b9918e5156c6e841c96241284d13adc8
MD5 0af2390d8b4790a253ce8694a2bb8aa9
SHA1 fafb23c558fe2f8731fb7612e89446ac82e5f9bb
SHA512 4f1c1e7edb058cf744cf27efad6b871b0ff923eb068fcc45d14ed919bf03d4b55992a358f3e0c564d60042b7c5b0d66a581ffd27fe0c7c563681e038e8ec0816
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkXNyBo4kx929bL3Hnx:vNc/zEOVHFJB+kn3Hnx
TLSH
T1C2858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b7d344addd0b9fae4ed0ef1bed1e36ae49fa2a0830ec1252bf2925402c111179
MD5 c58f7c5bd7769042d08409b696f8a46b
SHA1 e36d4db0a90cfc7a779a182f96a54dea614d04a9
SHA512 7ac2d75e429e0b3706d51f0f9cb24c1644a6304fce2ff7b87be797294738273b9055bbc54bf9ffcc47ebca8eba7b112084f1598715e5b6aa1b0311067f5200a9
SSDEEP 24576:6TkNvNnaFeYhJNtmZBmNNyBo4kx929bL3Hnx:6TMwBtOmqB+kn3Hnx
TLSH
T1A355AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 927352103e1171370d22677ba2fa8636f337ce88de704d687d00473d53ebfb7c
MD5 2caf75ed616fe4943665203be063b2a3
SHA1 0ed86269598c88b52f755de3737390222be25a8f
SHA512 cc785bc871ac2473c142ef7ef1256446134cf7b4d4110d2d667545d03ba8c5b4d0bc467216404ec7e71f36a43ead58dae83246478ba6c415a1b8f83e3a4836a6
SSDEEP 12288:mHvUrBFrEjwaQ8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mPUr+NQjNyBo4kx929bL3Hnx
TLSH
T13F65F21F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 477eacdae27337677c41b596ca88b0f041dfcb138ecc85de2eea6218e9e72b7e
MD5 0e210b6b8437103fe2d81854d9977fa2
SHA1 4bbdde67a2f36e0cdd584869b14d7b7ddf6d2763
SHA512 7b8de78fa729731ec6f2dff5b12021f25286c169479401680e1846c7e60d266d39bf3bc98c7409f66816f80c1e0e188ea719207d45cd9d0512fbe2c36b06c2c7
SSDEEP 12288:AQcMxWDXN1Dp/fshBItT1IQgATLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:SD3FHshBIYQgAANyBo4kx929bL3Hnx
TLSH
T12575E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-216-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/952-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/952-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/952-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/952-84-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/952-320-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1528-238-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1528-96-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1528-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1528-102-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1528-248-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1528-246-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2004-0-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/2004-78-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/2004-9-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2004-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2800-161-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2800-55-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2800-56-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2800-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4512-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4512-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4512-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4512-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4512-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4720-189-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4720-79-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4936-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4936-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4936-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4936-282-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4940-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4940-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4940-39-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4940-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4940-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4940-52-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5228-116-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5228-110-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5228-256-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5228-108-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5428-319-0x0000014580540000-0x00000145807CB000-memory.dmp

Download

memory/5552-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5552-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5552-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5756-122-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5756-130-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5756-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5756-128-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5756-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5884-66-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5884-68-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5884-169-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5884-74-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download