13ca4ed8681438da584aa495341dc1035e193cf4a6bfccb614286b10c379720b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample260820-sd8alasydw
SHA256 13ca4ed8681438da584aa495341dc1035e193cf4a6bfccb614286b10c379720b
MD5 9629097bc95045671f5c65b4fcd438ba
SHA1 7b662e4ae937034532f25c998603886fddcb7020
SHA512 941e1d83f37f44e9fdd16d2d6157e85a7171c10ce67eaad0291d16af982584ee8b27a48ceda2697f3b6a5ab4fa63cf938550dbdc838c0b1bf6b5582dceee435f
SSDEEP 24576:Gjy3QSVL5j/cY6sgAW4PJ8oe9sg3r5B3lK+ubh:GjyrVL5jX7lPJ8V1B3lK+Eh
TLSH
T17575E01DE3A554FAE9B7D63DC8A24206E6713C52CB71D2CF13A2194A2E337D09E39712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4612	elevation_service.exe
1192	elevation_service.exe
4668	maintenanceservice.exe
4556	OSE.EXE
4916	PerceptionSimulationService.exe
1160	perfhost.exe
4224	ReFsDedupSvc.exe
236	SensorDataService.exe
1128	ssh-agent.exe
2748	AgentService.exe
5540	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\39075a06209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036f23ae0b430dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3fa02e0b430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004439371eb530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061e284e3b430dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e756681eb530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000002255ae2b430dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
4612	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3988	2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4224	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4224	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2748	AgentService.exe
Token: 33	5540	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5540	SearchIndexer.exe
Token: SeDebugPrivilege	4612	elevation_service.exe
Token: SeDebugPrivilege	1192	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 3220	5540	SearchIndexer.exe	100
PID 5540 wrote to memory of 3432	5540	SearchIndexer.exe	101
PID 5540 wrote to memory of 6104	5540	SearchIndexer.exe	102
PID 5540 wrote to memory of 3256	5540	SearchIndexer.exe	103
PID 5540 wrote to memory of 4564	5540	SearchIndexer.exe	105
PID 5540 wrote to memory of 4464	5540	SearchIndexer.exe	106
PID 5540 wrote to memory of 3312	5540	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9629097bc95045671f5c65b4fcd438ba_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1160

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2980 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2980 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d4531fb77d8a9b09761568f3d662717940b2bbe9a8a0a7eaa8f8bf8882d838cd
MD5 980f15bcf47da81667c5b66c2cd76637
SHA1 463588a21bcb536257bbcdaf8deb008bc31a06ba
SHA512 1e78b3b976d2d282c0ea8477a99580d81a872c30fca00785aa8188aec7fb543bbc94419bf86e5f23786fe946c53ca1d7966ace0c6f66e32252f90f7c3d29fff9
SSDEEP 49152:9b+632BuPkFKRrdE6ohvstBhuXjfS4LWxna7lPJ8V1B3lK+Eh:D3q6sjBxU3l
TLSH
T104D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ee044ab7d6d61fdf0b9b52109f01fabe4bbb387ba9776ea1161f0e9e91c228f5
MD5 fcd751bc0781f5e508f2109420f001cc
SHA1 4b720498a3d8c041a6445f578f49cad164444198
SHA512 3fa8a47f921c689f80ce131a2594aeb1c36dcb6ba32f4742ce9c1f8e029f5cef5b05464720abd7573a9df755f8be5808b25e1dab3c7ac5dbe2c88c1d60bfd5b3
SSDEEP 24576:iXYfDtczA9gAW4PJ8oe9sg3r5B3lK+ubh:ptc47lPJ8V1B3lK+Eh
TLSH
T18E75F128B7E408FAED678279C8A28511EA337C514764E6CF03E499291F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7b72eaada66f2de78672dadc66d6d459a8186a2a87305c8ea439e37918648de9
MD5 f691921fdc51f6b19cef3b7186dbd266
SHA1 8fd31052710c0569ae00b2209a0625d4fa43dafe
SHA512 387fd9e997f939082fc5f26cae882283621e2158748f93c46b067ff6ba1a464dff070f7cf6457f9a7df64a3ea1e5580c3056803c2d7ae772c7d6188244eb5e16
SSDEEP 24576:/0Le5ji0hmxWrMygAW4PJ8oe9sg3r5B3lK+ubh:/Pji0AY/7lPJ8V1B3lK+Eh
TLSH
T19B859E25F6748331D073C0BAC5D2A69EE97130825B3089CB4296D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 efe48e595fd4765e2cd687e7f9f55cb09165c8fcedfec6448b03e0eec3bac77d
MD5 bfa4093b4a891bb951c99eeb7e128075
SHA1 61919daedf5dba7b668da21af74ad03d9cab06c0
SHA512 2615a501d9605a7b5957cd30e365b0fde10baeac6f1fe3f4b6557587d74cbb6c5881208e04cb16c1228d4129492176524274e791128623a43817df949c0d62bb
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWn6q8wyuIgAW4PJ8oe9sg3r5B3lK+ubh:I/ezSC6vUzPveHjyD7lPJ8V1B3lK+Eh
TLSH
T159755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4daea17dd0cbb331832d64836fe152ffed108b3ce6ee77c69dc20663139cea68
MD5 40c8a1a665573bdb7aebe2322a3633d5
SHA1 f6396414212d80888376a1c8d097b8e3f6bf19e0
SHA512 f2e20a87ea38ee04fc71888eea8fff78305ae18584b04757e353e1fcd9b765db56f87d176bf3a4695173bb75725012b734b9077ce3e67352c0895ba93796edb7
SSDEEP 24576:PVbqPb88hv/l+Y5gAW4PJ8oe9sg3r5B3lK+ubh:PVO88hXl+w7lPJ8V1B3lK+Eh
TLSH
T149559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E77BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 07fd2e4629ad0b954aea03125c2a3a66e1b5a5f44409aeefa280102fede5a4d4
MD5 fad51aad27b66031ed83ca6addba74d6
SHA1 75538f8e9d23a1843b5f81296a083199688ef655
SHA512 793e0ad5a2c496729ae0bd06015320d47f8f081f3d7e8bdb03c42ea21ad81a37cecc9f668071fe997251e28c8a938795b71eebc4bd7825474833e7a113e0a798
SSDEEP 12288:3xNJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bf:3xugAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T130552358DB7460A3DECAA7B3B4EF617859193C62D70D98CDB5A1390D0A34B8AF4CE311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6243a12a017b4eefc486c7caf3fec83ab52f36d0aaa71662ac378b8f29b3be96
MD5 30782451decd47b09c49910dbcf75358
SHA1 6442263d6935979a6083a53cb46cbe1e88c12857
SHA512 3987a3e9b497c339877dba37e655114064c40855326124f30a0e7461789e6b15b0c0b923525e3b8ea39b56dbaaa025805db8c720df0dfb3382dfa595221696b3
SSDEEP 12288:PeBNUbTVO86UGJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bv:PJIURgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T11E75CF3BEE38FCD2C67A9DB95A918200D77278314B12A3CBE175820EDE236D15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0c2e8ec35c2496c34b3750082b26e667692f155cb18e6a94ccccc328587df765
MD5 b80f7b029d2cd132d68a92e07fa961a5
SHA1 a7c75dd01e104a6fe16efc6dffeae574f95576fe
SHA512 8c77e6d6637cda63f0121ea5199ce62388d2295800d32f8f344a759f60f29d87a9fc55bd93dc4bd83fb4272009bfd0b540506aa1ab60d9df8473ee8549e4cacb
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:tQvGAdlCEL8c/DRNw5CCU3l
TLSH
T143267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ee7dd979f0a6062171b31d0dc5ae6c85f5de9993cbb0aa55d804507691f2a8a5
MD5 becf62f003ab65d87f0abbfb1ac6d59a
SHA1 5d2c616c370e39c6762d9bd757f7d963ae3f375f
SHA512 a5f447d0373697ffb5a11d8b9a90b69ffa1f4f58cf7e6c84eab7a3b73cdf731eeaf53ee35ba1727aa50deac0558caf6b0de789c7e67091c7a3c4a50f0ca6237e
SSDEEP 12288:GAwSfxL/2Dc38DLLmt0LDQewsAjoJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4a:bRewsAjPgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1F275E030FE74E032C6BB0EB22B76D716182D79204B5519C3F3E85E9E59302D2677AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8e125c08a079c689796366488d000d11e53f28d50d25de1598c9f19864e6ac7f
MD5 d11f2b7d3ad65f462f4810dcadafec71
SHA1 c5dd97426940149a6f184d39495fc3765c245a5a
SHA512 19b146c28f5fae8e12a1fbe33b5ec7793808d21c544177f149f4ae9ffb34a7a75f700661d3aebbfa1b3b57ef325464456358306d2b18f4401334a1ddfda140f1
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHrU3:0UEtQevvqc2W1cpV2tI32rU
TLSH
T1FD474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f5b9eb83b29954ef18a1f67953936126f29e7a47e7c41530372b51a4abea7788
MD5 10abe848ae656102f38cb9686793ca51
SHA1 3377b504ffa1a936d15882d06ba1269677deb426
SHA512 23c38abcce7307b5201629c432056952218a075def2b161ec11532ca5eb5f7addda32fa71df6df116d62810689bb41ac0310b6e9a6d10d51b3baec894bc73736
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zv7lPJ8V1B3lK+Eh:7oqtVjnmGU3l
TLSH
T16CD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fe28121529c5d6113ffacb791a038272974f466f99eac9f133284999db60ef4e
MD5 a5d2797a8b45e3e3aa7570a34ad69a6d
SHA1 0d127de5da221bd4bceb008dbb2eb16eb5bbb62c
SHA512 f90870abfa08e2c718eff44e2ff25c101837d694b6523eef1a6d2efbbe13d3b893dfb6ca695683c23522eb5953123762e57987dd2865a83eebaa0925389855e3
SSDEEP 24576:3AhGL3IFoiwtA5l7S53cgAW4PJ8oe9sg3r5B3lK+ubh:3AMUFoiq5M7lPJ8V1B3lK+Eh
TLSH
T180359D80E7F955D4F5B3AAB899B69170EA76BCA65E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 adb48f5c617a12ab3848471132fc8bdd86477cab17c3f80651e4324b7f594346
MD5 473fbb2f68a2fc60775c744202c0516e
SHA1 8336dbe6ae2293924073920da775ca330ac655c7
SHA512 f8dbc04e1e73787f05f5c4898414b636bc6bc4bf61ab7f5b15f436acd5f1f22f2829a026428bfc39553e17581e9bd3f33726f1e1b1e4d254190a87529f5cd275
SSDEEP 12288:imw5HEjsChNsBFgl0WDm+CDJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlKU:7wuNOWjgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1CA65F14977A40CFAE9A7923985978135F7B2BC122A25DB1F13A0C61B5F33361BD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b9cba6f8ad358cb7db7019d113c55ba7d24712def7ff22b02567ac23044ba4e2
MD5 395c7ddcb9b0450e3f469298e53845eb
SHA1 e69ef2a68cac7a95331b661709381f5bba2a44d6
SHA512 3c6d999c3130a8646e7601621ade2d8ac80591f23c962be2ae824fe551169025538f507b5186e1e453590b598ae6fc9f21671bb26f1b3c2a75f633f9deb15fe5
SSDEEP 12288:3dZ1Iy4Jmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bh:tZuqgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1E955125963E420F6D9D7937AD8E65614D7723C63A33A83CF226022191F32BC6AD3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 849d0b9f8a262fc98e2c24dd2e79bb7b60643da57df80645e7986e8a3a67da32
MD5 c6e46dd1f72aabc7b1c558f2b7d9a647
SHA1 9d326d100cb051d6680de1ccf96ad0e693817197
SHA512 d910f956a7213b66e872bc174cffac6bda7c4aae4f8ed19fa0e1bef2cbdf6c136c1354cbb0df4fa3ecafb75dc2d4759f8260015fad682bcc1c506dd6bead1d73
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U3:AQRQyi36YOcPbLvw2gAf+PN3dU3l
TLSH
T1BE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 33ba895c5c9263ce9927c360f8b86919fe8d4538462e518d5f191e51ed00d075
MD5 641ec3df56d56cdf6f7f127306fa5e1e
SHA1 ef9fa43180f4b31812509b539efe60833bf4d5d9
SHA512 cf9bd56eaeb0f6cd30df3607602107f23e284c0dd85bf3a65cf6cc75f13b7cfd0bd9367df55f58b7631b54016af7396f318c333d7b5439c1a94f2a7e5fa88efb
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U3:2QRQyi36YOcPbLvw2gAf+PN3dU3l
TLSH
T1D8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e8abbc866cc73ad2700086db9b498b20a8e207a0502fe81ef00c5faa9e50f130
MD5 295b77b9492614774afc639c56b7411b
SHA1 ccc8f49cbd2c3f2e24adade6226d8d9053bbdbc0
SHA512 c1d462d89c0492608a36889104f6a4ad12f26d9c1c42007a18f361bc300279dacab51aab78942d3260c4dbb0d01a9da0a643ce54d6da6af04ba2eae68eb68beb
SSDEEP 49152:Q68Qg55nhceWu7PNU3//7lPJ8V1B3lK+Eh:KthLRc/zU3l
TLSH
T14CB54933B2F600A9C44DE1769F4A873196D17C718FE1E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b7e1809a5c6ed024a13ea64ea02afccabaf12867bcdf689e1c43bad59e31d674
MD5 072e0b523cdc1a881fd47ee9ad111ce1
SHA1 22c128581b5638c050336cc6135ec7f5b2d81d72
SHA512 652a82263904ca65bc829d6e1112b30144d2f0557b9fe2586c584d53a1f6a56a68f7aedb6ac07388c3ca4fc5569cd8044dc605a55ac7287ecaf7be32420d1008
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99F:jy5112gYy5azzVvt69nLKnhZsU3l
TLSH
T14D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 37305f140154c40883b2294cf7790c6b0269cba574078da2880fc4efa5f60981
MD5 f5171b9fe0678741762dbaa33ec41458
SHA1 f2303aefca887c534e2ada75526ac3cc1b9fbda4
SHA512 ac6030582877779a6bf972a97f7f39f0cf731df4090e32f009843e103b06e3f052e601991e20f5ce9c24bd40e447d39ca80dec689a6a067cf8a1a377f43b1bf3
SSDEEP 49152:5B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glt7lPJ8V1B3lK+Eh:vu6Jmdxd2dVU3l
TLSH
T122D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 519dcc9ac82bbe671e5b3f3adbb3d4a6b3a8dcefdf94b340f5fae2056c3d44f1
MD5 3aa77f19b83557ff44b15c9deab4439b
SHA1 d4df1bdcda0821c3e059353d9f8bc5bf8185870d
SHA512 dfd81ab2a4d39f402cb80bf6a939f41e4fe63fb7527fbbb36ffdbb2af7cd77eb5e5c8b647712a602094193590433baa50ea3ab09abea8095a15024b0c7c5adb2
SSDEEP 49152:C1hpsNoJpF1A63U44CwH7R4xx7lPJ8V1B3lK+Eh:CmifPWRGU3l
TLSH
T134B5BE13F2D900E8D05ED17987569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 08d5904589338bc242dc14f566388fe403eb830939b8bf7710fa276c0d497d67
MD5 01357ab3d35c01c050c31a4499388b05
SHA1 507a44ea4759ed25fecf4a7b9de0c4ea89f69e2a
SHA512 64dbf664f0ca409a8110a80aea57d33f806a3ee8f443ec8c9a32b42df1166bc7d921d14c2e1d69cd8e0773b92e6f008646ab3cf25b1897f988c2ce8c202acc4e
SSDEEP 49152:8SuZQIY0Be2KcRVtOnks6NMHqq7lPJ8V1B3lK+Eh:+5dKii614U3l
TLSH
T190C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f47875e77698eb68faec4a48b775bdff1452934337224a530dc3a549e23345ee
MD5 e71f993c0ffa0d6ed73f26dba501ff67
SHA1 2598b009db1bd8aeda559c98869f556232ee6709
SHA512 652a882b03d6a4f19c974f8c15f50cd4e4ec898190ef9cdc97843857f62fb7d02c662d832639bf7ec7054c08847795736f108eb68e576ff7130418bb0a64a3e7
SSDEEP 49152:vhtSn8EApI0fig3giDn0AP5w97lPJ8V1B3lK+Eh:+X2imphqU3l
TLSH
T14C95BE13F2D900E8D05ED175C7568632E962BC120B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f5541470811e37c337fc383f4747bca8cd059dd8af7086736fbf7ae940c06f5d
MD5 6687d16eb21abafea773fa8c0de0436a
SHA1 e8c5cef2d1e81faf0896ac9d31743b1ecd7d5656
SHA512 fcd45acf014858bd4f005690b258ed5ef1f6d5f923cc001da806757a7e6515f01f1b1b15100c39b83d74d559a6cac60a54666d9b386489165bc5b39cef85eb67
SSDEEP 12288:5VJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bD:5mgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1C2552358DAB554A3DD86A7F3E4EE5178A8183C63E70E94CDB2A530091B34BCAF48E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 38dfa740ec6e29ca23c9c4cc1338a09c9ac0476feb36703f49cea482095614ed
MD5 a9c1553844932ca4d69a18c1a295fd80
SHA1 089e441c5e2c5916c1407979034f84950deddd71
SHA512 ffa0d5d188128dcfacbaabde482a46dcbdc5a687649936f7cb5f6dcadf339db1c7423535d37535cb0ba8adf12347278726e7845610907dc2c852e0fb2e3264b2
SSDEEP 12288:xMJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8be:xrgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1F7552358EA7554A3DD86A7F3A8EE517898183C63E70E94CDB2A530091B34BCAF48E614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bbe2b3ece2ebb08a9f74ec92543058c55fa2dd7765b483266f8414373a6835ec
MD5 3e14803fc5904c11b66fe8b637486f89
SHA1 1ac405c0c14d7f1af38e64975fcefeb1176f03f0
SHA512 afa3b8a4efaf0c8924b9ba140ff64953f0e1de11b550057c5adb2cfa75ffe3e016a307fd36abe9a675fc638a92e3d4f67dc737e8c73a7703bd189b5e9b52f6f2
SSDEEP 12288:tOJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b0:tpgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T115552358EA7554A3DD86A7F3A4EF1178A8183C63F70E94CDB6A534091B34BCAF48E214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 05df63b9b55f166d1c8e68e25796a54b25b5c538a31ae0343ae0259e3b35a632
MD5 847d8a488d240183684d783e4932eace
SHA1 f5bdfa4536dcf95f223fd697ab007efc4bccabd4
SHA512 cd1c222f4f374c6eaeb8b0a8fb8208307ab515a740aeb2333a137591797a4b28673c4bc443568d1d76ee900eeb5ee899ee630cd7b66ced96c48927f4d3cb2cb0
SSDEEP 12288:cVPJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bw:dgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1A0552314ABB950D3DC86E3B3E8EA5134E6653CA2E72A95CFB650350D0E317C9F89DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e0ce559b5829c0d2d7ad34e5afc3e2410be3e1267de56d1de53b834efe63af05
MD5 3f06a9bac3b35d99d1b163166109b34c
SHA1 7ed90cc77a41d96777f482a11f4d6f4fb3027bfc
SHA512 6d8243b0d073cb013cad5ab01ba361fbdc67a51eceb61b726c4da0a76f55d99fdcbbac606c0dce9130369dbb426810508ab977826be4290f9e5804fc59b6117e
SSDEEP 12288:anJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bM:akgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T129552358EA7550A3DD86A7F3B4EF5178A8183C63F70E94CDB6A530091B34BCAF48E614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 814e9a865799565cc29eac4c3b713502dc08427eb0b7827aa351288a21006c34
MD5 e1de0bea500002669077d046c5ccf769
SHA1 b48b80d93fb4d920952b3abb5ffbe62a6f49fc83
SHA512 a567c8fe54a8bf8b59b33aac8b0f7a18b4bef07d04535b52c6903f79fde77f578280ac0f5a9891225276919502604c8cd00fac0199feb89b467f3e79c3086f6e
SSDEEP 12288:LwJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bv:LngAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T170552358EA7550A3DD86A7F3A8EE5178A8183C63F70E94CDB2A530091B34B9AF48D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ca8ad3237b7325eceafbe477ab87b7eeb7410fc56e49d2f2c83a7b693fd8b7ec
MD5 06f45f0273ca51de13644ee21b711b28
SHA1 90e93207dcca73f6c15ff377209eca3b10159b4e
SHA512 7467024bc1137bfbdb79187f20a2f4a3ab057b026eae6a484f557962fa14525b0fc87f3d7be30735c0c1d05128ecaa51b9c1a799b4d92ee6e9a665263bf89577
SSDEEP 12288:OkJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bt:OTgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T12E552318EA7554A3DD86A7F3B8EE517898183C63F70E94CDB2A530091B34B9AF48D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 acf14e91877feb9c7f74f3d44420ada83b3a4a3f9ee18fb24ed3fe2121c8f36d
MD5 c2ceca03b6d88dccae13f447715df686
SHA1 85018b1b3782832f7fa5bc954f2d589c895d7002
SHA512 b5c5788ab12708d8206f48372bc4adcfbd3cd1cc3b462456cf6e683672257b04b469804ba31fa7ee8070fa74210b58f7c11b6d07ee103dee057975eae8829804
SSDEEP 24576:KZMUzFVSOLgAW4PJ8oe9sg3r5B3lK+ubh:KZMUzf37lPJ8V1B3lK+Eh
TLSH
T10B750194B3A018F5ECA7827FC8668915D6B27C664B60C64F13F4362B1F333A15C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c4f28ffb23ea8a4cd08c92adc0a923b8133660b343b846b65ae43deeaa3d95cf
MD5 00acfd07660071b2e1f8423d3ff26691
SHA1 dcdad6fce172788f90e5239f221598b3a991e89f
SHA512 da369a2bdaf73bf7d3bf6d7f1b84d964b84978af070a5818db9a2b1bed8a206c54416435cdf5f87270101a196064185a4d2742518953b8e9b9061b64232d5507
SSDEEP 12288:DBJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bH:D6gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1ED552358EA7550A3DD86A7F3B4EF117898183C63F70EA4CDB6A934091B34B8AF48D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e13d99e0631a42ed6c58e31b9d357794f6cf467b9f9c092178aee8e9e9f8c539
MD5 43b1dffde4b1b209e51c181a77d32220
SHA1 fa6610545fd5a5e0c6f6f48e1225a3d02b869a22
SHA512 be442ddad0b627c13f8cf357e8fea9f240b2c17d08a5c807f533fe46b309ce3bbcdd9e6e8bca8626486ff747bd892f7d3c29d040bc0e48ed724579a3875834a9
SSDEEP 12288:SdJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bN:S+gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T16B552318EA7554A3DD86A7F3B8EF517898183C63F70EA4CDB2A534091B34B8AF48D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 02af6b8b4ecdac30954f3ce4d29567ac2df132208b84ba4a9b3151a6410d3321
MD5 bf94a6367e9d032bdd4adc38c1fbf0e7
SHA1 51258f887d8513942c21a7054b08efe7db3121d3
SHA512 de587b759f23b624a508281c6bf0aa6b02891d84bfad8f196a81dfc7661a45782c60afde566476329dea650a73e09bd41c0e3804f79e8619f6fa4ce79c11e18b
SSDEEP 12288:3yPz5L84Jmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bG:6zyfgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T163650107B3A130FAD5669376C8A61A11F7757C3247248ADF63A0163A1F337D1AD6EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 73287054adb2b8f34d1c5a35c214d3a5f2b9378a6e162ab9dedc51c8c67af4cd
MD5 cb16535ffc0975cc35e77616bb911b0a
SHA1 6a2096612c20ad7a60a2c56bb5f269c9eb0a4d6a
SHA512 c9a1960525d160827d321cfd23a26b11ba1e894a375a7b6ad0e0ebc5b33faa975d0ab42018963d3d96f8d365afe08ca2fa0ee0453b3fba38aaef8d23cc00bda2
SSDEEP 12288:rBJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b2:r6gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T190552358EA7554A3DD86A7F3B4EF117898183C63F70EA4CDB6A934091B34B8AF48D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 343998f297dde2b07d66501808bfcb59cd78e698fc202e9ff9d49012d233b971
MD5 e9bc5bf3d533b5d10eea17206e827cba
SHA1 bd25011d8df1ee03c0b14dffe08a4595b77586d6
SHA512 31424f49445fd3dd65ff29b756bf3ca39b356fa0b2defa436f1873eb84446d98953efe637dc97af84a148d2f8186f95f15979686815d892fbff3b7221240a437
SSDEEP 12288:YBJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bS:Y6gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1E4552358EA7554A3DD85A7F3B4EF117898183C63F70EA4CDB6A534091B34BCAF48D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e6704a125e07f7f801e7048243938addc6148de9f6d3a0047581c85fde7df8c6
MD5 2cd5345bcf465b3a6ec2b2cc13d43fb9
SHA1 4c846cbd441f7fbc1dee50acc407f95b1b6730e7
SHA512 d487c83dec466a85be4bff390301412bf1c26fe7cc9fff5c8adddc44df48630d0f3055fc9b9808e8fa7998c10346a9c9ce8c7d027cb66368b8e2017f2aa79b41
SSDEEP 12288:CyPz5L84Jmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bg:fzyfgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T15E650107B3A130FAD5669376C8A61A11F7757C3247248ADF63A0163A1F337D1AD6EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 5fe0b6b885d7c7a7b756e076ae83171640d94c29715dabd6fdb92d671f03dcf5
MD5 6a0534f97c2008b543fec94492d818a7
SHA1 16b2e2a0a0dced2f3d97bec875288f8365a5d7b3
SHA512 50e03fa04161962206f7959946a31dcd6fabbe491de05dcf7b0dadccfa98cdf922e1bceeb70a44e46c8fb3bb13baf822117db6596b47b81b255abe0243431050
SSDEEP 24576:OTyaLl3z0zDZgAW4PJ8oe9sg3r5B3lK+ubh:OTpLljI7lPJ8V1B3lK+Eh
TLSH
T1D57501A4B3A018F9ECA7827FCC668915D6B27C624760C64F13F4362A5F333A15C2EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2b52cfd43ff38d62e597e33a7ee4455d19c9eb6943d4da19483b8f17bca2bda0
MD5 d14e1f9dac1d8da25246eec7113edf96
SHA1 4c7ea899f5af180a7425a4cc2f3c592e2203f7ff
SHA512 cb638b9cf29a9a1e8af1f987b245fab6b6780ffc55f671752b6b6ec0d11cc5e4512a85bf41ac9e3ee21b38a2748af39e17dc5c42c887746632c6b67da7706a35
SSDEEP 24576:E31d9CHKy7GZVgAW4PJ8oe9sg3r5B3lK+ubh:O1d9CHKya37lPJ8V1B3lK+Eh
TLSH
T19D85CF90F3E410E9F0B79A35C8764511DAB67C9A5B21DE8F13A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9cbd3e6afb30b9cca182d3cbffc03d75a1bb3219c8d894aa15dc85d22b80b0f9
MD5 fe77e9478e21703aeb7a1f66f79b191d
SHA1 495559862fe96f19faa4d89fd0568975a6273381
SHA512 99f5d75ba1fc463b1a0ff921ae320e42aa00b8a7264c9f45ec7672ece05658967c0eeca2461ffc4bc4d466a97e41190143f0c4f44695866c198624acb4c8dd53
SSDEEP 12288:HuJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bQ:HJgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T15C552358EA7550A3DD86A7F3A8EF517898183C63E70E94CDB6A530091B34BCAF48E614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e287c4552392ea230b2a719f39af3f31b6a0b279b93529d6adbbbe0fd046bb87
MD5 abd00ab5e7343ab70e0cc767cba81a8a
SHA1 f3f1016eeee5da8b0e88a830ac2c22f24f3f0fd4
SHA512 41f2b5f6f6e8c030599365e7c3b9cef1efb2543d1208b9474453f1f2a823a509f9fbb32705a83a3ae7dbf8a45ab2602d8869d88f4f2ba2fb104bd17c83fc8e98
SSDEEP 12288:5YJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b4:5/gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T108552368EA7554E3DD8AA7F3B4EF517868183C63E70E94CDB6A534090B34B8AF48D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6f9b84aa8278204c1529a18f41fa73722d1cff8f18fcfcf056d74b597fc4b788
MD5 002219f25fffc85b57f6dc3ad1409169
SHA1 da3430c4391e0c081404baf6beab1a4c12d2deb2
SHA512 8dc76840113af70f0d43b9e08206c082150c7bbdf7dac8b5118f065ce303e8b85cd571a02cb6ef83b7169e40c30d9b02317cb43e181069699c6815244b0d6deb
SSDEEP 12288:ibJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b3:iQgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T126552358EA7554A3DD85A7F3B4EF517898183C63F70E94CEB2A634091B34BCAF48D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ac197b8558ba118946bd7eb2a337078702ba61848a22328ac6e5c022cf44b176
MD5 a769188e7964bf78a2033ae86692c5cd
SHA1 2a1fa70a74c65f9b2733de4d3640659ee611f385
SHA512 cebc2df4cc3249afca11cb2eb0f3f5339bd71d8ca3c421fae91ea2bd31c406f3a699c040e6d46c27797c18a09a5df8042fe29b96da0bfd7b138123e2f9a6ca2d
SSDEEP 12288:rBJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b9:r6gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T10B552358EA7554A3DD86A7F3B4EF117858183C63F70EA4CDB6A934091B34B8AF48D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f5d1951a7236a5c246489e350ba8cced77c4e41c0eb33bff2ce1d947f63f8473
MD5 fd75b986189ee3db5ad7f46cbd96c92a
SHA1 c92b399f3c477a535af12a767fa90bcc338cac6a
SHA512 0ced21475628b58f31c7c04f253327f83e78fee574049bbfa01525afae5a6518d89a98db8cea22ab85abcfa54a7ade4ccaeb45693c90442f3486121b11f7fcb6
SSDEEP 12288:HuJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bJ:HJgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1FE552358EA7554A3DD86A7F3A4EF117898183C63F70E94CDB6A530091B34B8AF48E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 541de5ddf2f8e3c658e6c27c9a8d7365d1223452101ad1d6c5e5b3d3d2e8cd22
MD5 6da0d942a565db02b7b75f201b625e4b
SHA1 9eb6d88b475234bfe654f5c0ad5f57ad2e423f5d
SHA512 841f799cee4a2b6af7d699525705794c6b80f95ca21d7a8e96d7636edadcd68e8ffd100947d74bb44266bcd2cb53764dc65b0e6c1ef4fb45db4514a0d517677f
SSDEEP 12288:l5Jmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b9:ligAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1C4552318EA7554A3DD86A7F3F8EF517898183C63F70EA4CDB6A534091B34B8AF48D214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9ac74ebf07db469a3aa87c461d1101974864802eb400a8a8fdc18272aa1a6795
MD5 cfb38e434718d395e319eba63d1a22b5
SHA1 0159ee2a3dbb24aaf2e558682a551d96283396cb
SHA512 197251cbbfc83d0391edaf0c300356380385178ea78475f528b88e0831aca64293f314897a850cdb490409cdb33b36c34e5cda15d64718a0907f5ca15509ad3e
SSDEEP 12288:ZnJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bE:ZkgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T110552358EA7550A3DD86A7F3B4EF1178A8183C63F70EA4CDB6A534091B34B9AF48D314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 8952a3718f352e8151ce69712c7de7f7cde36f2618415eadefb53fc8299cf1f0
MD5 fbf181e598ccc837fad4a511b965e094
SHA1 0a62e90d915e203bd20569229eefa478193ba1a3
SHA512 a0f4dc5843e7fa3dd68f4a02bf726d4a29e83b0f5a9d95e570c125e94eb05f3ab49a830cd8b0c80831c8a10ad0640f1380013a1b7878d9e8a3760bbbfcaa77f7
SSDEEP 12288:PWJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bI:PhgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T18A552318EA7554A3DD85A7F3F8EF117898183C63F70EA4CDB6A534091B34B8AF48E614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 119f55ddf30b9890ba3c2a30cf103c2cfa3ee53b36e232a657cde8e02511dc6a
MD5 00a12007f4c96e25148416c035848fc9
SHA1 eb7cf15fb5281df27ac1073e788d18ebdd3e4c45
SHA512 07bff78a0bdf2d59936bbce64fd0c0c1e363f8b4979a684f6c0301b04bb843afa98139756ead76d25cb1c3f46690defa7f8ae61ebb3abbd4cd67d059b91e9209
SSDEEP 24576:XfwvTk9RX6wkyAIOgAW4PJ8oe9sg3r5B3lK+ubh:SMnYIO7lPJ8V1B3lK+Eh
TLSH
T15185D029EBDC44E1E1B7923D98B7460AF6B178691B31C2CF129A536D0E33ED4AD39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 943526ac0da426ae4bd168cdf45639a5b48abdb4bfa5fcd478c59132756bdf05
MD5 0a71f26e98aa66caf3ab04f69126c2ad
SHA1 d0264663bfa5647017a48f9ac9d3a883fdf15e4a
SHA512 9d6d6d573fc76151606c3a64a1e45c8a5b221ad0e8ec3e6002871e15dd7a4b96db46c02996908743152b74ce997a578df883a8cb68f3cb3b5bd42d7499d0c2e3
SSDEEP 49152:0YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0d7lPJ8V1B3lKZ:DySzP9U3l
TLSH
T1A4066C56A1A801D5C5B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4b9de29ecc723b7ed681a219e1ed587f581408511b52a0741626d7c06b9648bb
MD5 f310592bdf0be8c3347c8264792a2c9d
SHA1 6634cc16d5d5c1018164dde5574b0fa938db830b
SHA512 2c184a26f0d6f3f2f559b578ed9f54c7eae5aba2a14dd64f81e7e13a9736f1d13021ce3d6eff15e589261d2b64f84247d33c84019a0c1f284b86fb0ffd4cbdfd
SSDEEP 24576:J47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYbgAW4PJ8oe9sg3r5B3lK+ubh:J47JUQjTirIhCnDHUPfF/t7lPJ8V1B3U
TLSH
T1CD65AE1DA3EC01E5E1BA927885154A1AEA71782E5F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 6fd851b4d400d2eea3febb63951cb7720c80fa01642309285a0cce2573057ac6
MD5 9a4c0b7df4033b76ec0c88ae68e3f05e
SHA1 fa2793f3ec630484cfeba0214d238e6c04468c3a
SHA512 24744d0e66d0eb2006b6c1fe94af8b6985fa2848f2e073cc511186514a173a7e6fc8637023a409571a166fdf723348f2af019e14a0bcbb48c925f9fda24eb67f
SSDEEP 12288:/6sfxJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bl:JqgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T10F65F119D2A801E9C49EA276C7964650B3373C6293E1D3CF62D0F53E1F36694ADEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 df91dbe20a47197548a5ce6a40469679bb39833e0bd18858b85e871cccfc6a0e
MD5 f0a8dad193533af4c0f3900052d2dcd5
SHA1 84446ec617249390e077a08fc27f3686f070531e
SHA512 ceb0badfb8b7d1040f631714c29b384ec5cad5282caf1f7571efb229d2e2f5dca5004407f1608661eac75b629a273f1ac791cba55534f422af2f6efbca2a6cf3
SSDEEP 12288:O9kCU3fr5+qDqoa2AL2RH9F+zLDMyUgP+VmjARMaxwfbS7R7:O9bUPrNDqMB9F+vD+SARMax827V
TLSH
T153452850766AC74FC6AD80325E32D1CCA7707D11EE456F0373C88B3F9576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 03a51d03f4aa2bb26c6f89d25a6a35823e2cc5caf7e65558444612c800166403
MD5 c619baa69debdf428dd17e119762b1e3
SHA1 a96dd8d6836a8bb623bf3b99cd44fb37ece79ea7
SHA512 9e7d3b0c77cdf4c476aef7367bfb6c46e1b98e05970ba4a293eb7cd2708b1aeec07108330f2fc933559b1af8c1020f8e92d80072b538344a62aa987cb5a46ca4
SSDEEP 6144:1Kh3i2p17fcyj2Fw7ZARgp8kbo/pTYs3TR1tMxxR1tMxRb34fub5S8bRapov/kqw:03tNSO7ZaqRo/pTYspS8laOv/kV
TLSH
T1A865E881A43BD38FC1FB6032072A5B4CA764EC06B7456F26B3C5453ADC6A725A4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f3604b4ffdba7233c2cf14f6d1587e92bcc6c1889c92872d5ca8b0cfd4d77d3f
MD5 f09a2403070fa9d354501c3d26735752
SHA1 1aa2ed9e625ee94bb3b14bd5a19c1d9a460233ed
SHA512 c40937ee4de8a4551dcf7493636e8d74e7f68f9d57fec2f5df37c2716c3bec78927f8d389f5303a33c767205a8d4ebcc58b79922af1bd42e4ff960fb00d954ce
SSDEEP 12288:vq7pJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8bF:WSgAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T1D9552324D7A85893ECAAA7F3A4EF9138251D3C62DB08D4CFF59531091A30BC9ECAD705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b7f730932571647b5ecb08f6fecd1255c115d414686d011d94c21f71d0fa9c13
MD5 b17b8d419c4b49e1d07b78b273f26687
SHA1 0f7863d2926a898fe86b180bba3220494fd1cd80
SHA512 81915c83844afb5dbd1827a1b59b328e01b771f183d0908c961906c602dd8e3d7a424c50535634eaa42da83d7ac650f5a0b06747da33b065222623a50aba038b
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYIgAW4PJ8oe9sg3r5B3lK+ubh:Pgb4mBIBhGFb7lPJ8V1B3lK+Eh
TLSH
T1EE65AE1E22EC02F5E0FAE2B8DDAA4417D6B278125731D2DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7381065f479bfea41a50f5004007de2452df2b89f764c4a4864c70c2b52d914e
MD5 447e16bab60b6130e02c88d990c96cf9
SHA1 276376db8afa539aa85e8840df02f5febe8a2aa1
SHA512 af7e051d2601253e60bdf8bcb8c2ed939291139443a0bb1590f8c7ee4345a90b623227aa7b0c22f04c1cc1f77eacc6bfaa30a9a2d4eeee08bdbcb8ceab12b6f6
SSDEEP 24576:0G88u8FpJqH1gzria7/mLgAW4PJ8oe9sg3r5B3lK+ubh:H7ZFPqV/a7/w7lPJ8V1B3lK+Eh
TLSH
T12285F165B7E001F1D87BD13889864663F6B2B8210364EFDF06A88A551F33BD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7d70d1e13a848f66e69e512d72c8924b0f8e1ea6ebd5ff78c467cc32b77aeb53
MD5 77dc29f77b6f8ddb04160f0576f0e15d
SHA1 0c05c9bb1995ba64cf9cabcf510da477d5c2402b
SHA512 f0568d69cb0e6d3c28e719f8df2db3a4e21bec6bfa13b00c11b721727f0edf00c1cf52fe66b50ff1be4a8b23d6185c8bf311ed419e6aa6f9a2535eac7b186993
SSDEEP 12288:nHvUrBFrEjwaQAJmw87aRgbWyTQVPQLDJfUoprnUHdsg3rlu4BhtlK+Q37bi8b4:nPUr+NQ3gAW4PJ8oe9sg3r5B3lK+ubh
TLSH
T13065E12E66AC18E5EA76E17D89864619F77178625312D2CF02E0913E4F37ED8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9fccf39a2228778aaa6800d73caa407e03782bb47411f82ce09fd8a83b2fc079
MD5 cc101a7091ee46ed6cd111814512d606
SHA1 a436d762e046976012abdf8d89805c2db27626d7
SHA512 6f35528be17f9c5e5ad662a1f8c7f4a913212bd25f1ce0543edb25784b73de7341df5fac42208bffbd7bed588f7e5caf906d5e0680398eac4be2c196c3565cf4
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjn7lPJ8V1B3lK+Eh:SG05lO43b0U3l
TLSH
T1B7D5CF6E62EC11F9D0BBD17CD9C6460BEBB23815032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1a026d4dd88df054af96c756fa943b07fafd9efb0cd0c107d82a4c98534a20b4
MD5 ae8daef52c3d2c171d01cbabc581e3af
SHA1 341cbec75faf9eb848da834c7a5716213b97c64f
SHA512 7442e4557e05c91e654d4877b683eba00990cbce459492435aae5b613774536e2d84193fab16f415321fe1d2dad90c3b476c64a40e4457e12793b5f901721c60
SSDEEP 24576:ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidndgAW4PJ8oe9sg3r5B3lK+ubh:2a5POZ3BJt2pasx2+m/7lPJ8V1B3lK+C
TLSH
T11265AF5EA6FC00D5D5B9D17DC583461AE5B1342253329ACF122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cbdfb8571acc6c2e645b2cca2ed12cbe4e56b0949b7e81496b0ee1eb408524a9
MD5 b9b976c26607bb2f28356fee6b147d08
SHA1 2a422251bad817a9a43b0367176e88203e31b1ae
SHA512 791d2081c1b345cd3cdc307e4b5d63c5100e6c83065791e1e7545fc72b5fd8a2f9b1d4345c157f0665f340b7353b82a3d5fd69ce5dc76289472a9140ab62fa21
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkDgAW4PJ8oe9sg3r5B3lK+ubh:VNc/zEOVHFQ7lPJ8V1B3lK+Eh
TLSH
T162858B1623E901E4E5BBE1BE89779546FA71786553308ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1c4668ef6e8a301a48c71530f3cd22374aea7018f2db9091af1b0bd28a0c83b9
MD5 4f7f73ad610f1bfeafab9190e9a271a6
SHA1 1a262f026c8a387dae11996ec974253cc2f659a7
SHA512 4c7a3f5add4617f8a3cb1639f4ac0d81efaf6f7c00e82425a848b8b87988fe84d1e54e88af0d4bb72dffd73a1d80de07242b18585d59e0211e5ffbab3f8f7538
SSDEEP 24576:BTkNvNnaFeYhJNtmZBmhgAW4PJ8oe9sg3r5B3lK+ubh:BTMwBtOmh7lPJ8V1B3lK+Eh
TLSH
T13655AF2EBAB845E4D1FEC6B5CD238512E6727861173292CF5290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 80f9dfff0542ec69c50cfc690424d122f5ae3dbc1d01b212a90e2a6231d48fd7
MD5 2d880c23687396fb8bd1d14ac17c59c4
SHA1 72b34a393d047e8389acdd943874bd8f2d088490
SHA512 5ef74db1e9c0f27b5e2a9fa0e358fc77fdc6a1786b191409ae26010f6a92ce43863018385d6c05406fc0f311f38e0801959a87023bf77dacd92b8afed948d6a7
SSDEEP 24576:mD3FHshBIYQgAGgAW4PJ8oe9sg3r5B3lK+ubh:mDVHeBIAAG7lPJ8V1B3lK+Eh
TLSH
T1E175E13DE6AC04E5D47AD2BCD9A38606E67138A9032265CB12D4917A1F3BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/236-313-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/236-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-108-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/236-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1128-312-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1128-116-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/1128-113-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1128-122-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/1160-78-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/1160-295-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/1160-77-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/1160-83-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/1192-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1192-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1192-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1192-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1192-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2748-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2748-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2748-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2748-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2748-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3988-0-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/3988-321-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/3988-1-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/3988-8-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/3988-7-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/3988-316-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/3988-87-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/4224-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4224-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4224-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4224-379-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4224-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4224-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4556-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4556-258-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/4556-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4556-54-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/4612-21-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4612-22-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4612-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4612-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4612-14-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4668-40-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4668-46-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4668-39-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/4668-50-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4668-53-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/4916-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4916-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4916-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4916-282-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5540-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5540-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5540-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5540-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download