a043f81e35105833c59dda57e91a031b21acb26c483a9d72ce50d606095f652e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
Size 1.4MB
Sample260830-3yqldsbm4x
SHA256 a043f81e35105833c59dda57e91a031b21acb26c483a9d72ce50d606095f652e
MD5 fda8ecc4e9b093dc52bb150a8033812b
SHA1 d30cdbd3b06ccaf5dbd5d9a688375a5aa7bdce0f
SHA512 ff8e0168a7f99922ddbdf4829b18504474a4c4e284c5c31306e5a6ef3337d227dec10482829ce1b4061f3acc67a127b6b951fef543aee2ae512e2a65aed15900
SSDEEP 12288:6HDmD+0wJ1BwM+dHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:6HDfaM+BRLQ8zb7mThYfQln82ZTpGq
TLSH
T12465F103B26D7CDDD066C235897145D2AB31FC302750A68F52F1BB662E376A3BD39A21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1620	elevation_service.exe
4288	elevation_service.exe
2792	maintenanceservice.exe
4408	OSE.EXE
4980	PerceptionSimulationService.exe
1920	perfhost.exe
5416	ReFsDedupSvc.exe
428	SensorDataService.exe
3524	ssh-agent.exe
6076	AgentService.exe
4344	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\222890b9e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003612031adb38dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec974b1bdb38dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd33d31bdb38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bc2df19db38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d6f9119db38dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003279a719db38dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1620	elevation_service.exe
1620	elevation_service.exe
1620	elevation_service.exe
1620	elevation_service.exe
1620	elevation_service.exe
1620	elevation_service.exe
1620	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4144	2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6076	AgentService.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: 33	4344	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4344	SearchIndexer.exe
Token: SeDebugPrivilege	1620	elevation_service.exe
Token: SeDebugPrivilege	4288	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 464	4344	SearchIndexer.exe	99
PID 4344 wrote to memory of 4936	4344	SearchIndexer.exe	100
PID 4344 wrote to memory of 5220	4344	SearchIndexer.exe	101
PID 4344 wrote to memory of 4736	4344	SearchIndexer.exe	102
PID 4344 wrote to memory of 1696	4344	SearchIndexer.exe	104
PID 4344 wrote to memory of 3508	4344	SearchIndexer.exe	105
PID 4344 wrote to memory of 5760	4344	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_fda8ecc4e9b093dc52bb150a8033812b_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4408

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1920

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2752 2756 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2888 2760 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2752 2756 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2888 2760 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 05a30a7415c37c3a87d93396a4689612e50fb524f59a67947c462b83daceec58
MD5 a135fb177913991955c4c75a07576bb8
SHA1 f810030d41abe2347594ac08a58b8e188c2e4638
SHA512 0c6802772015f1d1373d3fa46fefff200337bd98ec7d262f7dca80d34d7aa002fa1c2c660fe6a0464bd7fc00f22876ef0db3467fb465c0b1bd8dd5cd4cc213fd
SSDEEP 49152:Db+632BuPkFKRrdE6ohQstBhuXjfS4LWxnzyIbCTSfQZjaq:h3q6tjBNIGTS4Zj
TLSH
T19AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 68bd7812ae73959a440f0d7d5e44bcef4ec78822dd7e09298816f40a20933eeb
MD5 f536e6876f80784419ff499c80ae4694
SHA1 86d3048c839382c441240a3483abafca8dd5a5f4
SHA512 ebcf89ffaee0ce5fcf8b2fafc6c8f701b0284431bdc02f0be373427a540eb9e9b4b633881def920faba0235d587ede4db7cc3a37e8127d4751b36c669bb5b43f
SSDEEP 24576:IXYfDtczAiRLQ8zb7mThYfQln82ZTpGq:ftcdyIbCTSfQZjaq
TLSH
T12F65012977D508F9EC678279C9A28912E6327C5543A0E7CB03E4D9661F337E84E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e6e20f07d8a55989f3afe4da85e3029998bb90709a838fe3be5c5af714bec29f
MD5 24a73d20009904283dd2cc59e7a5cf74
SHA1 229e444722ab004ed6903e96eeb452ccfdd7089a
SHA512 654af559e4d445955fb1e035e613ec7b27f09fae295536a419e6fa4717650245c29ed7fb8b82f965aa83fa1a9bf29cbfd7933c687c1a4d357ff825516f9c8893
SSDEEP 24576:W0Le5ji0hmxwrMrRLQ8zb7mThYfQln82ZTpGq:WPji0Ay4yIbCTSfQZjaq
TLSH
T15E859E16F6748331D073C0BAC5D2A69EE971308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bd641ba05979a2c91831f1902c10464283a319e36aab94743ed8fb559fdb0e70
MD5 06f3ecc61acdc72d7dde6ffbcf5f5903
SHA1 b1ead7a3129a4337fb0f347a68d9e4d20eb24dce
SHA512 c86ebab18d47c99069d6750a626c9fc520f6ff87efeb5d87143815d8550fffd3405f03405dc6574282f65f831f67076ece30600ef08bc4781cf3300e889bbd57
SSDEEP 24576:oa7/ezSC6vUyDZaqgrvWx6q8wyuNRLQ8zb7mThYfQln82ZTpGq:v/ezSC6vURPvMHjy0yIbCTSfQZjaq
TLSH
T180755C15F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0cead0690e3a51b653e60ec7b5ec432d10055191b4e43f59109a6b68f5ff5024
MD5 59144d72885947e944952f23fc88a668
SHA1 cc4be5f259805b18cf06e76331d885dfb8658b4c
SHA512 169eb3b2aa8b5b3c49b2de09d874b930a2f8608016b531d69841a446bb219d31599c0901dcd250f32c0f9d49b5717757f1d692c24f256aa91451a31a4f149e5d
SSDEEP 24576:8VbqPb88hv/lV72RLQ8zb7mThYfQln82ZTpGq:8VO88hXlVqyIbCTSfQZjaq
TLSH
T1CD559E66F5748331D073C0BAC5D2AA9AEE3234415B31CACB1246D76C2E67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 07759d1743816cb623b9810268a20c9481a10fad590c354e85ec9b15604052e5
MD5 c84b6a8589933ac3c5c2a81537b7eb63
SHA1 46149faa9e3fbbad222335ce0fd835a28af8db4f
SHA512 d11551a427f09ca93a019bd1bd4a870616c4d6cd910c7c7802b9247be94bb3e2a3651f87c62585398bc5007d2f57c521eb3be2af2776be6f7b2866dc991098f0
SSDEEP 12288:PIvHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:PIfRLQ8zb7mThYfQln82ZTpGq
TLSH
T186452307AA4A8492E65B87B397F65DD6504C5F686085E98BD0B0FCCA1ABED74CFFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 27feb55709ad42bfa351abd4908b61086d77d746bd176e592354d339a64bdc31
MD5 a7c5ce1dcc7c8a784ffff84a604d22ab
SHA1 a8b2b067d40ebabb2846c217730228414ed6fed9
SHA512 d83d04c8eefb2bdb38494d892ed7e1460dfa5e69c9e90d989b233b70dbf9bb79f7b013f42e9aad36acbe91b4cd0d8b69e91ae7d68fb58df1cc4bcbb9f5d9272b
SSDEEP 12288:KeBNUbTVO86UAHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:KJIUORLQ8zb7mThYfQln82ZTpGq
TLSH
T1D465CF3BEE28FCD2C27E8DB95B918640D76278304B52A3CBD175C24E9E275E04E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5162ad8aa8ae79b208dea8150d90a7b1d63c43fa33353101d1ef74904a3300f5
MD5 caaee9798e0c57e7f7b931332cc7aad9
SHA1 bf79086aa37cbd1959e7ded08db77f06dfc6daef
SHA512 e0a7f0a2a2799eaf0024d7e110f4285c5787a9667dfaef56a63b0154b4c724fce49e3753aa4fcc803e76f3f6da45d5aae6eca948a02129ca3599380bb184d71d
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THp:TQvGAdlCEL8c/pRNw5CwIGTS4Zj
TLSH
T19A267C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0479f060b702e727e99a7005b38c699a8a4ab838c6c4316c52ce23c6af336d24
MD5 e60704a16c8d980440ea2bfaded69b2d
SHA1 07bd14a747e9ba9f8fd99ce122d2cf4bfc0504b2
SHA512 7aaa0292b2b9dffc1c17aa2e6120bc0ee57ab36beaceea7db98e94966d4b7c008dfc059a5ab161edbe829b418a924182fe53836c719d50359777c60573b55ca8
SSDEEP 12288:8AwSfxL/2Dc3/DLLmt0LDQewsAjmHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvT:hiewsAjoRLQ8zb7mThYfQln82ZTpGq
TLSH
T10A75E031FE75E036C27F0DB21B76C716142CBA204B512AC3E3E88D8E59746E26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 08c6ec31ebd0d89cc1b5d0fbf5e476fe577d7958dc29ac4e8817fde9a7837d63
MD5 b352c3dc7aa0add806325c002aeee8ec
SHA1 e5d4031a4047b077b4fce6a35bc7bd37e625734e
SHA512 1f8db8c5e049f6ed1b09970b8920b6d2a7f99589bd4d579708aa2793851a4d7dcd1d230d073f1cfa508b7bfc56f66e172604073d13e5467a4091fc3f7491bb29
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHQGTSW:lUEtQevvqc2W1cpV29I32QC
TLSH
T13D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5db04f204d3ab8ec6220fea310db37de625c38a20ff85e2bb655095982932f2f
MD5 d253b6b5082624e506b30e53a8f0dff4
SHA1 77aadd852859859e669ba8c61074c9c6e87e2a72
SHA512 fab0aed79e1f5d4042d0482d51e5b92728ad8c5e4675aaa1f668912911096a50d6a0a1027835c50c4e4e03562362ffc42f5c7d01451b3671c2d1c7f814163f90
SSDEEP 49152:VCbRquA/m2yL5zLfFiV+XenmE3/zIyIbCTSfQZjaq:Coq2Vjnm8IGTS4Zj
TLSH
T1D2D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 92b3eb3ee3b86a812be34e0797bc2774cd28976b28b1e85a34e9f6ec5bfb4905
MD5 54c6c3426ea8a044ebf816e81055cb27
SHA1 c7296b12bf38fce6e66b8e3b4f4b6fa8e21c3060
SHA512 02d013947d6a4b73e8270fed5034a035dd1793a41750067cd1fae0b288b3a5bc491eb649587033dd8a43ca1fa203afbfc4d4297ae8ea33184d3e7c9bd070380d
SSDEEP 24576:9AhGLmIFoiwtA5l7S53JRLQ8zb7mThYfQln82ZTpGq:9AM1Foiq5ZyIbCTSfQZjaq
TLSH
T131359D81E7F945D4F5B3AAB899B68571EA76BCA95E31C20F2160D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 781cc39cbf038cb0d77fd67988cb8a2f9f7f97bb4f355d42118ca508c18c1a09
MD5 001f80716e63a9366e4b2b3ef892a3e6
SHA1 d86f5d33b21219f7b982bb1ddb7dfd39fd720acd
SHA512 4211153d0813b33f58a509455d7427cfd37d6087c891192fa3cb84934e90de4dc3ac3910f79ec6450cd559e04a643935c653cac2599a387d2f64a8ab3f81e9a6
SSDEEP 12288:kmw5HEjsChNkBFgl0WDm+CZHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgFl:BwupOWURLQ8zb7mThYfQln82ZTpGq
TLSH
T12465F14676A50CF9E9678239C697C536F7B2BC112621DB1F13A0C65B5F37220AE3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8261291eb9068b60a08c899d39327cfc10846288d86bd8918a129510429a4054
MD5 39a531ad060d6c36f53049d79e9deb35
SHA1 9e34cafaeaa680303a73335b4829ad521f757552
SHA512 870e037a9712c652a68a42f9d54011cd6a77ce21f98f529c594b9e57aec5b258762d35d30a963bae80162fee5d339cf50bb91acbd8188baa2b9fa03d20cf6d22
SSDEEP 12288:vBZ1Iy2HOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:5ZujRLQ8zb7mThYfQln82ZTpGq
TLSH
T1D755124B33D560F6E197837ACAF14A86D3657C66237183CF11608A9A1F77EE08E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a8fe60d45484405bfb3ddf4fe019d7761bf0e3081d2d764cbf9850a9fbf26b03
MD5 ef0be9773cefe778868f9f56752eb170
SHA1 dc68ffdc9f9fc8adf0be91d8f16e35f26cee0197
SHA512 79308f70ff3d6b683578d8b561d9b6602f9106c3fabf896cb6a8b1ca6435ee7d0c130648fccef00e9e7807857492074474d1a483bb8db7f3922ca860f1671080
SSDEEP 98304:SQRQyi36YOcPuLvw2gAf+PN3BIGTS4Zj:JQyiKakX+PNqGTSW
TLSH
T189667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d84f8b32217bd68c983fc7ccbf1158285cda43d54dd20cb5d1d10a4ace5c1f2e
MD5 4aa3c3d053bd13e2f93f38e3860fec28
SHA1 2adf5772f73bf9d89510623fb9bf24d8de809533
SHA512 fdf815871ec57696af1fee8f027934a0f14bc3490f6c9235f6a15861918740c2a8b1283cf9c158bb556212e36783b6afd480ab939868909dba61771961694a7f
SSDEEP 98304:xQRQyi36YOcPuLvw2gAf+PN3BIGTS4Zj:oQyiKakX+PNqGTSW
TLSH
T139667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3e8060037655ae4ec5fca73f5e4582f48fea90ae4192c1802c8cae21297cca9b
MD5 ae2f52798a44ef765c3c1ca59c7e18d7
SHA1 3751748ff6d8445962497cb64d04d9813e8cdb21
SHA512 fc5c0c60c68216aafb9cbcfc3615e013aff5d1aadfc84880974c5577836f55849029a4bc894b2bbffb7a09524ac63dc97cf528da9c0c0d83c98ccb56cea61464
SSDEEP 49152:T68Qg55nhxeWu7PNU3/4yIbCTSfQZjaq:NthGRc/3IGTS4Zj
TLSH
T193B54933B2F600A9C44DE1769F4A872196D17C758FE0E3DB855172061FB2AE07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0ac07a178fe13cfb219031b381281fdb63c0052c2c5f57251ff16a76b9dce05a
MD5 19ae0d138297b9f5b555d574bd20d3f0
SHA1 f9d15bbfb139431fa5ccdbf50455fe6dae1d9934
SHA512 e027a22a2061ceea3ebbb655e51d03c7220669e2a639635a327cbdfb9d06e3944bd99a1359ba060bb7d0c69bca8fae5c40f3293ea1cfb0e847e7b0bf6380b4a8
SSDEEP 98304:ay5112gYy5azzVvD69nLKnhZqIGTS4Zj:DLIH+WhxGTSW
TLSH
T1ED167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7b303ffbf1ea3814bfb7661b61c2a5fb5920f66ac6173aa0e3731f40fb942ed5
MD5 925136d882254ec31a273bd28bdd095b
SHA1 994c4e80d6482fdeaf4ad22e46c41172676ec02c
SHA512 a0097383d579d944071aad8fea70b42fd58268ffb684fe93189909525fb6a6f96035a6c4d03120bd01c2447e0b683ee03324285d441bf1b1d22c4816e4bf9e33
SSDEEP 49152:vB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glyyIbCTSfQZjaq:Ru6JmQxd2dZIGTS4Zj
TLSH
T196D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 69e160bd066d88057c86332bc81723cb50575562e463ee99c6406d43236a9b6c
MD5 0a73876c2ae6299c8398209b54976bff
SHA1 f1548d7e409e07009b88e3a99d8ee9222cc65234
SHA512 8c0ee4b3b6850030b2a173428770fc4679c3dd04a21df768dd75eb6d0f87cd7aa1730d06799ea69f3d7d3cffd0aa34b27e297e59d637be121078f4d7fd8eded9
SSDEEP 49152:j1hpsNoJpF1A6yU44CwH7R4xuyIbCTSfQZjaq:jmifPVR8IGTS4Zj
TLSH
T151B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0d2e83a9d281f3db6d3ead8d182a6deea4fcad9ad73ab63a3d3bf4d643af19a0
MD5 5ff6051c52dd89eaffd52075a276f86c
SHA1 c32b1be94808971960aeac547d042a254875b489
SHA512 59f765918c646176749c04b5f52a128866a75f6c0ad4a9cfe364e60dfe53216098e4e5e09686fe5a00e3ca98e20028bf469222be10cadd779016806eb5c12752
SSDEEP 49152:zSuZQIY0Be2KIRVtOnks6NMHqjyIbCTSfQZjaq:x5dKOi61eIGTS4Zj
TLSH
T120C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 337a2cc86c741426141a85f694e69697cfb694ba07e608fac073f55e856e77f9
MD5 2614aad9faf16c07e4aeaa5f23c400db
SHA1 fc4b57123ba1ea3a5e09e494af003ea5282cd00b
SHA512 0a7032a6699bf0f9fabd77fdb7f30502233ab9e73e835feff690217ad64a8df569b132f477e7a3e5ce00bb6d9fd7a5562abd691db94d23e8bf257f7f4abf0992
SSDEEP 49152:AhtSn8EApI0figGgiDn0AP5wiyIbCTSfQZjaq:RX2i/ph4IGTS4Zj
TLSH
T11E95BE13F2D900E8D05ED175C7568632E962BC160B38BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 31ca4b0a1667591073eb56ebe9083493dc983fc68e5e5d958610830f57c4edad
MD5 b3a3330b93d0194453f6cd51d0f25d76
SHA1 1f98d914c714bf6c2a004e3f45310cc7708a96b0
SHA512 7c640f9887e1ff221a22e8cfe0f3d617d568fd0cc71b53e6d38473e01fce44cd6f93f09d1c5700920bf7fea8dffba94829b6b1025a318d5e327396f5c4fcf217
SSDEEP 12288:dXHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:dXRLQ8zb7mThYfQln82ZTpGq
TLSH
T1A0452307B94B8486E10B87F3C7F25DD6904C5F69B185A58BA1A8DC862EBFD748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 af2963b019facf4e6cbf65d488fa7819a742c29c158047933e5e8b7d671d0987
MD5 45c56a9fdbc6f97157048cbfdf3add23
SHA1 77ddb9ee3a2d3e94ca4dd5689bf09e259dfe7ec1
SHA512 835ea8c401397ad72d8f13b62e5d9e9cc0286480742afd8c554c1d461ea1eb1893bc11657f9aa46f565f54e82b20f3365b000e19456e3371769f8c55a14484a4
SSDEEP 12288:GaHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:G8RLQ8zb7mThYfQln82ZTpGq
TLSH
T187452307B9578486E10B87F3C7F25DD6904C5F69B185A58BA1A8DC862ABFE748FFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c4d8cff7e62ab477fe5d99051e3f7d118555fb50a6594facb968a156466d4242
MD5 7aacac3f00cb6d2f789689ea62ff7e7c
SHA1 b0bb9b7707a027678150c3e4c9d5571db8746f68
SHA512 db44bcc05d37910deed03fff5ceae147c4b6105b6a370903ce5c1123cb43ab3dfceff835f542a71c30a789a8da7f2718914d0f347570d4304f9e52f5e4ea1af2
SSDEEP 12288:9IHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:9GRLQ8zb7mThYfQln82ZTpGq
TLSH
T120452307B95B8486E10B87B3C7F25DD6904C5F69B185A58BE1A8DC862EBFD748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6f21e66cb9c802cffa4499b91403fc99c77524c2ec7379e176a39434afa2cc5b
MD5 e92bf282dc38e8744bdd2e8736286b4e
SHA1 bdf2b75609f11687292ecbb3380cbb0168d62d7a
SHA512 b692ddcdfe5ea221824dbcaf1f6cad3961687dcb12246d43b7ac8051e332c87c42dbcd8683fdf96da008ec7c177fa81639ea61b8fd7da375f25d3ed0091ab45c
SSDEEP 12288:TV1HOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:7RLQ8zb7mThYfQln82ZTpGq
TLSH
T158452307765B40C2D457C7B3C7F24996D1687E68B261A6CFD5608C861FBBBB48FB8A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4f074e5554de698ff103dc248bbf30a9c3d5a2fb88579cbb1854eab35e7d4815
MD5 907415146249741e517506c16f22ec4e
SHA1 c13a43c5e90f05155ff52a5682a4d419df197b26
SHA512 0cb6adf86bf816cc998f8285b3496d12c9e57b44192e5443fa14c23c26e78320588bc0032a6c90f100bd0ca5f53fe4b575bf2ec2998351164dd2aea993081aea
SSDEEP 12288:ftHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:fxRLQ8zb7mThYfQln82ZTpGq
TLSH
T135452307B94B8486E10B87B3C7F25DD6904C5F69B185A58BA1A8DC862ABFD748FFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5fa631d1c2abfc5aeca05071906947277d83e581436bec648540fe159c4afdb2
MD5 569706838ed16f5c825dcce6f6980eec
SHA1 3c40be27c101ae3fbc0358f4b7567cd97db97731
SHA512 06c34503ed9e8fe2e048611002d4ab8127c145845b899de708a7382cb3ee42b2292b6de5644bfc4e1d2c4ff34af1c46f7a0c6c87933ac80e81ae8870615f64fb
SSDEEP 12288:1OHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:1ARLQ8zb7mThYfQln82ZTpGq
TLSH
T166452307795B8486E10B87F3C7F25DD6904C5F69B185A58BA1A8DC862ABFD748FFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0bcfaa67edce3d8fc92a6516ceda866cac2a2a017ee589574c20657e2ff7b346
MD5 b08e31b3e7ed0def0eb40ea10409228b
SHA1 fa1f5a3dd020683a3d83dd7704be5ab663d699f5
SHA512 fa59b1024afe2bffe60eb5909a4efa797b856eed2ff136c7ceeb10169502553bcbe41e6ab755f1c6fda99718e6034f90e4fb0c8ce41e8f7fc8332900a33f504b
SSDEEP 12288:OSHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:OkRLQ8zb7mThYfQln82ZTpGq
TLSH
T11F452317B9478446E10B87B3C7F25DDA904C5F69B185A58BE1A8DC862ABFD748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4bfbdfcc31d65ca25e2aea61c6068a14e9edb1911569b63e617bbb3e997019cb
MD5 e656956556b2e73fc3455a1269add1d0
SHA1 1d7d4426d348514ccc4d8db556b6d0fdf7aae02b
SHA512 69663e8338c7feae3ae5646c3be3f507694c4d1c8e4e0421a248357d8e5386238cc30f02196268f43af9d646dcf3f3c844ac11dc39a62f7ced62363031508af3
SSDEEP 24576:kZMfzFVSOcRLQ8zb7mThYfQln82ZTpGq:kZMfzfwyIbCTSfQZjaq
TLSH
T16D650196B39008F8EC67823AC9658D46D2B27C291760C64F13F43A6B1F777A04D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0fabb4ed7af2630bcbe1744c96df1f58f95ff66e50f31b6d8972c548b2714006
MD5 9dd3bccbcc473c19eb1f8b6d780a0f6b
SHA1 3a9c977c4786af322b662a09d4109ff6e0b935c2
SHA512 857e1f0db8e39f37098a757bb4e14a4ba8165ab3f7b15bd30726a4857204077c67105fe63dcbc2f7d6af7dc1df7ce6a7194f41d47498debb29cd1d0078e8bcab
SSDEEP 12288:iTHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:iTRLQ8zb7mThYfQln82ZTpGq
TLSH
T1E2452307B94B8486E10B87B3C7F25DD6944C5F69B185A58BE1A8DC862ABFD748FFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7e892e0da8deb3a464e2cc241ff7a2ec96595c5038318d6f38caa934305574e0
MD5 85d10d3d306c727aa19695e299be75b7
SHA1 ffb420ca1f8f803df1b8835353b7caa6049d97fe
SHA512 5c532f5fd3487ab842c4d24f621fd3f1b6b7133f1a8adf4bcb4c5739cfd992e40c81d3d649ada686d07192ff575e92f2ef3574d4de4c6680a2911ac528890584
SSDEEP 12288:S/HOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:SPRLQ8zb7mThYfQln82ZTpGq
TLSH
T10D452307B9478486E10B87B3C7F25DDA944C5F69B185A58BE1A8DC862ABFD748FFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c023c79b5fc882b73f37e81545cfa99202593e240b71032228caca29cc63a919
MD5 a8355ef43ccce8ea7d8c02ce79cd6013
SHA1 a8604718e5e1c30a9269c2c957370073f9707205
SHA512 f2b7ef31f4af8b345a271d677cc7d6c38b319e22699d0fe6433482b6938faeac0c686513ad7ad26dcbd0a6d45f1774b5c56c21ddcc9394c42ea63a0899bdbb78
SSDEEP 12288:ByPz5L82HOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:QzyYRLQ8zb7mThYfQln82ZTpGq
TLSH
T14955120773A620F9D1278375C9A21E42F3757C3557209A9F53A44AB62F376B08E7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5883563cae20ab099f48abb7704f03007b6bab1b3b0502689646b4ae4ffabc65
MD5 3af111f5a43ea3896e2cee9946ca59ba
SHA1 c4c911dbb49fecb8a67e3282f586cbe2edb5d770
SHA512 f80320933b8a1c17d032784ddd27b65a667e54f596b75365d9e8ead37944f18d54b21600967daf5f7bb15d8be8b83c5982b343adc2535fe546b0f517282a6077
SSDEEP 12288:1THOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:1TRLQ8zb7mThYfQln82ZTpGq
TLSH
T1A7452307B94B8486E10B87B3C7F25DD6944C5F69B185A58BE1A8DC862ABFD748FFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 41336314477535ec7e3801de982439ff6507af974f513d348a185a3154f2fe04
MD5 19aaa8caf2a710a664a81fffa039ca86
SHA1 e23605f5fe61921271d19108f7ab672c2e4c600f
SHA512 58eb420ab5e5ed3706daebd57c74491b41447f79c9297e7f10a430a400813a85aef8b0df35364784d6199433c6d37b631c62317ec62204c10a672967470588f8
SSDEEP 12288:uTHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:uTRLQ8zb7mThYfQln82ZTpGq
TLSH
T189452307B94B8486E10B87B3C7F25DD6944C5F69B185A58BE1A8DC862EBFD748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 736cfa3e3eee7ae281a8245c4cac5d71ff0414efe92ce872ddb1f7c24564f0f6
MD5 4d298756bd1e4991aa9dfc449e77ba0f
SHA1 1f1de32de674d84e0e1155ee6d6686613c7482f5
SHA512 8a0eb408227d779ac1a644d9983bc4386b8e9f23497bcac1cae1993de195279365272f679c53629f3d580a0151936eee6be035b812bdacb7806d3e36343b22fd
SSDEEP 12288:1yPz5L82HOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:czyYRLQ8zb7mThYfQln82ZTpGq
TLSH
T12C55120773A620F9D1278375C9A21E42F3757C3557209A9F53A44AB62F376B08E7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 972ececce37d87ab1f6a33317f64b523d9e8ee742069a5714ebcfb5d7ba006b0
MD5 d92149b7ec9c4e5a25aca1df34c288b8
SHA1 963077b840d1ebefdb3438aed61e7fccc291af50
SHA512 f5a5cba4723b230ea4403633b20ee20411afedbaf08b5328c18f808dfe9596879c404ee85ccc826600df3125ad023b025cb16510ab9a8051c82efd8cf8d36c1b
SSDEEP 24576:STkaLl3z0zDWRLQ8zb7mThYfQln82ZTpGq:STTLljNyIbCTSfQZjaq
TLSH
T17B650195B39018F8EC67827AC9668946D2B27C2A0760C64F13F83A6B1F377B04D3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8ed7bcd1b438c4b0fe50e598dfd9571a0b14a051316190fa85f4d2ce56f0f304
MD5 0f214f99904c1948f9af53477c29a887
SHA1 f21d85438ad3e14fb7286aa4a14d122eb17b3554
SHA512 04a2968180e2accbb9dcf1c3ec606cccb7fd7009f090ee063a817a50af1518e6166fae7542fab75ee28fba2a2f63ec29ba2fed5159ed8ff04f9259837e306186
SSDEEP 24576:q3jd9CHKy7GZaRLQ8zb7mThYfQln82ZTpGq:Mjd9CHKyawyIbCTSfQZjaq
TLSH
T13D75CF91F3E410E8F0B79A35C9764512DAB67C591B21DE8F03A4655A1F33BE18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0a6cee314f965e5e8627aff765f4cbcda6546b53d6a2eb742396b2a84ab6282d
MD5 30e89061286a16cf4b2335bd0c91f452
SHA1 feb67ae5caa31a589825d25de70d0bb56ab3c701
SHA512 4fceb376a79fa281900fb2b96ebdc676e9d0aa3941038509e906637819156727f0f7e4264b68b3c16c725da345ad9eef445be01dc95610e19f7c1125c2c50fbc
SSDEEP 12288:xoHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:xmRLQ8zb7mThYfQln82ZTpGq
TLSH
T191452307B95B8486E10B87B3C7F25DD6904C5F69B185A58BE1A8DC862ABFD748FFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f6e5d2c015a5ec88f2b79ffb04a4ef4169e0517604f2562e170e8807bcc4328c
MD5 eb56405fdb625cdfcff2aeea816f39d0
SHA1 f4abfe11e3f22d70dbbf27a8a274293256c771f7
SHA512 9cdcb09f60e7d106321357aaddfdc61afaff21faa54162f53f67701de9e99198f2f06f303dfa97ac3af5d4f222b8cd058e63ffd4dec05a944bffc44a06cf6fa1
SSDEEP 12288:ZWHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:Z4RLQ8zb7mThYfQln82ZTpGq
TLSH
T164452307B99B8496E10B87F3C7F24DD6904C5F69B185A58BE1A8DC861ABFD748FF8400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e22a4554d3164d4b7b0a8d516708441fd551efa0b0e517ba99dfba6298aab3b4
MD5 0896447afc6e3ba1f0c1aae09ce635bc
SHA1 7664de27be65ac57e3a209e8130414b894cd227f
SHA512 1b728f19637cf9bbbe7828edbbe68502d3b78480e3d2352acdc5b5f540c9aa38a0bc3d424954b4f473e87b7b41dc77ef923aef914dd61f8fcc02a2f010f88dee
SSDEEP 12288:9RHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:9VRLQ8zb7mThYfQln82ZTpGq
TLSH
T14E452307B94B8486E10B87B3C7F25DD6944C5F69B185A58BE1A8DC862EBFD748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6572f1a5a646df7770e2c5f11058235ca1f9541ac772024a200b3862903045db
MD5 0dffd3643d195e7754b4dd1c48d0f872
SHA1 c5956675c80a9605c921875a4ffae408d975ebde
SHA512 1fa12450acf85c8f0b831791e04ead0cc8bc4e3a1ca4b3261d91286c37fed41564b632cc08ba2ad4b6d6a047a6524edd3c09320912104a710abed2be256b9d0d
SSDEEP 12288:nTHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:nTRLQ8zb7mThYfQln82ZTpGq
TLSH
T103452307B9478486E10B87B3C7F25DDA944C5F69B185A58BE1A8DC862EBFD748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0f69dd3b0dc0b5f82bd1d8e7831df7f80d5131a933525ea629a122d3dd65e437
MD5 6235a08635b7911203d23868db206732
SHA1 0bafa7dfb7d56e658f14a1290200b5da384020f4
SHA512 0a15321022bfca80bfe4daa411537cbac68454cd0afc88bd9a2bfe0f8d9ce7426bade4135435ba05e9b4d2a7274922e0038a6280691b90474233b4e792100702
SSDEEP 12288:VoHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:VmRLQ8zb7mThYfQln82ZTpGq
TLSH
T1CB452307B95B8486E10B87B3C7F25DD6904C5F69B185A58BE1A8DC862EBFD748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f589858ca9e824533c61703dbb7db0ab5f488f5da2f97856dd30a92c739415ba
MD5 5779c14f72e67ddd1f0105a9ad8f74bb
SHA1 4633806fa2047fb5f08b62e0a7ee54f32d9e60ac
SHA512 d25b36b9f24ae62a37634d1a8af9fbdd18a1c1aa22d8cc1b83f044f89440e90c7c9d1efbadb2f3fb3fe4a4660aa85c4e3865ebf3ac8533dc399ed58a772fb298
SSDEEP 12288:5LHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:57RLQ8zb7mThYfQln82ZTpGq
TLSH
T1A2452307B9478486E10B87F3C7F25DD6944C5F69B186A58BE1A8DC862EBED748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c654549ed84a8afacd56688936d6544291981af28a8461084ab76c74e70eb9d9
MD5 b2648319c7b75d766a7cbbbb06fe0b65
SHA1 068451405adf82bd0b54a46c6103bee374add4eb
SHA512 c49cd50b29079cbd1d1908e71012455c509cc3244a1ed967dbb1764e2453b9f2b9045687d21a355e3460118c7710730fcf69633b25968cb791262e79ab1371ce
SSDEEP 12288:HtHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:HxRLQ8zb7mThYfQln82ZTpGq
TLSH
T1BC452307B94B8486E10B87B3C7F25DD6944C5F69B185A58BE1A8DC862EBFD748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 35117bdc6ac6ce8fab26ebc5efc586413be198c78d513b9488e5208068ea1e97
MD5 a7b99a895075d3e4f0038273a62af767
SHA1 120065636884956e42d806ec00e9465880a1cf89
SHA512 e4caadb89a09e111b78f32b153a59e1f187f8043940e4be51c983cc9c2ac71d3c1352613a637fc708259a88aa431ce5ff6edc15247196fe9a90d73c9923d198e
SSDEEP 12288:xQHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:x+RLQ8zb7mThYfQln82ZTpGq
TLSH
T159452307B94B8486E10B87F3C7F24DD6944C5F69B186A58BE1A8DC861ABED748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 ed414224cb9ad3d6a208324c8b3ed2f402b5340e3061de925728cc40bdd65f85
MD5 20e071676c6db381a89a807bbaad5b67
SHA1 c2a0994e80b38d0accddd85eed242b669bd12f81
SHA512 812be6ac2d983e0456acfecffd6dae235e3d782bc60782f670fb94d3997f85b4bb4576e34b30268665c3c69f7294d6fdfc5b26e7e8e8df69ae794c0a049c0329
SSDEEP 12288:dtHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:dxRLQ8zb7mThYfQln82ZTpGq
TLSH
T100452307B95B8486E10B87B3C7F25DD6904C5F69B185A58BE1A8DC862EBFD748BFC400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 8829c4fcd615899b3f87b8c9d572f7f8fb84c6def09d36676a45f7c2d120559e
MD5 82f69324739331b3f91fa258cfe42e9a
SHA1 8cd217e9f1f92641ae8a0f02de8063b9431aabd7
SHA512 e0b9c630a25ea63ea96253feac7f66173b454e0f1942840057adb39cb84ed430cf79f6d86f3b31afb02a81db21bee44bcd7faa2c054e1a13d0d30cc3f981c728
SSDEEP 24576:ffwvIk9RX6wkyAI/RLQ8zb7mThYfQln82ZTpGq:9MnYI/yIbCTSfQZjaq
TLSH
T17F85D029EBDC44E5E177923D89B3460AF2B178681B31C6CF129A53AD0E37EE45E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 369f7af411c965b81c089e608cde0b2fb85d6623f8edc47a5d2064b941d4101f
MD5 f17aa494009b81f635b3865c005b0d6c
SHA1 dd987f108043ff9bb38ff73e87b192558a491485
SHA512 6d84e5a0b9c451fd8f9423035ee475bf070c3f029d8c350aedfe50a65dc15fab104cf07ed86aa658da94eff74cc584ffc6e414e92b12ca9ce176d673481bed17
SSDEEP 49152:YYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CyIbCTSfQZjaq:EySzPhIGTS4Zj
TLSH
T156066C57A1A841D5C1B9C1B98B1BCC1BFAB134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4837a19694d314aa7182a5b3f08a41ac92b1f0eb48a2c9b59050ed54b272d2d5
MD5 39a2b59317b5458aff6b025f5e759c64
SHA1 b3b14ac86ea312cf980a5f1ba6974cbe5a25e83f
SHA512 fd4fa7a843292aa802e584f77cddd0c2c0a2df03e4f995169d861d6c8e4c21e51b7e4a9002a82090f3ec85b111402f88410641ddbc829dd8ef672b7a2e35a1cb
SSDEEP 24576:347Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYMRLQ8zb7mThYfQln82ZTpGq:347JUQjairIhCnDHUPfF/yyIbCTSfQZd
TLSH
T13565AE1EA3EC01E5E1BAD27885554A5AEA71782D1B31CACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9e3baed2b100bfaed806abf8cc50353e44537d034ab63c49540ad980dfdd857a
MD5 5956c65e6034fb8e8bcf6989eaeae73c
SHA1 2584f51aea7c5b702bdd8154656fef253d753800
SHA512 2c9864057026cd65de1e50f74ce8fbd04d48c037b76c485722e72791763bfc68d8051e004aa31df461b5a963f059fe6b4c8c0c44f084916d199a0c68981aec86
SSDEEP 12288:MmsfDHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:EjRLQ8zb7mThYfQln82ZTpGq
TLSH
T17255F10AD29941D9C06F9276C7924A41F3277D2593E1D3CB52D0F87E1F7AAA08EF9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 f5dc140fd698cd6ab581e51bd970eaae8f8c2c61593de0c513bd9b6d6be8aeb9
MD5 9562104620da2f5a3928c305ca532570
SHA1 8efeab0702c3477886055ebd90643298317995c3
SHA512 4be176d30703ea9d81446507cd3e3675e14035107422be354747d98c70a894f51788fbaa1bc6c555d815c8711db9618cbf2028aa128d7c5810034e727172b233
SSDEEP 12288:0dF9+tU3fqiG254XpYxveAqgP2bl/u4uu:0dPiUPK0449puR/Rv
TLSH
T157352850766BD75FC6A940321E37C2CCA7707D41EE04AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 73d7ea640c5999f0f97af04f347febe37e858d86258ac7af37bbb6f3b3accb9d
MD5 850c7aaa5f7cf4fb64917298bf5c17e2
SHA1 9cbd6a8e9ebaf03f557d3d2c5ac3be1fed56be10
SHA512 1dd8fed491b348f7c6124ac89a8e2c84f5bb2e855fda568eda0095db2fb57e021cb737e6a8285fd6902a863849c2231664ac7b1cc04e80004d07536a9f1fe6de
SSDEEP 24576:QL6x0KAwFZoq1SKkZ43Qm0Sl/aKDSB74W5R1/BF:QL6x0KAwFZoq1SKO6dXl/aKDSB74W5RR
TLSH
T12055B6815537A3CFD1FB6032072A9B4CA774DC07B7496F2673C4453AD82AB26A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f13e26c1b1897a16a0128fda8998484e7a2617957c5148f4e2014e530ccf4c85
MD5 5ee6321d007c1de0b1330b84a97306f6
SHA1 8391752cba0c5e267871d94a6749fe036c8c20e4
SHA512 c89d9a475a133e8859340747071a8a8d2e1723b686fd718f8ba2aaa1a269e3b7635dceef39ed65e4d55bf6c72021b1cab5c7a603906f351f9c12824adbc19bfb
SSDEEP 12288:a377HOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:kLRLQ8zb7mThYfQln82ZTpGq
TLSH
T13B452313A64A8842F16B97B382F64966600C6F386740E5C7F054DCC62ABEDF0CFF8504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cb7c74835c252a3092c8095f6d2a9530698f5884e9294301bb07411f1e7af07b
MD5 ad5909a0e81e5bba506ab863a5df21f8
SHA1 b10829aee8e6729aa6186293e5a35268a71b38c2
SHA512 ef33f98e2d801855e2b16ac93f88e670aa12dc7cceba69d26e8c965ad705dff0308bf924947786ab98596f5dea8824b6f44ebb0e8cf75c5f9fd09f4b8289dd3d
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYNRLQ8zb7mThYfQln82ZTpGq:Kgb4mBIBhGFMyIbCTSfQZjaq
TLSH
T1F065AE1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6484a147c8720affd36bbf13efe8aaa3ab95ffb6b1012dc8d63e9bce904e3994
MD5 1ef4b377120f6de6278a416d45e040d3
SHA1 16cca559e2d2d2ac990f75f4bb252679fad844ee
SHA512 7912f023489aca8b5bc2066ddb6836e15d128d4775dcdee959d551c4f36483f93893409bb4a90a0a4eb7b81f3c45c6d95593e439facbf7f5f4fd5c4dac2f12ee
SSDEEP 24576:xG88u8FpJqH19zria7/mcRLQ8zb7mThYfQln82ZTpGq:U7ZFPqVka7/1yIbCTSfQZjaq
TLSH
T13385016677E101F1D47BD138CA924663F6B1B8251364EFDF07A88A511F23AE44B7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 93157dbcf5814c288a86fa5b1361c675b087f50ea39854c5a89db5f0430e9600
MD5 352b83a60ff9247514956ef8be441627
SHA1 070e44a5b258ef19a47345d10efa376aff14d094
SHA512 7e61d938d43d4e4a16f0865d19e9c7178c9f08b2e6c0904c9fd2dec3fc570b8d6803d3499a0edec2155b447fb9aeef827a5e1fd590fffdffc96d85fae215d968
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAyIbCTSfQZjaq:jG05lO43bSIGTS4Zj
TLSH
T1D0D5C06E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f0f40d888645a4c958bffe2066e6090ac9523ebe5a42647f17c1ed6a6531890d
MD5 fb0aaf0a255f2bb1b08a6c96f17243e8
SHA1 ef452d1a0698fb3a75f6b413eebcf4c40c5ec786
SHA512 e4d6a05324a07ee1b9c3b9776c684c137dac1e9467564fad196e3c097a200bf3b6e10698bc7fa8a42ef42319722191a93fd8319c34667a1237a426e40665e8a0
SSDEEP 24576:vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnCRLQ8zb7mThYfQln82ZTpGq:Xa5POZ3hJt2pasx2+m4yIbCTSfQZjaq
TLSH
T19065AF5EA6FC00D5D1B9D17DC5834A1AE5B1342553329BCB122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bed1f27d6c4e012a4a9778ac0921cb9997be9ad50209f2a7d3b081982f74d2f8
MD5 117acc1c3dfcb4687a2896ef79fb2730
SHA1 d637d74c2347f0df5fe9ab9805886d9b6ae188e8
SHA512 64f4608c7c9d88d79426be6b1b07cc5ba4118d749787c9ed3a03d96f7679897c649d0e3a3b94adbf6d460c29eb0cc3408615940d580661519b608a3cba54d5b6
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fk0RLQ8zb7mThYfQln82ZTpGq:pNc/zEOVHFVyIbCTSfQZjaq
TLSH
T116857B1623E901E4F1BBE1BE89779946FA71786953308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bd1bc32a17c7eee49d015912f2812aecbcdf322c748ab2b06a4bcda293f39da7
MD5 1272970c145471a1a8b81082a51c0da5
SHA1 c5280486633aad92b4a79bb90b152baede3cb5ef
SHA512 1af6ee0acb35cc32d5e55cb079eee18e2ceb5728fc6c3ffcbef9ce576226bbaf1756d283e9c35fe4f392ad1627351e63dd793903a032e8123ed6421eac98a482
SSDEEP 24576:u3kNvNnaFeYhJNtmZBm+RLQ8zb7mThYfQln82ZTpGq:u3MwBtOm+yIbCTSfQZjaq
TLSH
T1FA55AF2EBAB845E4D1FEC6B5CD238512E6727861133293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 31260c0f995cb830fac81f9324000e1a0513d8e030992b6352ecf265cbfa1efd
MD5 7347ce869392024864706829fc67b574
SHA1 e04e71c804eeafeeed934882e0abba05ce819289
SHA512 6e3aa3e24eefe4a471f5aff05d414cfb208f3dd90910733e8a23cc95407007f51bf53856192063b712ae04131c5b35af3e2b29772d4dfa8e87c3deb681337d08
SSDEEP 12288:fHvUrBFrEjwaQeHOvEhxf48zz6I7m3DhYf6P5g06CpnxUV2RvTMFgF3nGK8nbW:fPUr+NQwRLQ8zb7mThYfQln82ZTpGq
TLSH
T11265E11F26AD18E5E67AE17D86924619F771B8621311D2CF02E0817E0F77EE8AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5406e25cd1bb87ca533141730e649e57d16c325dda7cd0ec5b0568b54c7fb352
MD5 2c7abe772cb5a3d0b065abbd9616fd31
SHA1 71baaa980f4a35a098d571aaabb1f75fb99061c3
SHA512 8c0b218dd3215be44090bee496134f13c5e73d98ded089bbf153f01b7c937532a9a03f4bd2e33cac64b37ad38a8b2c8ed46604c9c697105f8563e599b0da1ce6
SSDEEP 24576:BD3FHshBIYQgA3RLQ8zb7mThYfQln82ZTpGq:BDVHeBIAA3yIbCTSfQZjaq
TLSH
T1AD75E13EE65D04E4E57BD2BCC6A38A06E67138A9032265CB11D4C1B61F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/428-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/428-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/428-103-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/428-109-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/428-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/428-367-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1620-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1620-15-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1620-21-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1620-22-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1620-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1920-80-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/1920-310-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/1920-85-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/1920-79-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/2792-46-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/2792-40-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/2792-51-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/2792-39-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2792-47-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/2792-53-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3524-370-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/3524-117-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/3524-123-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/3524-116-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/4144-7-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/4144-1-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/4144-311-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/4144-0-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4144-8-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/4144-78-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4144-315-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4288-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4288-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4288-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4288-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4288-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4344-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4344-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4344-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4344-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4408-280-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/4408-55-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/4408-56-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/4408-62-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/4736-380-0x000001E41D7A0000-0x000001E41D9E8000-memory.dmp

Download

memory/4980-309-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4980-66-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4980-74-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4980-68-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5416-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5416-90-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5416-96-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5416-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5416-383-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5416-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6076-129-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6076-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6076-135-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6076-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6076-140-0x0000000000740000-0x00000000007A0000-memory.dmp

Download