13ff98407a71ed059be93785cd1411628f23e6a791a1ec7bb523f013d0519e28

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
Size 1.8MB
Sample260909-bcpy7aam9x
SHA256 13ff98407a71ed059be93785cd1411628f23e6a791a1ec7bb523f013d0519e28
MD5 5aca60262cd2d0ce6d19376f58544094
SHA1 0a85486ff8d1b2d47d5485ba7eda9b70dfd53bce
SHA512 49e57099018c693691c5e39fc14bdccf60a54d6d88c2c8d41e555774b36b38b45e5bdb01bb73f26f9f76706d85da3daf432558f177323cf059ee1d07a576d8e8
SSDEEP 24576:jM1mtPSIwwcYq5sqjnhMgeiCl7G0nehbGZpbD:jM1OXwrDmg27RnWGj
TLSH
T19F85F12DE3A851F9E5B7D13CC5928506E6723C569B70C38F1792199A2E337E08E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5912	elevation_service.exe
2712	elevation_service.exe
2348	maintenanceservice.exe
1332	OSE.EXE
2324	PerceptionSimulationService.exe
1208	perfhost.exe
5016	ReFsDedupSvc.exe
2156	SensorDataService.exe
1784	ssh-agent.exe
3612	AgentService.exe
2540	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5f90a290e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067755e9bf63fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0bbb89bf63fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fce103ddf63fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000060ded39af63fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002173e69af63fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d91b1dcf63fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ba8d9dcf63fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000753eecdcf63fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da05ce9af63fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
2712	elevation_service.exe
2712	elevation_service.exe
2712	elevation_service.exe
2712	elevation_service.exe
2712	elevation_service.exe
2712	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4384	2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	3612	AgentService.exe
Token: SeBackupPrivilege	5016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5016	ReFsDedupSvc.exe
Token: 33	2540	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2540	SearchIndexer.exe
Token: SeDebugPrivilege	5912	elevation_service.exe
Token: SeDebugPrivilege	2712	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3408	2540	SearchIndexer.exe	100
PID 2540 wrote to memory of 5512	2540	SearchIndexer.exe	101
PID 2540 wrote to memory of 3540	2540	SearchIndexer.exe	102
PID 2540 wrote to memory of 5692	2540	SearchIndexer.exe	103
PID 2540 wrote to memory of 2520	2540	SearchIndexer.exe	107
PID 2540 wrote to memory of 2316	2540	SearchIndexer.exe	108
PID 2540 wrote to memory of 3536	2540	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_5aca60262cd2d0ce6d19376f58544094_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2348

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1332

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1208

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2156

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2752 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2752 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7cfe84874d09b94aac1c7e0a7d86d1766d5f1e0af68127da46713de1c59bc617
MD5 0096347d5e426932c54e970667e51c30
SHA1 a70ff70ffd17aee6e2735b641ca077f42158c646
SHA512 ecf89678cfb3f5fcac4e0e6c075e4c0bb65656af8d3a7bbfb5ae90c3708d4df70a588154bc23103d2d1a666b813bda1b4c969a42337ee52cf0fd6bcd69eb81b5
SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZDmg27RnWGj:Q3q6sjBiD527BWG
TLSH
T134D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 37c3801581528358fd9fc03562ba3b72d43dec1d2879605fb711ee083183602e
MD5 bcb64f3dbd92a205bf45053beb2bd5f9
SHA1 92f0382287d850497a32ba5f708a0f641f43e823
SHA512 4ac15945a3c3a68f8ab8682f9f5abc92e65aa598cf337ef5ce1b659b21c47796305051cb218cc7afb9e72bfb74d114b60a500eea9e1e82a5aa76e0958c4be3f4
SSDEEP 24576:DXYfDtczAisqjnhMgeiCl7G0nehbGZpbD:Gtc/Dmg27RnWGj
TLSH
T1D7850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 5c1150a084189987931d7e1d9a2072b7c37e3638ebc2172f7b5a2c9574562798
MD5 383377452bc0bae1aadf6fc876606c6b
SHA1 e2dabe87a9adb29f09f1e31a82489e039ab21f88
SHA512 6545f92b803636017da27da5002c1b844cc867ce45002b671d460b6d947e061fc5259d0a4d8afa4ccdf1a13c82202e538ac5fb2d5956428d7e734a9b652110c0
SSDEEP 24576:T0Le5ji0hmxxrMNsqjnhMgeiCl7G0nehbGZpbD:TPji0AjIDmg27RnWGj
TLSH
T167959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 98503ffde9888a43613a59ffbc4c1e6b8ed086d3b3c173a4c6b16092f33b2635
MD5 b136aa6e12cd01b3411085db36474647
SHA1 c437baa19e80f30105e4af603d8e3902c4a3dc8c
SHA512 7fd670d8bd0b23a92a55afedb5ece464cc7550fa7d23db450e34e0adc428423983e4f46b4f0f04d83eb6d1823e278d11b17c89517269582fda5d51644dc686d0
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyubsqjnhMgeiCl7G0nehbGZpbD:M/ezSC6vUzPveHjy8Dmg27RnWGj
TLSH
T196755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 25035e38e5a2be3794fdce56f84f8de37dbeb0d139d09e3139604c94bc48e345
MD5 5c2ee8d1c131d56d3a01ae00b2116dbf
SHA1 e4416cffffe6dc14b15a39b221a3ec9b71b11160
SHA512 c7d57ad255b417a433cacf2bdf3775ef5f8cc3ca3c06b617fa1126c6c988190b2d8194e87ea096f29ab74b09a9bcd4630bdfa987b28a5d196f97fc83b8d9f173
SSDEEP 24576:iVbqPb88hv/l+YesqjnhMgeiCl7G0nehbGZpbD:iVO88hXl+3Dmg27RnWGj
TLSH
T184559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6d30fcbb5d68d5377a08f7fab73d49198ec65d3e6078f97568957db9de5f3051
MD5 bfc3ad28bf2dcded1ec004a89a17ded1
SHA1 8e82c053cad579be8cfc44ecf68cd8d56579125d
SHA512 e2becbb774f0d21f692d8fc0669f506a1e2b6c894203b76651f0666b8382e142e3a935fe8840bf27ff5a902e11c86c3884db892f437b9cf4001ec57f1ad3bda5
SSDEEP 12288:lLZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lLZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F6523BE824C11CAEA7708B5C3E9F11DAC177E5698200842AA677DFDE6F5464CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f6f95e488b45f03268251c4e85fa4a2ee5eb0499e9ac9ccb4fbd55c8e13e167f
MD5 7be69d31390283369b42a19ef6405fa5
SHA1 ff30ac7b63ddb426abcfc334cc1d8cac6384cc7f
SHA512 89547149340bcb9f2efabf0dc3850a524eb441c3999feebfade7811104c0b92ee9055a30910273cbb0c8f639d491277768d675bbc45f05a56713aecb2b1178d5
SSDEEP 12288:qeBNUbTVO86UGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:qJIUGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B885CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 284faccde6cd302cce9fef5f57b3a305d342a0b3c4ea8a9fb9dfb16748b9420a
MD5 03e79408f1abbf7d95ffafce4812c076
SHA1 d4dd77fe49d9e4f112f310cc4dbba436e8c5cd98
SHA512 01ebdfb8abe3df5772aebaaa5130be21f11e40585ce910a0b2ab6640610b00b1227c2cea60f39cb811f8500f644f8821a0e1acdbfd260a9cc4e9f0c99f193043
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:fQvGAdlCEL8c/DRNw5CfD527BWG
TLSH
T1BE266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 84dd2c66b1bc4213ea1c6315812a5e7ec8a4394af9d6d8fde30e080974ddba98
MD5 193ca7b4cd21336041df2c417c7172e0
SHA1 7f161efad472d612025ecc6518b54c288440094d
SHA512 2feb65b815b502ba1e267f607f49d63c5cc536ca66d61ac7bcba46ed1de28233e2a4beb649da119b35dcd39dffe84e75c813e6616af2b8dad9cf1374e8dca9a6
SSDEEP 12288:5AwSfxL/2Dc3RDLLmt0LDQewsAjsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:q0ewsAjssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED85E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 65d20e1bb0111ee734de2860dedbd8986b3ac5dfa24c23850c039dea6c131a09
MD5 4c0b3d11732baf225cdd0424df572c66
SHA1 6a99d6a078343336f750c638528e5514304fa44f
SHA512 3920b1d3f2d340db76ace85379071cbb0985f274f6018becc591281e237a17d9cf38054ec8b91d8c56fddc20f18a3ff48ecfdb62aa97479cb767675ea59b1483
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHgVQBWG:qUEtQevvqc2W1cpV2tI32nB
TLSH
T19F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 03ceab4525f3d527552d7616765c533970433020b63f016312b03ae9d7abfbdd
MD5 ffa26d4537cd3d9415c1aabfa32ec0bf
SHA1 ab5b80d1d9c8f06f1374b52471a45c369a54098a
SHA512 44af7cbc7453a6052f70526880ec9728ac3d741c4463bf10e3078854baaf9db05011e87fa1e289899fccb43e526ee62639573918d9aa86a95b58112cc4de8c90
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/z4Dmg27RnWGj:joquVjnmTD527BWG
TLSH
T1FAD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a58da939ba3f4a60b7a6e11b9b19fab28535701d1f2d776c3f72102a8b2e4685
MD5 84df93c84aebe094a408537a3a010f35
SHA1 6b1893bf342850168629777df586a7c75ed30745
SHA512 dc1752ce43ef21fb5350def7c16e777c9cb92ab6917ea01569c32b09cbd81d76e46a62b61a8b14c86722beda95cce832ebd111d72e1648d5b17f99400060739e
SSDEEP 24576:oAhGL3IFoiwtA5l7S53PsqjnhMgeiCl7G0nehbGZpbD:oAMUFoiq5jDmg27RnWGj
TLSH
T1DC359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 c10fa9f68fc04e3d553aed648d1661c1d46c916ba9ece904ca1359bedadc88bd
MD5 0d27d214658b777a79cd64b562b239a3
SHA1 ca576d10b649a7d6ea980f650cc8673525af1a1b
SHA512 d6684299e0766175c0d3e283f72438aeef9a948907050ca0dcec2d336b7b674378c37b57af17a41b3ce8f1834b031d50685cf3a5b83b5bbf193fbad8522cc645
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+C7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Nwu4OWgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12375F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 9cd218a46db9109d7df07d537c81d8463c905514cdebb684560e7e91beb522d5
MD5 b030447025b026635ba0a1086c1b6467
SHA1 aece10008e92a606ab7d16a2c676bc840f11c86c
SHA512 f7c8b92afb34dbd7242668fc510ec614d2c31823e6b7269f0be849a9f508ae51c089b6d0a1c18b634ae3cb130f06f7eaafa0b84c5e42eb6eadde3ffcdb92aa4c
SSDEEP 12288:5eZ1Iy8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8Zu1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1926512AE239820FAE5634178C6E5D609E7333C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0ad4019e51d24c5b5df0f3fa7b8934d19ad54e7de5d5c0f6d88751e2e2b02c32
MD5 bef7647d992962e383933a427d8271a5
SHA1 053b9eaecf64912faa6af8d8ed224f2e8b2be3d0
SHA512 e1ceb118807379ba8c2f5a31f49e4628924215da8afa9a94ea39add429edaabcd1fb814204ae09fa07ac712091c2f92615f13faefd68fd439728a9790ebc657c
SSDEEP 98304:CQRQyi36YOcPbLvw2gAf+PN3+D527BWG:ZQyiKa/X+PNuVQBWG
TLSH
T14E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dc8078b1241c907a5afb8596037640490674c93c5d2b70d1fab5cff36a45ccf0
MD5 95b0877fb02272143c3954c368bfd3b3
SHA1 b6acc97db65c43b805bb040c43ec346226af28e9
SHA512 5a16532165a24c1ea53219c4281b0f80a6e9030a2266d386cf99029d8a1e5efec0c838190feb179ba01a79df2d1778063b21608512f8ab31028894ae037c2c42
SSDEEP 98304:eQRQyi36YOcPbLvw2gAf+PN3+D527BWG:FQyiKa/X+PNuVQBWG
TLSH
T1C3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d317dd27cadabfa9cb31483fc9cd8422bf8f04818a2a8dc2033e8d16ca9ecbaf
MD5 8fc77f0519d662abfd33fe3d6e393eb9
SHA1 17dcd33fc4e3ee969c6b54605f1b62eb12d1212a
SHA512 1138af609360a94422ff7db2e254196f26a438a421e966a5ff8caae15091c122ab8b1d3589b4e5ab575e07619d1c9bbd4b2b917a7847af529ee71eb3dbe8664a
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0lsqjnhMgeiCl7Ge:C68Qg55nhceWu7PNU3/IDmg27RnWGj
TLSH
T1A8B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7852434295ceaf974f13b3dd5ebee735f6671b92e88a178a1d0cae828f06c1eb
MD5 3c2133f361e9e9baf301278a623e3415
SHA1 32ce718fe2e27a7f430132d36812aa42b0969fbf
SHA512 1e163b2ae106e97e71363b3e093ee724088d48b05a2c5565849f8f8131a363992e3f7b7955cea6855343f13c15d4770b8a03b339e140f28572c0d745cd807498
SSDEEP 98304:zy5112gYy5azzVvt69nLKnhZdD527BWG:OLIHEWhbVQBWG
TLSH
T1BE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f566bf35aaabfe6de6cd08fb5f6959582474ebe193c51ee3e05d793a00934a77
MD5 fa0a8dd6c2da04ce0b294990b4bf2b34
SHA1 4c002008bd927d14e61b426b38d359ffc970eba2
SHA512 80fb1359324223550d9b03e8c64b6261f7e42e315a942cc1512356762d6185c233bb6af38d78b82defd9ea2904f1d4e132bbb4ae1d701bd76fdd8bfaa527f73e
SSDEEP 49152:xB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glWDmg27RnWGj:nu6Jmdxd2dWD527BWG
TLSH
T179D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7c10fc53e91f78ca8864c244373df47c558d447e820b66fa26a466353d991213
MD5 b5618eaa380caff55ca81bf6418eabe3
SHA1 e01a1c7f2ff6c8dfa203aaf13c7fb2d908b8877b
SHA512 dd5708d9843037e9688e3c7f6386fa4d4cbd38578b91de9c7b671f32fa2ab972da09045bec5fe85f030004ebc95419332799c55f7696a120b4258af025135758
SSDEEP 49152:P1hpsNoJpF1A63U44CwH7R4xqDmg27RnWGj:PmifPWRTD527BWG
TLSH
T14EB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a5d936b3c34479632506898874a8992abfdaeb550ffeafc7162460e9a50770d1
MD5 12c3e6b297f4baedb84ccf5ba234074d
SHA1 8df1a90a4c74391effe2bd5786f3608ec30b1ff1
SHA512 ef58c2fba037d7276f8fbbb5b807bc68bfc3746c1e576d26e4fc281aa0ee1dbcf14370db96474d3f0d03b35d8e1839dfcc5fc0a98805cf87ad7867e97336b59c
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqpDmg27RnWGj:H5dKii61pD527BWG
TLSH
T129C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3ce6d439aa543cad5533ce5dbfc419bca4b2593a517c4ca26208349674da58bc
MD5 8a58fa2c76dc1f4ab751a8d2be970e5d
SHA1 59a22d326e918c5755adadec335ff5d403acc308
SHA512 c7efbe57839a21dc59d6145a501011d11eb5e6846c9cc9be2e8c0a991e54082e318a5d25d74de3b6a6ec8a33e8e74e950a320efe409b80fe19f0b62b91da1749
SSDEEP 49152:mhtSn8EApI0fig3giDn0AP5wmDmg27RnWGj:nX2imphHD527BWG
TLSH
T17895BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9c7668c054cce5a5743d19723438e197180d5ad3a93439fc59c5b5c4d38d8bb1
MD5 006451c2113f340e90b543e5484c8577
SHA1 aa90e968e47fc4de9550922b2cbe31026b4527e6
SHA512 81c45b2b30fb85e65670d8184050ef9a4dc8cc04c36908a715b661bbadd0931d887ab00529e30dabc5507d65571cdaae0aeb1f7966b6f9a11d1d34d347fc8b18
SSDEEP 12288:lhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1266523BE914C01CBE92648B5C3E5F14DAC073E57E92004937A5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 80ca4a330fb970e3eb37d9bbe3f21cf138209f4e9931de201b182d45b2efde1c
MD5 89073be1ac1cd6a8fda79a10248705e3
SHA1 064896c455da2385af4184a6db42da936fdb65f3
SHA512 8bf196e6ef81ba5860348666c3df41d729e4fca6f8930d64c6afd46e9bb23584dd65c9d97b4190a66edcb78b11bfa8dcd9dfb06088c3ab6f5cf448a7644baeb8
SSDEEP 12288:t4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB6523BE914C01CBE92644B5C3E5F14DAC173E57E92004937A9B78BAF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 24fec69bbd581f33f9f81478ee3d60c75dffbea6e714b0f4935aff73ca077bbf
MD5 47a379171d09bd40fb9839d9ae0d0f6f
SHA1 5b39348eee23dd32587915350db82b4d21c11d40
SHA512 de1f68792ea8539676746ee1ec10a249edb24918476b68b53b7da8e33749c2ea7c0bf6daeb1464194b8155c9f956d8ab9c78397de8a94b0d6f11c361530eeb04
SSDEEP 12288:mOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E6523BE914C01CBE92648B5C3E5F14DAC173E57E9200493BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 5c386d6f32806e0ba1ce835a7d8c58fc2902b3865c89425e8b265f3f19a4d8be
MD5 d74de22c2822b7f18f937a4a5c96182e
SHA1 03e328f944eeb5e1d52f6a5ec42e7fe89157e329
SHA512 6b4a434008f375ebf4a88e19a19f8c5f11d2f15c9df2579c45b5153fff360c33e771760ae52dd63a6486d0126732f530afd7242c7f3383a3f9fd12cf62c25f6e
SSDEEP 12288:cVvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C65236E535C01C6D83285B4C3F5E11DE8277D56EB3005DB6B532CAEAFB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 7619c8b85977ad6d6c16236276051cf01f886ec120dd0c517ec1402040e7871f
MD5 3e044b185ab9399d7a908d80647e3e05
SHA1 aced35c8a1089c18520064b2705cdc1d258eb320
SHA512 9c0f5c0d4afee679c871ab9d16c82c34d4dc8ffa04671a29159b5f8f781bc6b7fc68ac95ac1f7a9ce2c77af78e077324919513bb269e018bd3fecb990d6e6842
SSDEEP 12288:2nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1706523BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 359138c96bb248ef57e3821d60695deecebeb77b5f509a86a8e805032cb8e2b2
MD5 e24e8ca72777a2476c08bfc3786db3a0
SHA1 70eb42fca654e417c6e32516645769ad377551eb
SHA512 9f43c152f4271565b0370433bf96dc94b293db150d0fa625b8e31a8738c9aad7d056bea957d31562f4f1c15ed89b3df42d0cda0e9bb8b86431b8494d71ab4cb6
SSDEEP 12288:ZUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F16523BE914C01CBE92644B5C3E5F14DAC173E5BF92004937A9B78BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 79dafde9e2f959e07776b61aefd776d7c5a203ff3426f0629f3223e6f07b2cd4
MD5 219e2b88d307600b2782aae5681c1ecb
SHA1 f571ee3144417101f8b9c0451fc35d7a4e254909
SHA512 5d9d995b4ec143d7108eaaadeb8b2038eff2192b43ea7b3e3844073c6a5fd0104bdc81af73d3520823224386efb2f114785748ce38481309a1bc2df4ae78dd60
SSDEEP 12288:LQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B6523BE914C01CBE92644B5C3E5F15DAC173E6BE9200493BA5B78BDF7F24684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 4200a3a15c6a7a73f78470f292dd65c45ebbf9e51ad74dc301a789373085ba52
MD5 eb11af668244b7145722a10c5d37788a
SHA1 c08cf0b680f3680b77f90b530d8e198e4aebd491
SHA512 71555c22683314a111852b4b91e1410fd473530906be4f7f88432d99f6a57ccad805711e7ff86b89d0892e2feccdf2fc59a5fa4a58db7db9fb9fa932bd4fe8e6
SSDEEP 24576:uZMRzFVSOYsqjnhMgeiCl7G0nehbGZpbD:uZMRzfADmg27RnWGj
TLSH
T1CA8501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 cba23be1a77e5061cecbd14835d21c3ac111852fc37d428ace0727e7922a287f
MD5 c1cfcb63ad1008d23aae2221f4ee34e0
SHA1 966ec197bf5b8166ab02e46e459ea4c8dfc7857f
SHA512 0da6fe2aa76f3c166e3d5008771f47a4076047c0d90e154093cda8078d1187158ba88ce76479778d126776b00ae255d6f2974dee553ec77563c8c14bc7d85e59
SSDEEP 12288:PFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1206523BE915C01CAE92604B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 dc083851eb6c679506b1bb33e6574358f68b8c31ca56816224f94a6dcbc4a435
MD5 fd75d0255859be580fdc050cc88ce83a
SHA1 98a78a0bac2e2cbdd7ef4cf4ff83bce83a6d242e
SHA512 71c5acf715502ae7312b120fcdb7d707aa552cbf5b47fb5e0cc442591ca15581f06cabf36d24140a95479d629e2625dd562c571bf80b2d3d29877c7bd7b5d7e7
SSDEEP 12288:hpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF6523BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 1cfbd9cfb25aaaf77ebab32c8185b0189c1e02d645b7e456b8d5de51cf475fbd
MD5 ac9312e622c47716716ad4e7666a1dbe
SHA1 0c1c53508f7368feda797a3d7c60c4ebc7cacf53
SHA512 c26cb117ddae7e5078936e286555b3c864099a7806161b74d492105ed291f772cc278e7a82ed1fab1b37b68068881e1d90c9c44e437b5f0a8521875f308caa29
SSDEEP 12288:WyPz5L88Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rzy8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B775025B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 07a8a9528765779cbeb16f86941f8adf25cc7b83ea130c30413285ca9c23529a
MD5 ff93432effaf2b252193b7ea33fe5f43
SHA1 9c5d1c01e9c21385518815718f7dd25d69106259
SHA512 c938f0165f24803c28b01899a1323dbb465df748fee81c4e05b8b9cf562b8491c7aea7d0d25d13e5e41c5c881a9d1efe2f311a122bf971ce70659a3445e85881
SSDEEP 12288:8FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E6523BE914C11CAE92604B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 344271a4422edf145770e5f7614855083215a011f91c6a07c9f9cd0028665646
MD5 5ad0b16d6d904f802219d0acf552b89c
SHA1 7391a050d77cf8265dfd860252aef57758a4f005
SHA512 d5ce8b087bf52486682428c4f4c730573494071a8283816542d91845c60c06f6fb51a50f98a7ee64ad914ce52e2c1f9249bf2042efc2d6d66c49027a9d1e6d3c
SSDEEP 12288:IFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C86523BE914C11CAE92604B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 5058a67134d2023fbb9dec64a23d2886b9190a08f77894c2dd59e37afeb8244c
MD5 2a036a8a6019f94ffd78aa1b1a21a170
SHA1 5ad7a7cc93db48584fb4907dd99d88ad1fe28c88
SHA512 bbc9d2e039a9722e4c3be35e6f8cef1fd0f15afea497155fa52171c8f5707669470027f8db2b899597e749c4f524c5ae5fe895120fef55e8838adc27425da3c4
SSDEEP 12288:fyPz5L88Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Szy8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14275025B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 830c11616fd2702fa74fa3decb023f8d216c6ad17b9fdd73f38a891e79630892
MD5 67ca3580b6732b0c0ac9778d7294a2fe
SHA1 7b04d7de9da367f00dd978c3a9a7f1772c6930dc
SHA512 aed540c05c0618466a4409655cce7db62249f8fed2c17f252c6e90fac7324c9a2cf240f84c699fba312e2816529920b2c7734c90dc76647fd73ff128bd277ff9
SSDEEP 24576:sTDaLl3z0zD+sqjnhMgeiCl7G0nehbGZpbD:sTuLljPDmg27RnWGj
TLSH
T1998501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b4812bcae1157e25800f452419af29602b85d8d31ffc6f7c9d281ea303d42849
MD5 6331c1a04ffe5e9c0bf15f5a159cb625
SHA1 0e78501e5a6e42947ab40ee68046a6ae01d2149d
SHA512 7dd07aed825a6f13da3261f4c061a8dacc0e372bf626e690967bc0086dbc224681a8243ebfa7e095dc3e2f2b602f57e2f1760e7ae86447e9f5cad9a50ff51e98
SSDEEP 24576:s3vd9CHKy7GZKsqjnhMgeiCl7G0nehbGZpbD:Wvd9CHKyaADmg27RnWGj
TLSH
T10C95CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 d97a310cfa520d5ca26eb5bd69dabbabcf93e85466c9699bb81298856cd8599a
MD5 cbfaf0a2e9275e2629eabba523a93c2b
SHA1 ca77bbb854bcdd68619daf6515aa8905c72d8f11
SHA512 8687dd126ad45f4d50328d2604e9264d3febe9715da2e4466fd50f78e0d0f8cbe12735639afa1a18edc5523452d69641e54c4d92fbd8c4cf0bb659b6c3c63b25
SSDEEP 12288:HuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B36523BE914C01CBE92604B5C3E5F15DAC173E57E9200493BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 64ffd7032cbf510750daf660cdfb2b0194c79e0eac258092e47de6a60c2f686e
MD5 db692163115bb8c712d84012dd4ad566
SHA1 810401068f95037d2f988609302988deb404c9b6
SHA512 a0cff80b76e5877a18ccd1467b58ddfdcbf9efa29f9d5142ddfefd529c7a396e18feadda64c25f17c9503b595e3ba227e2a02849448b942816f27dc4388615cc
SSDEEP 12288:ZcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B36523BE925C01CBE92644F5C3E5E14DAC073E57E9200493BA9B78B9F7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3f0f0cf94a67e45beb5ca0b8e4ea6939205bda1033d4c6aa593129ead8bc2d70
MD5 0ec48a56377aebcf4058d19d9bb701b8
SHA1 a585c666c309d802252c5540c65cc107b64d173b
SHA512 145b28a2f3e35f8362ad913b77aaabf6f27b2a279436f303f2726474ca9165a270f443ae93f3ac9a9ce4beb6aa399855dbe862df08a985d7bd5aa90e3a455770
SSDEEP 12288:pTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1476523BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA5B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c60bd26001f6ffe6d57e97ac75952a2e1f972d915c3675a15cef2a414eea31e5
MD5 46a2afd7b9d9c30b26a4eee7b666eac7
SHA1 4484e66c0e791d7c11be04582d873776bc6fb996
SHA512 6114169fce7fafa0cd761469ae94e31dd680cc5958d07d45d0161909e6661740b149cd47ecca1ddd2e766ab395f6debb20d714d935303340e4efb77677cef94f
SSDEEP 12288:fFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD6523BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 7eb98b653586df73c159caa854edab75d346fb62083fb3fb1420753a96299d86
MD5 6bd2ef03dbec4e0d3921f3227df97ec6
SHA1 db65c1639f5e3b69908e91093cde8b5a106d87b3
SHA512 57decc02d13b24fc254130b4a942a1effe0c35e71a5b14c27115f1c78886bf22904c91d2397536b843d8298c4a3133b067cb7e172783f5e2d5446b5a05d09900
SSDEEP 12288:1uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1usqjnhMgeiCl7G0nehbGZpbD
TLSH
T1006523BE914C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 64d629ab9d16c6820246391a57586f1b4fe4b5d611f56c552182c384fa5e0c46
MD5 3464d98769ccd87dc581eb7f4f5ff8eb
SHA1 90aa79ee450cff5d351c704150b29fc480e0bccc
SHA512 006bc0459a329ecfd0a20bcb26994ac188661edddfe38792e58449fee7ac39036a0c77ae415d99735593010abebc5f794ff396098f115fffc7bf7843154999ce
SSDEEP 12288:89Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:89sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F6523BE954C01CAD92644F5C3E5F11DAC073E5BE9200483BA5B78BEFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 6313ee287347eaba6139817a6e8f6a6e0aad5121e11a9d0175e6b0466c7cc9fb
MD5 9474984e906ce0f7186ee079b4392427
SHA1 4a0f7aa95b84f0f8ab6f263c9b12515288efbaa5
SHA512 d8e0bb216cc1f767eb9825bf77d9beb2f1f5825fa3177d0efb740e2055fe4c084edf0d14e062914d8f247c2714a95f9a6526ff28fc4d2631b6253e51507575e4
SSDEEP 12288:AnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1596523BE914C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 764694024a404559ea0db9cb3b57c3b01c4b1a605b5f95321046e21c35fa8e99
MD5 331b5bd49f8bc3ee17cd72df237e86e2
SHA1 4b16daac79aee9fa0a4c305f551d04a5397a59e0
SHA512 5be819c5512dc0cfc2c59587bc9fcf75ef5eadfd65e19febe200f87357fb378caf5cf30d80d344a620236ebb2389fadafc8b432f4be45ee547f12054c2dd7cc1
SSDEEP 12288:AWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1226523BE914C01CAD92644F5C3E5E11DAC173E5BF9200483BA5B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 10e3c1ba91ca9635d59b8009414e44252e56a80f55ee9800b6646d36e1261510
MD5 c828a8afc7afe8477baaef996787f79c
SHA1 e4f753dfb16387db3b062121fcb8fd4c5627ccb5
SHA512 a69f48974eb5af9916e86a4f6e8e83836d6ea2eb37f9574b4625497a2a6d0c6d56d74a13f8d5d5701a8081ab5c58e45322d351bb4811dfad46a3ac7fea6ef784
SSDEEP 24576:QfwvUk9RX6wkyAI5sqjnhMgeiCl7G0nehbGZpbD:kMnYI9Dmg27RnWGj
TLSH
T1B695D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1b67f2dc5426d39bddff71332bc1121b148ecc43b53b10755a13f1d77817b52a
MD5 d0617863b431675e3880a0e012248605
SHA1 2966b5da1f3b1e468539787fba5416efeaeef407
SHA512 d677b3cd0212ea1e84daef36f952e73a9490dfa4a7559e67d65273c15a590f2ebb0176bc9ebdeeaa2a2bdb6327d6b5ead6ce3039a47b0958abd15019112222ed
SSDEEP 49152:OYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GDmg27RnWGj:9ySzPeD527BWG
TLSH
T107066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 696377bb20c63a2c399555a4c08c986195892010e173b35749cdca8294d75a33
MD5 d5383532b96674c5e1a3d496a21c869b
SHA1 14a82fca51c40b4627794c5f3be34351a500aeb5
SHA512 d43c06cd50a59af58ab94d25986a5d92d798076d51184dc23e2e8708f303bb27095db2cae90a129da3822beee62431d3448db492a857eb67598c198cd8fe8a2c
SSDEEP 24576:m47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYosqjnhMgeiCl7G0nehbGZpbD:m47JUQjTirIhCnDHUPfF/WDmg27RnWGj
TLSH
T14A65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 3032ca0d14f7eac1641fe054c7f01daa03f178f719266ad4b09b3062cc9d89cb
MD5 959069a97972344bc3590f0fc00a7313
SHA1 89711963a84be39d088a5bdb53c762fe9f9773e9
SHA512 87cae0d626653822e09d5fc687bdf9c459953fa60ef2d0798aa209d71bb658eb9c1faf927037ecf2de6b2a786e2159f439575df9ca621dd300869a27c10b75dd
SSDEEP 12288:mbsf1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:N1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF75015AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 9dded4ecc3890ea36433efdb7ec191b1491cb3e005e362014d3edcbd365efcb4
MD5 4d9f4b585533530e810ed61ebc5a2f18
SHA1 06722d337b512c0743fc066cd2dd2362c30640e2
SHA512 007334500f05d9cbb9d7f8517e2d826e312ef3d7bed2de4eb9dc0b16213160a9d293e6dbf448e61e7e668261e040feae117c0bd37d0be7b058bd05b63c6e4e6e
SSDEEP 12288:K6zx+WU3fya1Sr4Y7ral3oTeacZJP33BBF:K6VVUPVQU3I3cZJHBB
TLSH
T16B252950766AC75FC6A940322E33C1CCAB707D41FE059B0372C8972FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1ce4847096a6b7ba5c7694620bfb995ca91af64dcf1ab3c03901515581e9f5b8
MD5 f46e24daff2f4fb2e4df26e1f69dc91f
SHA1 a544777413d624c32d33f869aa4d482e3a064a08
SHA512 c0414a19fd71b1ca823f86113a865d1e07a5d897fe3c8b632d1cd56242818a415570ef93fd5da64894909deb89a2a90e107cdb2de302419191158fa273a68705
SSDEEP 6144:nT9DMtpHCJYAXzDQ2ZmsHOSmBQ26tMx7MEDT26tMx0HRHXXtYKOVFIf+pny2:TJYAjDQ2ZmsHOSWHV4KOVFIf+dy2
TLSH
T19865D6815437A3DFC1FB6032132A9B4CAB64AC0673496F26B3C4553ED82AA2574F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 79f378e43f1f3b8b17b27d910317056877fd9b1766913841593b8ed85b1d3573
MD5 fb1c219a43f4ae0ed5c774201ccac303
SHA1 6d019dbdb79a5aa7cc22e3a0b501e492f6d61ef2
SHA512 916d999d91bef04ec1963d5f8ae65b6e771c6a3456eed91138f5671faf8cde6494793a67c7e969a08ff4039ad41c73af683b64cff1e7270681b6f1e7e646749e
SSDEEP 12288:Q07tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C6523BA934C118AF83605B482E9E12D781B7E669F2044C3BA4779FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 552fc787501444038a34c6de056acd38f488433fb68ba854154ea81ad5fe0878
MD5 71bc3629ae657a6d72e82f628b77d56a
SHA1 d3c0800141ebd0dd337d97bddadb2721e13314e5
SHA512 324dd53e16ce047c1ec68ceeb4dea17e054bf0b9cab62c87949ec285b87f382ce87a208b6eef24b91f013adf6bc539cfcafd16f7384449dc2f547739299df8b8
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYbsqjnhMgeiCl7G0nehbGZpbD:Kgb4mBIBhGFUDmg27RnWGj
TLSH
T12C659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 46f1feb8ff59ae91d678845cb85b71159d5f9eb4b96b529a6b37f9d99a0a42a3
MD5 1f6a7cf9aad43cddbb19caea1fe12a5f
SHA1 ee443372705f837a31a1f017c073e9ed74a2beb6
SHA512 d8749c6e24235166f5f894adc64c99690196c8ef0020f94f910beb955d73fb994ea5a9506d95b91a41345410a6d7d3540cf9e9da09dc6b2d67c1885a2fd88578
SSDEEP 24576:+G88u8FpJqH1bzria7/mYsqjnhMgeiCl7G0nehbGZpbD:V7ZFPqVea7/3Dmg27RnWGj
TLSH
T1FE95F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1c012bedc0a5ea3d815f21e4541385eff571b610ccdceaaab7a8dd1eaa74a95f
MD5 771ce2af624f4fb6404f3e7d0364413d
SHA1 0dfde8e529c2ca4936d6d4ac4bedada8fcf7e3f8
SHA512 32f8cd74223af3c31519cf94d50dd4f41d8e9601776d275a404df1a190ecd49d47a5d515fd410de4092886eb2a4b05e11b7d0cfe660c82e757572c7db9971e24
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwDmg27RnWGj:wG05lO43bFD527BWG
TLSH
T1B8D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 adc83e4b9e593312f2fe59ffe2a948881208d8d744db4dd6be07b1858c859322
MD5 0887bbe93b8875a677f09e39ffb16acd
SHA1 d84344bdd3ada702522e2ad32805354248c85d3f
SHA512 66c23845bf1346759b878d14ebc85f99989bdea126c06a49fa8968d4ea49d9de8e28bb7834fedc1492170008ecdf457e4ff96e6cb083bef43e9fbf142abc9319
SSDEEP 24576:Hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnCsqjnhMgeiCl7G0nehbGZpbD:/a5POZ3BJt2pasx2+mIDmg27RnWGj
TLSH
T15265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 abf0e3d9ccd43a19e0f97570aeabf1fb0d7148c396ff2cffc8cc97bbc330ca81
MD5 82d6fa308e72f32780a7c2f4fcc33d54
SHA1 03335fb87a71c3f9169e419200f3520b37156b3a
SHA512 531ca11180e130c021d4623af1825dfe28851444d391a19803d2267efb5d746e9235fc6c372f033f563c7e2583b6160e0618468633962aad89bbe65aa7da78d6
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkAsqjnhMgeiCl7G0nehbGZpbD:nNc/zEOVHFXDmg27RnWGj
TLSH
T13F858B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 22069b142d2a31ed72dd61967a25271909ad6d307e9826178bb77e28194b947c
MD5 402a0ee00c49861cbc6aa2dfc0ccec40
SHA1 079e5e13eece8bd10af1f4ba506c1380bab2419d
SHA512 2743caf72ff861b718ef84c4547d5c443693f2a03e9af5890a8d307087538471a058725f3815a8bb6bd4265fc5ad06395704ccd087928a73bb99cdf1d6ad84dd
SSDEEP 24576:pTkNvNnaFeYhJNtmZBmWsqjnhMgeiCl7G0nehbGZpbD:pTMwBtOmaDmg27RnWGj
TLSH
T1AD55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 fb4860f2eaeb04fda7c7cfa910e5b36dcff1eb2d02c71ef4850c3e5a04bee16e
MD5 fe20eb0a40650f8f19a4279298cff45a
SHA1 2c0cca6a468cfd06b3d1cebd7a635fc350fe3de8
SHA512 73284df89952d058a4c5531c5cf27def14a4ed2821835c06bb902f6b55ca827950c2808d719bf9461576b581829f231fe0f26d7022b734b821e587daad9b00c5
SSDEEP 12288:lHvUrBFrEjwaQkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:lPUr+NQksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B075F12F62AC18E5E676A17C8682C70DF6727862171192CF02E1817E5F73DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 8116ed66ff2b186d966b5d9aff4b6990ae0cd981ab2f3bc7ade2055c4bedcf2d
MD5 0217dae55cd6ca57461b17f76c418b0e
SHA1 35e485a911a1435bddbab257ad9df901a19be0fb
SHA512 ea0f4acab4432417b4883dbe43c4b1314a34c7ef07616d9a887f985f3d9078e18cdf45fb0e51376421999bed35cb35dfaca42f312ee4d3c375a31128015d76a8
SSDEEP 24576:pD3FHshBIYQgABsqjnhMgeiCl7G0nehbGZpbD:pDVHeBIAAVDmg27RnWGj
TLSH
T10F85E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-76-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/1208-301-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/1332-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1332-54-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1332-52-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/1332-274-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/1784-113-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1784-105-0x0000000140000000-0x00000001402E7000-memory.dmp

Download

memory/1784-304-0x0000000140000000-0x00000001402E7000-memory.dmp

Download

memory/1784-107-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2156-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2156-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2156-93-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2156-99-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2156-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2156-305-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2324-66-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2324-299-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/2324-64-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/2324-72-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2348-38-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/2348-45-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2348-53-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/2348-49-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2348-40-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2540-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2540-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2540-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2540-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2712-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2712-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2712-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2712-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3612-124-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3612-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3612-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3612-118-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3612-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4384-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4384-0-0x0000000140000000-0x00000001402A7000-memory.dmp

Download

memory/4384-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4384-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4384-79-0x0000000140000000-0x00000001402A7000-memory.dmp

Download

memory/4384-309-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/4384-312-0x0000000140000000-0x00000001402A7000-memory.dmp

Download

memory/5016-87-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5016-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5016-81-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5016-371-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5016-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5016-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5912-21-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5912-22-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5912-15-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5912-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5912-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download