2e981b82327607a26129d9040e951c7b42286b67b1798014d0efc36729404312

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
Size 1.3MB
Sample261002-2nxfhsvbpf
SHA256 2e981b82327607a26129d9040e951c7b42286b67b1798014d0efc36729404312
MD5 f1e942daac8010a26a7efed8f49ae67a
SHA1 2e2154aad4451dccc33f086c09387e34163c067e
SHA512 488470694557f15268d268e3b8753cd52c97bc4b537af1f09b8db9933f427baffcbfa4440c1493d73e42cc513f6309db6840221d23fd6fe49c1d17b8cc22fdcf
SSDEEP 12288:PoQJvNRhhcNAhhba43G2LdnrO+12N3zhPAXruYyVHHaf4HJ1jwssawsUoN9PqIl:plhBh8H2hnrSN3zhPiQnDJGaz9
TLSH
T15F557B557BA446B5F0A28A348A65822DE6727C50DD33CE0F11814EEEFFF39518E25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1252	elevation_service.exe
5756	elevation_service.exe
4168	maintenanceservice.exe
5892	OSE.EXE
1320	PerceptionSimulationService.exe
1680	perfhost.exe
5060	ReFsDedupSvc.exe
1888	SensorDataService.exe
1120	ssh-agent.exe
4164	AgentService.exe
1004	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
	\??\F:\	elevation_service.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b8e760f13ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf1fd69ebf52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002531c1dcbf52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d1851ddbf52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037d92d9dbf52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d27c8fddbf52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f82e3dddbf52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037623a9cbf52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1252	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe
1252	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2964	2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5060	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4164	AgentService.exe
Token: 33	1004	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1004	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1004	SearchIndexer.exe
Token: SeDebugPrivilege	1252	elevation_service.exe
Token: SeDebugPrivilege	5756	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4876	1004	SearchIndexer.exe	100
PID 1004 wrote to memory of 2568	1004	SearchIndexer.exe	101
PID 1004 wrote to memory of 5536	1004	SearchIndexer.exe	102
PID 1004 wrote to memory of 5792	1004	SearchIndexer.exe	103
PID 1004 wrote to memory of 1740	1004	SearchIndexer.exe	105
PID 1004 wrote to memory of 5376	1004	SearchIndexer.exe	106
PID 1004 wrote to memory of 6024	1004	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_f1e942daac8010a26a7efed8f49ae67a_icedid_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5756

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4168

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1320

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1888

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1120

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b9fcd00c4e2f402c0b67f6ed080a3f29636e9bfe433235b706284b8fc5db0f58
MD5 ec661c2f6861ac586ce044e31eeefbd0
SHA1 4665835c60a37448818bd7cee71d0e5d185579f0
SHA512 91018e8b47b39708b9fcd9118ac5b4bc7d1ed9c8d47dcdf209b0875bb2ae944c70e1c47364f825bf759aebeb8aa73821f7bb18c044b393df0af157c45f3b26c1
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnEnDJJh:M3q6sjBbDT
TLSH
T1C5D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 8ce47ed5265f13dffa11af11a41dc1eae8c6f8c0081a8301c5f954132ee6a1b9
MD5 4e772e56f99bfabfc55ae4f45284ad59
SHA1 1aba46b3869c9be5aee1ddec96e19fd194de4f6e
SHA512 ca1c8ea642923b69f605f351939cafe94b6b18ae5621b88c10d15a9aaf47da64da8861481aee3881451cef9c4fd91a7bd4f7e38e571387d0e4b83412b9012846
SSDEEP 12288:G1XLsswWkxy2lRq2czAbPAXruYyVHHaf4HJ1jwssawsUoN9PqIh:kXYfDtczAbPiQnDJGaz9
TLSH
T15475012967E508F9ED67823DC9A1C502E632BC9547A0E78B03E499761F333D41E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ebd4422008590dea6aa25de83c4c509d831c3b696c0f52fff8a13e10d5a5bbf6
MD5 9efb7190541ddf9d623f946047416521
SHA1 b0a9d9baa3717c42699156bf1f5b5a8ef5674f52
SHA512 b54667cc420db3df5d5faf13afb0d7ed38e914610fd93a100eefad8f7c791c96f8179d73878715b81412cafab112727e8ee705f948dd73cdb6eb5824703b4f8b
SSDEEP 12288:aXZNYVLeyUji0h90ZD0wxpGZIVu2rHsOPAXruYyVHHaf4HJ1jwssawsUoN9PqI2:O0Le5ji0hmxlrMOPiQnDJGaz9
TLSH
T1DF959E16F6748331D073C0B9C5D2A68EE97134865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ed7ce9de1708533441258e09c3fc0cd69a20acb987b9a6b0cc192823c6a19f0f
MD5 0a82b81ed5d9395985098e42497f1951
SHA1 59db2d2d9a0a8a61a3fe56f6acb15dcb73c3f14b
SHA512 67bd08a64b34041874833bd0f282c547c1f54ad44e26e65825144dde0ed2e81246c285490fb43955b1b3d2d8cf8873e2ddcf7cc4efb36a195053ff35ed156506
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyu0PiQnDJGaz9:C/ezSC6vUzPveHjyBnDJJh
TLSH
T134756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ce6a3eb5c37c2ec359be5438b1ac867a3e75e80682c1b07677fd062ce1f3ac03
MD5 adb19dab8f3e2a2d697941246b45b5e4
SHA1 c568e38be25ac4ec51d3a41e7077a273d984dd4c
SHA512 2227a6305f014a43a9e13ea8c42679bfe1ac505694b3871490433366488a91b4585307df0a7eb200d859c086e692c85043329c718a37f69f962b665bced3fd51
SSDEEP 12288:IVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98/PAXruYyVHHaf4HJ1jwssawsUoG:IVbqPb88hv/l+Y/PiQnDJGaz9
TLSH
T1AD55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 2517f32d94a75b2beadf24ee1a2242905ba357e0e45f55a7e85b67841bd1e667
MD5 2c2c313f2218c0d6346b9bb226127ed5
SHA1 1896a5950e6c68be7c978b528e23aaebe12a9e43
SHA512 537c1a01398a31da2dbb7e82246ea5b0e4b24a10921b86752e058fa39d943515ce59433de19b7952bd4916299af093fc943dbef1ca302fe558b1ff0f41dc942a
SSDEEP 12288:8/iPAXruYyVHHaf4HJ1jwssawsUoN9PqI:8/iPiQnDJGaz9
TLSH
T1B9552367CBAF5051F30E677AA6C8F4073038BFA4ACD4E41718697E7B29749309DA2913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 390d9aa7e479d1839ec40903d931122bf25b1034431a2105f99d39e1f799a296
MD5 8662cd2d56ae022442c71b7e714fcfca
SHA1 87bcbd25628f00373db1efd520e60a3059ad1204
SHA512 ecb69b10bfa9eff29ef2b16e15b4a549a394d3afcfbe735b3c5f4040795e86ecc556e0e08504e56d439831e46e67b6b2286ef62f20d52fc715210f756d32b338
SSDEEP 12288:neBNUbTVO86UHPAXruYyVHHaf4HJ1jwssawsUoN9PqI1:nJIUHPiQnDJGaz9
TLSH
T16275CF3BEE28FCD2C27E9DB95791C600A77278704F61A3CBD165820E9E235E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2ebffe4ebc39bff735afd70be7017b49507e7cc4263b1a08035ae1d810407ecb
MD5 5bfda4751fc4fc3a8f07cb7610a4999a
SHA1 94b9905d21544a06bd16db515513c38ce418fd92
SHA512 08bc0c3a1cd071bf586fb55931fb00155f600206fa93a0dc395d5c8d1cd48ee52cddbaf4289e9ebabe8e6de538723e9d753c3261b0440e8cb8a065939658878b
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:pQvGAdlCEL8c/DRNw5CGDT
TLSH
T1A1267C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a14cfdc79c37820765b627d681376314214c03be0620e94d655b0b69765e4afb
MD5 4f6c96461f7b20528ce0a548c73c26c2
SHA1 0121ce6e98672a5942149a252f15441fbb5f278b
SHA512 9c55dd08edbae76ec47267ce5bcaa882daea7ea512bd481fd3d42be4185ed88fb96f767f3142361dcdd155608cf634fb08b435b3781060a35da961abf0a67dad
SSDEEP 12288:eAwSfxL/2Dc3lDLLmt0LDQewsAjFPAXruYyVHHaf4HJ1jwssawsUoN9PqI:DQewsAjFPiQnDJGaz9
TLSH
T1F285DF31FA75E032D37B0DB61B65D706143CBE604FA129C3E3A89E9E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dacfa95dfb229482f3a6e13c232b3d65e4c537ec5694595a9c5301e7e845d798
MD5 0fdbcd8996df4cf2e514639c080d513d
SHA1 2149ce3f918d795790052f04dcfce1c542147164
SHA512 951a13a3b557c9be6f3ec24e9e94cab3a63ab75beab02398c59879b30c597c88510e871ba8184d0559e435d6d3ef2c21e66d320992001fceeda901f44de45ae2
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHx:XUEtQevvqc2W1cpV2tI32
TLSH
T1CB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 99cc5389685ede57d0f37f577fd6e6acdabd8506aef1ddec0f5b3503d8913541
MD5 72a1524dc952947bd1e3e28b98f1259d
SHA1 0bdacb0b966bf4674e01d8fa9cf26da8b9bfeea1
SHA512 0159f960dd6accf9b1d761153c2f05cc3835a638ceb5c58b4b670d0a13ed5cba3055fa25f07495c78c0173f70101e11bf8147d3d191243dd3cf4949c37e8924e
SSDEEP 49152:/CbRquA/m2yL5zTfFiV+XenmE3/zVnDJJh:YoquVjnmiDT
TLSH
T183D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 af617ade47aa5a9119e5e8e25b96854e14965c6194eeb4aa0abce8985d77482d
MD5 0d24c9c284e8d52284b5cb69b91ec877
SHA1 963ab1cd7970fec5afb7027ef87f9ee94fba235b
SHA512 84194771a22d22d19c38e4c900eae714bd679901b6953ca5dc5cf2a47d3d9a3c81550d0596591d2cda7b91487bc1cc7d9e889d244b66b261e36f5f6ecac5f821
SSDEEP 12288:FAZ/GL3IFoiwtA5qy97S9uaYFLq3OTPAXruYyVHHaf4HJ1jwssawsUoN9PqIW:FAhGL3IFoiwtA5l7S53APiQnDJGaz9
TLSH
T16835AD81EBF945D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4227ef345940feeaa89ef4d84d0c095ced765478bd17c5ce8b32a249a8bc3050
MD5 ce49c82f13346873057de158bbcfd09d
SHA1 d7359de04755926ad24d6c5740f21e5bea6e5b45
SHA512 c096a7668c4ff2d413e6bc4455cf9c1ffb8362b3c45957dfed89ba0e26fe2ad8c465efc7e9f3b0819d7110c21657c6bbb6f09129afc1a255a952a9c117494004
SSDEEP 12288:Mmw5HEjsChNZBFgl0WDm+CUPAXruYyVHHaf4HJ1jwssawsUoN9PqI9:pwu8OWRPiQnDJGaz9
TLSH
T1D975F14677E90CF9E6679239C687C136F7B2BC112A21D71F1760C65B6F332216D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 c49796f93c15ccbef22cd3b4a900184280cbdb439bc558d7c41a96a83b411096
MD5 33bd186e88b5a01353713c3db9300c64
SHA1 fa7fb1453234ca0f098657fabe56d12ae6af3bd0
SHA512 204f3a11c1e049f59dbfd239cd6f5d74fec8f5c969e81f916dad7d40e0f575dca0c9b61b22050e0e65b4860e2ba207ec3135cb4c4b9f6e6b13387fabc6c73df7
SSDEEP 12288:oaZ1IyVPAXruYyVHHaf4HJ1jwssawsUoN9PqIw:lZu2PiQnDJGaz9
TLSH
T1FF6512AA23EA20F5F397533DC9D49506E3707CA26B7183CF1524566A2F32AE11D36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dc234c48627c99dddf16098b5de2a31decbeffbd27ed62701f91d21844267aa3
MD5 7e3f3d4d8bb54812dca3eb677225cfc9
SHA1 fe6b7e34bb795c426e570bfbf263083f9dd29324
SHA512 f1322412ccb10acfe08058d14617ed558bb0ee03f4b67af9684b710b0884be98acd86c14c3c4d7de558cc1a60fbca68bcf6876dcae727a9a3b272d4ca910261f
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:cQRQyi36YOcPbLvw2gAf+PN3/DT
TLSH
T121667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4aa329231d27e8b7a32605e6232bb057e78a6e3b65d125c727e89d78f9404ab7
MD5 743b2c31dd203a5576c9e1e222e9f8f4
SHA1 50a079f9fd7bed9becf0902361929ee4c55fe751
SHA512 e7e3afb3c7f3b458d13a6c2bc5c0b5ba61dbc467bdac47e0c8ab746bd566268bb63afa2b5d2c417c55e48195d9ff8c86d85459794c45af4252e8aa76d4c20c0a
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:VQRQyi36YOcPbLvw2gAf+PN3/DT
TLSH
T174667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e8afe5a0082d2b9d93681cc9227f11cd1e6f3d999c2187c23ae88af668eda429
MD5 0f11e83237dea2877ec4011b5b2fbc01
SHA1 1c28e579628a4509b66a1c187bc2a8b5196fb58d
SHA512 f3101ba5f3217a5dd4f0f72b46351356845ccc98a465d0cf6eccd725e30816ae8e97d8c474d05f8077bbd7aea23bc3cc9272a5f21c7815ed10a888f7e6e75c2b
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0mPiQnDJGaz9:768Qg55nhceWu7PNU3/lnDJJh
TLSH
T182B55A33B2F600A9C44DE1769F4A872196E17C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 81d14e2c75bec6b4efa821183480cb274bf8201601753ac7c3dd9c209bb24f58
MD5 986080c69df09ca5a47060051eda1c5d
SHA1 5d653f706661d5fede99d5b9c94135ae1333866a
SHA512 80f5ced10b34bdd7bc52f6e91aa7eb4fd92792893ade56b9e863419d04f8f1c1be3cea658dad63f67ec37ddf37671326924d952678135c105919764740ed1ce7
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99n:Jy5112gYy5azzVvt69nLKnhZwDT
TLSH
T1A5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e154bd2c39f102cbab631fca2e298999ac02f58144f135287c069cf11da2227f
MD5 ce63558df62335b9a64bd2e8214c538e
SHA1 852ed2d87c9c71d9059a51fb8b36ca144cfdfb4d
SHA512 5e9c6fb8e8f4bfd3bd2399347711f647f07a610204f84db3c30a44113b62b118274fedfaf69e0d45877a4502b710076388142d07251773b992e26c172a45ebf8
SSDEEP 49152:JB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glHnDJJh:fu6Jmdxd2dHDT
TLSH
T1BCD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 63d72940cfd9da88f08c343130604b9cb72ff49d1b434e53956ab9bac43606c5
MD5 b12bd261a065ae378bd755b3eff62698
SHA1 b36bd8f23bff420cfc1977d432883e445ed2d503
SHA512 6c92afb8d36af2929eeeb148caeb99c0a5ad6681e83098bb4ff873c09d77ee38620c05ec1c4957a3e3fcb6e5d56ef56d2c549c0706fef4865bbb6fd4677678f7
SSDEEP 24576:zhv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx33PiQnDJGaz9:Z1hpsNoJpF1A63U44CwH7R4xTnDJJh
TLSH
T1EEB5BE13F2D900E8D05ED17887569232EA72BC460B34B6DF0A90B7962F7BAE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ff04ff5ad663009528340e6ee46082f5b33d9561ea40fceee5e9d0732ece4ea6
MD5 a648eb9682ef71a97d92ec7448522df4
SHA1 d05da6bb811d1fb408d41d0fae6782aec46bdef1
SHA512 6a0381330a08509946601cc2613ca778aefd745a98a62c7e1cafbd925981778292663f4b4628f8abe7272628fb6662713408cb6dae4be443ebb295dbdbfa90f9
SSDEEP 24576:n4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6vR04FxGgVG2Onks6xt4bSMHnq2PiQnDJn:RSuZQIY0Be2KcRVtOnks6NMHqUnDJJh
TLSH
T1E0C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ffb986000ebd1ac6199fabf0c0426eda75c86d317f28ca565269a212e561eb51
MD5 1774ae05e5b375b08484f086bdd7a110
SHA1 6f5fd8eefcafcc43f84d2713d48048ee392c3f28
SHA512 3224484096197cb003ddfca0c8cf62d6d64c06ecc89fdba7b14b3e316274e2144c591d26a6728d3c04cd5d71b4bd585c577f96b76e06b5ca317a0e0e27bb589e
SSDEEP 24576:0hiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QL3PiQnDJGaz9:0htSn8EApI0fig3giDn0AP5wXnDJJh
TLSH
T1CA95BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 75182eeb99261e685a833eba0d8e70c6bfcd722f3c8c35c523c61d60bec6b386
MD5 5e555a3866bf3fb885f43591e52c49aa
SHA1 7e1bded7252a02938eac6b057d4e02d42cd6c225
SHA512 40bd73bc8c5b4f63f29b8e1443701ec474a5f30c0fe9298f95ef51fb98737a6d2e5f04ac7a52789eb7063e99d303c6f487783ea651fb8eebc78b0cf427302731
SSDEEP 12288:XqPAXruYyVHHaf4HJ1jwssawsUoN9PqIf:XqPiQnDJGaz9
TLSH
T175552367DEEF4052F3099776D2C8E0066038BFEABCD1A05B395D79373A74A302D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 fa2e3f62d7eff0edcb7b0cafc543ca13b5aa614a3f4b217b4af5acdc0e7e6731
MD5 e42e09f0cdd1f6c6cbf087ca7598ba87
SHA1 9f5abeadbdb7798a0b1f82269e5bfa340af59009
SHA512 e9c4a96ab2238b3889cf939126379e25566b34fcf6ffe0d7434c1591071593a1d6eb98178524df96c85fc07b7287e0f79cb2548980f117dd0e5148155373c78b
SSDEEP 12288:tpPAXruYyVHHaf4HJ1jwssawsUoN9PqIf:tpPiQnDJGaz9
TLSH
T14B552367DEEF4052F309A776D684E0066038BFAABCD1A05B395D79373A74A301D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 4073a1b4167183b9156669707df15849bf303adac435f864257dd20b39bd1790
MD5 f12bfa74155bb5f2d31f3c2cf2c1548f
SHA1 a17cfcbffe56d744067317db6e15b0bb4eed89c7
SHA512 1ec99cbe3662e74a437273c99474f4b9a43de299f204df52da8c928d1798f5b36602890d9855110d68605e24c11a79b28c0d32a414a1859f990895e79edb16cb
SSDEEP 12288:avPAXruYyVHHaf4HJ1jwssawsUoN9PqIw:avPiQnDJGaz9
TLSH
T1C5552367DEEF4051F30DA776D288E1066038BFEABCD1A05B395E79373A74A301D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c850a58065bc7b8320626310db5b0bbe5b4d191139c9584351d91772ee8dac77
MD5 76470b476a698dde508b5d4655f6c39d
SHA1 0b40e952f06096594b2526ccfb8a3cd830fbb787
SHA512 00b072faca7eace94a88ad124a002f9677fb043fe15d8d1e98323233bbee54f58e6bf40b5ee73f49429fe31cadac5e01ae62b4b2d0f0c3c5b0a023cca65d5a5a
SSDEEP 12288:OVgPAXruYyVHHaf4HJ1jwssawsUoN9PqIx:lPiQnDJGaz9
TLSH
T1BB5523675BAF40C1F30AE37AC684E006B174BDE5BD71A29F2A15296B2E707302D71E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 f6a51af990881e03fd94e57f28873a2335f574e7260e7c46f4e2c52c6891366c
MD5 fc62efbcf61c8b00739d13b58e5d3fd0
SHA1 0626cce24cd4c067b8203ff7ee99077ed99d3a1a
SHA512 4a77d7e676b2fd10cf8269b863153ea796bc34305e0e73c9b93230f9417af74cde3459a16c8fa137d5fad18df6d8064a386d1260c681d9ced73443555df8d4ee
SSDEEP 12288:lYPAXruYyVHHaf4HJ1jwssawsUoN9PqI4:lYPiQnDJGaz9
TLSH
T1B0552367DEEF4051F30D9776D288E1066038BFEABCD1A05B395D79373A74A302D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 39d65c4a722a5b8d4e03f77d7816d3c1e8d1f51edb9059248f7abb9197e522a9
MD5 463b59e2aad388e38067f9c2bb3cfb1b
SHA1 2029b18ed80556178e275ab27778b402c14c9975
SHA512 9655f6685a66df6b1b380a2777df083946a451b50e9a3d196b755f84cc6c8831bd9a5b973727ee84cf4e6363e3c67e22dcabd7b9dc93956f4f34d84731bbd537
SSDEEP 12288:AtPAXruYyVHHaf4HJ1jwssawsUoN9PqI4:AtPiQnDJGaz9
TLSH
T1C85523679EEF4052F30DA776D684E0066038BFAABCD1A05B395D79373A74A301D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 28ae60348d91de3643078359927c38fda3ecae24ce25b772437790431ac045a5
MD5 d9bc6feaad46898bbc895e2831b21a4a
SHA1 e03ce061e20264bd669d5ea332fa72a40b79c662
SHA512 18e568e1b2bfa4dfac78e2e18769dc86d30373444edd7dd47aa6d99baf02de6a9c9910e4f80436b371530855ca73c1da4a4a937eb94850aca84b2b4b7e2768fc
SSDEEP 12288:ZBPAXruYyVHHaf4HJ1jwssawsUoN9PqIn:ZBPiQnDJGaz9
TLSH
T128552367DEEF4051F3095776D288E0066038BFEAFCD5A05B395D79373A74A302D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 2fb91ba0992b9f0a3cee3eb80ee0f1a224d949dd5f6dd680639cf7da3a0b7285
MD5 cf6c477ebfdadefad8a0618b3f6d22c8
SHA1 3b72397aef426f3207def95b6deed7a2ea0cfd06
SHA512 167a299277167040d25f93e18e6babc35f830bb334efe443337335bda7fe4498449e94dc31b24909e1649edd8036d96e65aede86105e3d1fbdfded8edd7f667e
SSDEEP 12288:3iZwbpzzFEoS2cPvyJPAXruYyVHHaf4HJ1jwssawsUoN9PqI3:yZMtzFVSOJPiQnDJGaz9
TLSH
T1B57502A5B39518F4ED67823EC9559906D2B17C6A0AB0C61F13B836271F333611C3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 d51fd6ba6466c32bb4f8433789f0a4071e69b0f2dceba3a7bcb499ae1ed3af33
MD5 d215dc169be42741519e8fef78dcaad7
SHA1 fa74cff7943b0580ad71f9f9f264f28e60eae1c7
SHA512 bea1d02d21e4453ecc9c0463623e54721ef5d06f86b01e54f8ef61cafbeabdb35f69ebc7aafe211b40e48bbd9bf87b3b6f584f820abc0a75e432ee9349b1cff6
SSDEEP 12288:xGPAXruYyVHHaf4HJ1jwssawsUoN9PqIG:xGPiQnDJGaz9
TLSH
T13555236BDEEF4051F309577AD288E1066038BFEABCD1B05B395E79373A74A301D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 07e75d4de4efbcb6bc696883e0b7ae8335a82beaf51b643f82d67f5557924124
MD5 a959427bd18f7c52da142ae5eab91777
SHA1 5bee6b67d305c32f8e506fec47342b81734915c2
SHA512 cd47133c8d3e55a34d02c1fff98a1a6bddb321d5d925bb1a60fd40cd9f5baae997917b6c9df69e86d7bc2b33edea0842d2490cdb9853572b678a71bccd5fc987
SSDEEP 12288:syPAXruYyVHHaf4HJ1jwssawsUoN9PqIg:syPiQnDJGaz9
TLSH
T1005523679EEF4051F3095776D384E0066038BFEABCD1A05B296D79373A74A311D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 903ae9791f633dc34c68e3ba60d464f7731043c6cda344f5bab1611b3403c2b3
MD5 5e35221e456cf93a27eaa8e45b6a1bd1
SHA1 ffe0791b40f8d08fedb2444cee3fec9a03130f0c
SHA512 38540cd8c1118f71274afe82cce57936af0fcf6440c2ebb42ddfbc667104a29a4260a0f2b15db57a6ac290385c870d710d6b06b6ea66c3ffac9ab45cee05df50
SSDEEP 12288:myPz5L8VPAXruYyVHHaf4HJ1jwssawsUoN9PqI0:bzyVPiQnDJGaz9
TLSH
T11065121777A630F9E2269339C9915902F370BC325B609AAF176417772F336A05E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 28b6edf544eb26cede730384dfc45238c218d2ee49faec53bd437aa43e76ad2c
MD5 de42bd9adf985562e86239f083c12cb0
SHA1 71ec6bcbbabadacfc203dd9b5c5955d0aabf6e30
SHA512 02c3005970db5f18f00c41cd4a58f496d9bc523e25745c046d4af43dd8f9c917055b96a85f03098e880c1508c46f1d2b3b60ab6c7ec46da63d1121133e5b427f
SSDEEP 12288:aGPAXruYyVHHaf4HJ1jwssawsUoN9PqIj:aGPiQnDJGaz9
TLSH
T16B55236BDEEF4051F309577AD288E1066038BFEABCD1B05B395E79373A74A301D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 8f02aac939fe1d938df5793a58d9a679536185f9d9e9125012a6415e9197152f
MD5 ebb64d59070ba52a42afbfa07c7de64c
SHA1 58b6d37074ce4a57706f7b4c3803f8cf196a5b9c
SHA512 4a5d76e4a96660657512f6f974158be47e61c4668cc138ad0ccf4b93b2b8b72b1793210be111e4edd97c85e1fd0c5f4be32174cf1a21bc2a8eb6ee0496b3d496
SSDEEP 12288:2GPAXruYyVHHaf4HJ1jwssawsUoN9PqIj:2GPiQnDJGaz9
TLSH
T133552367DEEF4051F30D577AD288E1066038BFEABCD1B05B295E79373A74A301D92862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 a1574acc06e0cde669739ab9bad68a3f3a1f772a7b3e7c31d5c8fa80990d1bd4
MD5 2c017a4e7b0261cb476a65bac76717f8
SHA1 0c4a50c808909f220f99230436bb8a6c37e03037
SHA512 5f2322345a2d51db31fc58f9b4f74c8841056ab23eb6635d1bc7f0ae15bd79fcb6d0bcde6a1a8463a23652a213650e6b13509effadec5dabb8584b1bb18e169a
SSDEEP 12288:hyPz5L8VPAXruYyVHHaf4HJ1jwssawsUoN9PqIO:wzyVPiQnDJGaz9
TLSH
T11465121777A730F9E2269339C9915902F370BC325B609AAF176417772F336A05E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 b9da833974aaec72173f9a821791532a1f9f4070a90d2340a0e53b0dee09af29
MD5 33cd744dbd2c1ab4e0a4f35bfb945297
SHA1 1a5d43e811ba419da21fa4d24c625beadd0fa0c5
SHA512 3452b7eea2a72b1f952aa25941db248b664637481e469e523ac4b8b5d74e482c9b56ac017aca82572a4d2d7e5ffb4e9ae69c18ef89e3be079784bb84434c0985
SSDEEP 12288:wCd9GWYoaLHF3z0z04PDvhfPAXruYyVHHaf4HJ1jwssawsUoN9PqIm:pTPaLl3z0zDfPiQnDJGaz9
TLSH
T1687502A5B3A518F4ED67823EC9558906D2B17C6A0B70C61F13A8366B1F333611C3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 f2deb1ae6f0d09d52e32c0f37f55c48ce772d5b5b60c0c91e8df4ff448bcd4b6
MD5 1c7438a9cf4300fdf22adcda44ac6c2c
SHA1 9e437558f8087e700a720c517901b5714029dcbe
SHA512 efb2a37067e7f6d8b08a7c21e623cdd1de9f8dcc4067bb0123d2ccc03de480b6ac9e67fdc4856a5ab50610d4d54b11bef9e339f1af60a99c9ac771fb4ceffa8f
SSDEEP 12288:Ti4e7GRdTfgwCHKy7GLbbdIvsPAXruYyVHHaf4HJ1jwssawsUoN9PqIa:T37d9CHKy7GZDPiQnDJGaz9
TLSH
T1AD85CF90F3E810E4F1B79A35C9769501DA767C591B71DA8F03A4261A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 31ca155610db82821be0f902d3e3272eccdbec896e6187cf4c84a24c75132609
MD5 a2ae0e82f9b60092b40bd376b4b8f68c
SHA1 9063c8a1d4dcef0291707f26666fd2b18fb8e2ba
SHA512 f727cf7e557026dbb250d63e939a296f40cf8bbc43af788ecf501f31b596a8feafdce21ddcb9f5d6a5977bc46aedee6b9cea24983e3761d63ee4acde6f175de7
SSDEEP 12288:tPPAXruYyVHHaf4HJ1jwssawsUoN9PqIN:tPPiQnDJGaz9
TLSH
T1CA552367DEEF4051F30D6776D288E1066038BFEABCD1A05B395E79373A74A301D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 c2f9d62d29a738203d99fb72b77a09ad51df2fab71c5f0a4f1a0de11e5f07292
MD5 b7fde16bd447cd60810fb17e413e3a28
SHA1 a217a10cf6547e287fb104907f307748e52f341c
SHA512 f264f2f6f49179075e778a3dd877b57758991e6cbf020e8f0990981afd6821f714c20ecca2f624146f9694ca83632899c3d4501bbbc89fc4b15256b5a012380c
SSDEEP 12288:L1PAXruYyVHHaf4HJ1jwssawsUoN9PqIl:L1PiQnDJGaz9
TLSH
T1735523679EEF4052F30D9776D2C8E1066038BFA9BCD1A05B395E79373A74A301D92863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 b792691e8074a950dbb4ba99954836c5ed1cb4ae1a5a696fc0fa7495f065f2f4
MD5 0caafdee0267d9afe965a67ef62d1932
SHA1 a29d25f1ab42e9f0351ef813c95a6cfc5ca99546
SHA512 8ef291dd7a1cb2aefa37d5b415cdfdabcba748908fb19a0b9c93cc62cc7da56401344061f8c7362699c8a0f6c99965605fc7144968d5f0a287494ffc3dfa3026
SSDEEP 12288:4sPAXruYyVHHaf4HJ1jwssawsUoN9PqI3:4sPiQnDJGaz9
TLSH
T1D45523679EEF4051F309977AD388E1066038BFEABCD1B05B395E79373A74A301D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 75dec140edd5a66402fb886c45d66fe4069ceeeb7caa0790fd607b94ae20dd45
MD5 f6cd3f4dea4115b4bf61a6a23d8ed518
SHA1 9570e0a79e6706c9ff2b0c9213235d7097f94f50
SHA512 0376c4d20e12cd7ee41162af6f6f2630811ae958b461059ef8f21c5aa2605396ad14b936efb26927bec42d9d2b8c683a47d01bf3a5e1329f480f8db4a2f1702c
SSDEEP 12288:6GPAXruYyVHHaf4HJ1jwssawsUoN9PqI3:6GPiQnDJGaz9
TLSH
T11E55236BDEEF4051F309577AD288E1066038BFEABCD1B05B395E79373A74A301D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 28a5586b21a829a1e2b38c03b0e4985dc050de89709be62c1355a8a023541d98
MD5 5955a6bf13b642ec86468dc342053d1a
SHA1 e36b5765cd01e1097d470b54d7872ea43dfc4e63
SHA512 d79dacc84fe5ba74e56a68726d02e7df6c4c1c24072bf222d8cb91a0191f2cd0d638cb29337a614f7c4a94fb4fe63c2f3495bd530c941b6c0d8c837e44131094
SSDEEP 12288:WPPAXruYyVHHaf4HJ1jwssawsUoN9PqIz:WPPiQnDJGaz9
TLSH
T144552367DEEF4052F30D6776D288E1066038BFEABCD1A05B395E79373A74A301D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 e301f9078db6c0062d6c63593afdd54f03fe69d144a8b9f3975dbb015b292566
MD5 39a4786b63661217b37d5a50c8efa9c8
SHA1 776b6f39cb3f0722f2d4db4f04eaf11cb4746892
SHA512 5e2b0967974db44f1064b7c61928f46964312c5d69dd1a1552d73d19f0e462c1529f8eaee18d786c305edd5eb92a44970d3b68db118dba3680d87edd3367289e
SSDEEP 12288:o+PAXruYyVHHaf4HJ1jwssawsUoN9PqI7:o+PiQnDJGaz9
TLSH
T171552367DEEF4051F3099776D3C8E0066038BFE9BCD1A05B395E7A373A74A311992862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 93231ac7e2e668922810150752dfe69da549664a8956612ead5eb5f03d1bb968
MD5 47501c26633dc9bc50d383b4e27a1022
SHA1 c19341126c186dcfe3fd7ec701091b33832c4d87
SHA512 7dc656b10acd58053d8d7ff3202299822899c776449eba85cca2b0863487abb960874c47661ac4d293130045f925f4df5aca7f951b6e95149d15a09481fff6a5
SSDEEP 12288:ZYPAXruYyVHHaf4HJ1jwssawsUoN9PqIH:ZYPiQnDJGaz9
TLSH
T12F552367DEEF4051F30DA776D288E1066038BFEABCD1A05B395D79373A74A302D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 728c9f9e7664150a8e22d57b8aa39a53c67a788435339afd96296be3744ae891
MD5 7e1f0129f128feafe498488f707a9ca1
SHA1 724d1b03a16065cf91a790f1f73712d334865375
SHA512 774495f3c315f5035f6580033680a8f351d1e5e29dc56cd99a45db73fd7a42188f44eb4fb74a5d0332031e879be20b1193a338a3db12e12c902300b25fc22b35
SSDEEP 12288:CXPAXruYyVHHaf4HJ1jwssawsUoN9PqIJ:CXPiQnDJGaz9
TLSH
T11F5523679EEF4051F3099776D3C8E0066038BFEABCD1B05B395E79373A74A311992852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 b85dbad83f3b3b3abd2c25aa531f6963798ded028a5bae6fe303b6bcf587b8d2
MD5 0e57627beab965581fb88e207a64c4cd
SHA1 b986a2b747cea74df0f3dd00d4fd98365b32dc2f
SHA512 4550fd31e30d7dcd52a037498b22f7255262b6213366711c62df6a2bdaacaaccddb78bcb4f075d50751888fc0fe41dd4c60dfd6f4077a187cc670070d4b2785a
SSDEEP 12288:8YPAXruYyVHHaf4HJ1jwssawsUoN9PqId:8YPiQnDJGaz9
TLSH
T1DD552367DEEF4051F309A776D288E1066038BFEABCD1B05B395E79373A74A301D92852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 be3f18b4aea467d8dd1da52b62cf0fe86533785eac65c407e03e74c5b2fb8092
MD5 d6d9858ab7cff721b8fbd718aa6027d8
SHA1 7bd29021aa25dba5720f0fdf04ac31d01a842bfe
SHA512 d30a10578ebfa97a1b5b64a91be5548e815f651846bc060f4bf8c76ab485a589dd6abd9277fe877cfe9e74738696e7d91d317d01fe6655ebcf76caa2081099e2
SSDEEP 12288:EfwvD5u664Lk3tRX69qkyAI5EPAXruYyVHHaf4HJ1jwssawsUoN9PqI7:EfwvBk9RX6wkyAICPiQnDJGaz9
TLSH
T14385D029EBDC44E5E177923C99A7860AF2B17C691B31C2CF125A536E0E33EE05D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f9e3895305c486812c63df5189ac64556e305b3ff9a71febd7407088e23f98f7
MD5 d3e37d026d916c2aa324a1e3fbbf6aa9
SHA1 0d2500c6159943b70bf9a3ce96687316969031ae
SHA512 dd87c7abf8865e8d3c297c37d9d0c378213ad349fd8459fb848f2230688a84270977e64109232c289fb3572a1ae760777dea2aabf6036a85a69c6e78f3c0d10b
SSDEEP 49152:/YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03nDJJh:qySzPfDT
TLSH
T14A066C97A1A801D5C1B9C1B98B0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 764a57d1ba09256af089ca16f9e76b96470154083808b44e51f7c7a3441ad195
MD5 4f1ddcc6b526b0cfe29a7d89c5ff17a2
SHA1 7b84b172b50c9779102c1be0a1266245d0e4324f
SHA512 e0974eb8cbec4cfa7a1e0e2bf9f2d84a7e913aca0cb3176e5c9a4f24014c6024a3e2c2430abb196ae1f7c4aa2f6fb14a75bc7682b72371af493218b759acae52
SSDEEP 24576:m47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYZPiQnDJGaz9:m47JUQjTirIhCnDHUPfF/HnDJJh
TLSH
T17365AE1EA3EC01E5E1BA927885158A1AEA71782D1F31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8d31cd29eab4cef563263c22ac990476f261dc2ac625c6f5ee269de80f498b3f
MD5 98e68479c54f585da5fc6b50bd8ca1da
SHA1 614fb7bf9d89ba734fdffe1293aed36ee4262755
SHA512 f25e147a1858b04bfeb219444a271f57f49891b5bfeb8a35c4dfaaac13be4e4c9b53ab892504ba3de38c9689deda762e186828f2e6ad3f41bfdba1fbfbf2d65b
SSDEEP 12288:lvsf2PAXruYyVHHaf4HJ1jwssawsUoN9PqId:E2PiQnDJGaz9
TLSH
T12565011AD39902E8D15E6239C7859601B3337C659BE1E3CB26D0F93E1F356A05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a07c9b4c3fbeaeb1da1dd393943afde90a4872749e4e133e8e94966cdfbfc828
MD5 a01be53ee781e9beec648b454a328f16
SHA1 06af89413ae0acf07e90608efc05818da14b2494
SHA512 8b94179d0c1ecc912663d221c0f108224f0911db39ce82b19e3880ee99f6535f6311b370e22146379c6fbad04dcf58e68127288bc74c3f5858d48011e83559ba
SSDEEP 12288:q7pqkcAU3f2OABJk3ta6AganhGxJOhJIXlf2lyfS:q7UklUPGBaAgaoJAJklf2m
TLSH
T18B3506107626DB4FC66940321E36C6CCAB70BD42FE05AF0772CA473FD576659BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 2022def9b7fe0f5b5221cf22a4b07c5b60b39aa6556a96dc81cee2cc657fc98a
MD5 c14dad2983beb3914ed6cb966b4e90a5
SHA1 7acdf5ad6342cf5e9082c97700fe65886f0718f6
SHA512 3c251dde3df4e8f7e7a7bd0f10d13fa97774b74a132f72530b6c82412024e947e77e9b67a073da104787be5bd66d6289b3674dd1f9a66339a09f7dc163c9b91d
SSDEEP 3:OlH/l7gFOL8TVLl4llUBleyg/llbl3y8Dl63mCllltGlslslslslslsl6od:KzLcLl4lUleJ/llBMmCtEEEEEEEfd
TLSH
T191819250AB009E11C92E98348994A3D88322D6AB288BDBBB8D0414870CA4A5D8C2975A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 fb61dc3562f4e88311ccbc0c369b8b87e3d23090ec1f78a3c045dded2eb8e809
MD5 90c3b8bd1a6e182b0460dfd817e168ab
SHA1 9229e48978cd2da2fb3ed94ccd6083d3d8583409
SHA512 a6a9d064b85d7511dcb010723e3716d540d164bcdd471916620011f6b92ceabb36f2ad5643a9825418988f2857465b7e52ed5a45965c50eec2ba5fa25c87884c
SSDEEP 12288:MVhZntXnOAH+27DIPTtpUKQ/3VZf636r8ajvrdl3pv1QxO55pkaJeYj1YrM4s10G:MVRPCPTtrsF96YnXykWGp/XUctsAFt
TLSH
T180754B015577DB4FC9BD40370332D6CCABB4AC02FB492F02B385497A9866A5EB5E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 1160f727b127407fdcc308c56e9a0f7fbb238c615dd5ffaeb8f20fda1c4300f1
MD5 ee0fa76da9ee465294d5983b0eaeb3b0
SHA1 c6d7275693f0a404de401d6c2d32c116b62a42a1
SHA512 518e80a8e9bb3808e628f98e9761c21a307e73c4c834b4210262b6f97aed973fc5551af128ca5aa3b7e935d7f4eb0bf2f3e3547165468f94fff5d9a921fce001
SSDEEP 12288:xI7uPAXruYyVHHaf4HJ1jwssawsUoN9PqI:OuPiQnDJGaz9
TLSH
T100552367DBAF4401F32D67759689E006303CBEB4AF90E0D778197A6B3970A701DB2A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 41dff1d35a359f61ac8be1973ced64f11ffe246d3b1f5159bac209ed4bd6929c
MD5 ee347356268eee7010a8a94298d1d5b3
SHA1 3cbf4e78659eed07bd7886220f1dfd31555feb8e
SHA512 c5f3cd33cd10db9b16bdebc30efe0669ffda639e7d65f31c4de1109a8b6366593c9a2473344b6fd3096820c65943b129889984a07f58d583fcdc5c58525605e1
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bY0PiQnDJGaz9:mgb4mBIBhGFpnDJJh
TLSH
T16865AE1E22EC02F5E1F9E2B8DDAA4417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 6d4888fde3a030f18454d607d7c4a33bd769af6c0cf35a1ce7127f38e585b5e2
MD5 a562fd842a9b92c97a12e20c30db4f9c
SHA1 34d701561aea0a4ab28ee2d0158a43cb133cf17e
SHA512 0d339b795d4d33ffff7f6a44eeb0a74a8eb914dea87264e14c268b475e49ec6d3c230538c33a1949aee6de47fd244eba2f0b17d4312ef29c450f18a570e00c30
SSDEEP 12288:jGn88u8FpJqH1CmqQyizr9wA5hUo7WCmJPAXruYyVHHaf4HJ1jwssawsUoN9PqIf:jG88u8FpJqH1nzria7/mJPiQnDJGaz9
TLSH
T12795F16567E501F0D47BD1388A868653F6B1B8251364EBDF06AC8B521F33AE10B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 4d2323332112a65839c7714486725191f2b4f728fcea8bfc8f764c7067411376
MD5 aca82ebab5c01cb60dbd6c0dd8474534
SHA1 0f6c8159a56c70efe1a244e2f8ffcffa0baab13a
SHA512 060ed1b0e4ffd64e4c35c1dba7d16e6973f349f8afe9093a5707039304445c43fb1fb415f4193b2c428d56c5f5c39bbcb3aca3e85a8b61ef44c11c79fb7cbbd6
SSDEEP 12288:+HvUrBFrEjwaQ9PAXruYyVHHaf4HJ1jwssawsUoN9PqIs:+PUr+NQ9PiQnDJGaz9
TLSH
T16175E12F66ED18E5F67AA17D85828609F371B8621711E2CF02A0817E1F73EE47D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f8255a35da22a27ec4562bb7952b7c7ad34ae778dd3a34b9b2b58d217241ca95
MD5 e8e73293753987f5e3aa6851f0483f7c
SHA1 a92f69a3c55338de079fbd6be8f94c6148113853
SHA512 f8994e144408df13675ce5b1bc37db7809ac26fd6555d8ed671ca4d44c994796890244551d11a8e3787285a1c6984bdc2050c35451687f06c9f811bf7d92b85c
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdnDJJh:+G05lO43bIDT
TLSH
T140D5CF6A62EC11F5D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fcf25cea0646c9b6f1c557fd612b86a40aa1ea268515bbb0257274f9dc04b915
MD5 a69962fc4227f2efb371a915ada78f99
SHA1 678b550480ab94ad7fb026d1fa856922c116fe37
SHA512 ac062fa4d291d185228a37217de87165bf06eceb225dacf0deb045ea937086310283be96f6aa249f9b31e3ea696f17939e1b75a8ecf7c438ee01970c6c7a6ded
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7PiQnDJGaz9:Ua5POZ3BJt2pasx2+mlnDJJh
TLSH
T1E465AF5EA6FD01D5E179D17DC583860AF5B1382153319ACB122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2c6ac5de084937379aa3a5c9d1bd696a51e2013c72b26dc8335a6c77dbdcc1b2
MD5 b9917a5958194776d646b64869e1fa7f
SHA1 795b25db44706e30a5e1809778c3a8ae47276628
SHA512 142a47d99888634da1a2785e816a6981dab891658dbddbad25c48b134ea2ea0eb7b472f6596f18d050648720abb81628f5a1bde4322fe424ff6191e34e030749
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkxPiQnDJGaz9:dNc/zEOVHFunDJJh
TLSH
T1CA858B2623E901E4F1BBE1BE89679546FA717869173086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 49e241029f47eb2edad87871584ce9f06424c7190336f84b7479497dddc73733
MD5 f58adf04980b945870e4c3849f52a8f4
SHA1 9a0305a380039d30dc27f4b742d7ea2ffe8fb4ef
SHA512 c37942e423bfcca0c7477361679f8986fe1998a6509d3a710d251842f5bdb6276ef0aa3f73a940ac7a75b5d1177a01a8690cdbe0c3e8833857b5b025ef5f8b56
SSDEEP 12288:wQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17tPAXruYyVHHaf4J:wTkNvNnaFeYhJNtmZBmXPiQnDJGaz9
TLSH
T14355AF2EBAF805E4E1FEC6B5CD238512E6727861173292CB5290C13F0E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 03fef894a76580171d93335df58fa23cccc208175dc3e1c6213ab4b46d80b08c
MD5 16a998d6c850798b192e65c72a4adb55
SHA1 9599104f94325fe4cf7b72d9c01a9fe83f1f6634
SHA512 c7a9ab81b4274166aba4bf3a2b3cbee76a19064eb54045ba0c92179cd4d20b2534bb93907a1d1c4551e48b7ddc0386c8fec4c23ee25aaec002a033ea4697e0dc
SSDEEP 12288:lQcMxWDXN1Dp/fshBItT1IQgAKPAXruYyVHHaf4HJ1jwssawsUoN9PqIp:JD3FHshBIYQgAKPiQnDJGaz9
TLSH
T15985E17EEB9D00E4E57BD2BCD6538506E2713CA9072265CB02D481BA1F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1004-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1004-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1004-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1120-363-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1120-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1120-108-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1120-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1252-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1252-14-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1252-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1252-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1252-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1320-288-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1320-67-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1320-74-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1320-73-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1680-78-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/1680-305-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/1888-101-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1888-95-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1888-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1888-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1888-360-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2964-66-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/2964-9-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2964-8-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/2964-304-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2964-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/2964-308-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/4164-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4164-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4164-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4164-121-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4164-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4168-39-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4168-52-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4168-50-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4168-40-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4168-46-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5060-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5060-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5060-375-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5060-359-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5060-83-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5060-89-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5756-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5756-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5756-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5756-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5756-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5892-243-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/5892-54-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/5892-56-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5892-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download