86d9d15ba8b389291e6adf8719df8cf64af445960ce6c3c09f10339e4347b69a

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
Size 2.4MB
Sample261015-nnvp2ade53
SHA256 86d9d15ba8b389291e6adf8719df8cf64af445960ce6c3c09f10339e4347b69a
MD5 6cb9183323a6377805f9b490b1f7b630
SHA1 96483ed8d59259366653cf0b706f26726871d1ca
SHA512 1b6055d613bf81893cd331d6e774ac507b493744ecaf7cd6fb366cd4b26523fb608161bbcadffeba915eadc88da6008df4dc77129f4f71bc404df83869d208ba
SSDEEP 49152:oaUZ+4sbZjEuLqm01HRWpZdL8PwAuBp2g09Wda8sbZjEuLqm:F4YjEuOmKWpZd2NsYjEuOm
TLSH
T10AC5028162AD3FE9E167D135CA718692F671FC150B20978B03F566A12F37193B93E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4240	elevation_service.exe
2612	elevation_service.exe
2656	maintenanceservice.exe
2432	OSE.EXE
5704	PerceptionSimulationService.exe
5284	perfhost.exe
1192	ReFsDedupSvc.exe
4648	SensorDataService.exe
5864	ssh-agent.exe
552	AgentService.exe
5680	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e557e55e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5888-0-0x0000000140000000-0x0000000140270000-memory.dmp	upx
behavioral2/memory/5888-255-0x0000000140000000-0x0000000140270000-memory.dmp	upx
behavioral2/memory/5888-75-0x0000000140000000-0x0000000140270000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a9d0600995cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004639a0ff985cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca6478ff985cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060ac433f995cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe
2612	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5888	2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	552	AgentService.exe
Token: 33	5680	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5680	SearchIndexer.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1192	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4240	elevation_service.exe
Token: SeDebugPrivilege	2612	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 5996	5680	SearchIndexer.exe	101
PID 5680 wrote to memory of 1112	5680	SearchIndexer.exe	102
PID 5680 wrote to memory of 1584	5680	SearchIndexer.exe	103
PID 5680 wrote to memory of 5512	5680	SearchIndexer.exe	104
PID 5680 wrote to memory of 768	5680	SearchIndexer.exe	106
PID 5680 wrote to memory of 5364	5680	SearchIndexer.exe	107
PID 5680 wrote to memory of 5320	5680	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_6cb9183323a6377805f9b490b1f7b630_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2656

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5284

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4648

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f07b1305623f6c76b47433d9ee672333517876b99562d929f0f1d200c87706db
MD5 3237c4f2b7c0d486f88328059dca1114
SHA1 46bbf64a2ed41c01d8f5835369dcdf3691994e88
SHA512 7f4aaf96ed49367c495b459b664ee9a30bdd9223fe8ce1485157abffb0e436bf6e76cd10635458bfc47c19b4f1f72e5e332f61381f9edbc106c55e76c97af5ca
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnlsbZjEuLqm:b3q6HjBSYjEuOm
TLSH
T163D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 7147f776bd7c549efa3a7c066ddfb8dabdfb9d1218819f0be127b98b1f4e376c
MD5 26d0d01aa1aef898097f643408673e2d
SHA1 d14214533056fd2ff4ffdff143ff93c9cbb32fe8
SHA512 35e625a8f5231338741625edef52f15229f9a6741e18fdeef7dbf0a376d6a7d5bd4357f10404439634d559d8a1e41923dbef1f8c7db94ed79d7fb361756aa8fb
SSDEEP 24576:sXYfDtczASZByOoCjQbGYJxEqadcvTy8qm:LtcTsbZjEuLqm
TLSH
T17B75012973D449F9ED67827CCDA2C112E773BC954760EA8B03A499690F332C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 83474ca2e97619117fc90f1d060507aff8f582e3713b4e3675077f48fba1ffae
MD5 321f73df48eaf3abcabffb4f1ebaec80
SHA1 289f7d56d3021198f5a15b53d209208c3f2e4e7f
SHA512 b5600e58c1d0cf121b05094a527f2afbbee7567d50ff83a00f418c59b8b1a9b04068000a565a1eab2e55bdfa1d72795fade925ca9c36f3217a650151a86cc296
SSDEEP 24576:p0Le5ji0hmxVrM3ZByOoCjQbGYJxEqadcvTy8qm:pPji0AbYsbZjEuLqm
TLSH
T14295AE16F6788335D073C0B9C5D2A68AEA7130865B3089CB4286D77C7F676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 97611c3f24350f115671c96689f374147ba3d55a6c96e2ed1b25d30741aca603
MD5 d112de417a07423f87fec7779a701c54
SHA1 8e33e8bb890e4f0330e9c41e95aa507620eb20a7
SHA512 6adbddfd40773e7a08741b73793948da9d772a1bc0e02829b77466fd7c7f24cc99149a70ee0dc22752457763ea8d3b60d38cb75691b1f317f92404a024b9ddf1
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyu9ZByOoCjQbGYJxEqadcvTy8qm:E/ezSC6vUzPvxHjyssbZjEuLqm
TLSH
T152755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f0f47570f7adba18f6429efad287330815a429d2e70ea0643f9a1b12548535d
MD5 baeea621b419f1014e9b3eff4e588b8b
SHA1 cdaf6f90c0dd62d3c6c04e9b6e10963a85dcda31
SHA512 449c8f9bcc5c1469d985a6a7eaeb348cd1d3befa7cc91337e3a53ac865718dbd5edf83c035b9c7fa906bcd4a44503f229da5097aeed9dbc780ccb105bc207b31
SSDEEP 24576:jVbqPb88hv/l+6GZByOoCjQbGYJxEqadcvTy8qm:jVO88hXl+RsbZjEuLqm
TLSH
T18F559E66F5B4C331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 837eb2ac493de5a682ba42cf2efa99cd5d0d7a17e73114c4fabec796cdd09d04
MD5 ba9e57babd6f208d27c6fd1dfa97c88c
SHA1 0121e39a5247abec4508431071ef6f0183ec9e48
SHA512 f70db11d28f24071e1a87169842c4227676de1e0e836cef1da734f63d8d9d9e08f780a298e88319641cb793d872c47034f8f2f4e680af655238e9f0207a01ae1
SSDEEP 12288:vtLqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:vtLZByOoCjQbGYJxEqadcvTy8qm
TLSH
T180652393199DC2D4E3661A71BEE690D353A9EEC88D768C17E32B7FEE853C009C916113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 8e82d959c82a6746d07c7dae21054a7389ceff434c030d5b3c634a9bfc2603a9
MD5 891e79994a9fc038a4d6fafee458b369
SHA1 0e60962d5d8b7eeb6cb8a6c647c3f6a40fa55b2d
SHA512 5bf9c3f7737b219a0acf17bf33a1039bdfaf7be46e2957d1c39bda3531e4268b92a60c9e02c8c832fb1392ca88d1e99dff1bf82fe788485f8e5f9997eb77aaac
SSDEEP 12288:NeBNUbTVO86UuqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:NJIUuZByOoCjQbGYJxEqadcvTy8qm
TLSH
T16385CF7BAE28FCD2C27A8DB85A91C240D77278704F6293CBD165834ECE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 53c88806841947724a7e0b75dec6c9c2503f170087ff3331a38af54efbbaeb45
MD5 cfa64bea936fed61960ba84befae3d3f
SHA1 34438f138bba1bb23775379d6e0bb5e0c57dc4ce
SHA512 b813c610032feba2e6563346e5a01583f384730f1fc43ec753cd9d3588ca3ea9cb7b22deb03a7750a010fc692872a2f6465746896856caa72c171c955a9d59fe
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:PQvGAdlCEL8c/yRNw5CzYjEuOm
TLSH
T1F9266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 4a81714833cbd5eb74c2816523e2c96c28ed1bc314729cf4fbe0b458371cfcc4
MD5 8cdebd2f602f177989a50c8b0307c633
SHA1 4a3d56c30cb0d7a73fef66d00aec2c5a40a6056c
SHA512 20ac0572a36ef0469e61c023a8ee2bcf468665e80e7eedb91ab1fef24945dde17c83ae32d17683c8b425735269cdefe748880dd040a117eb949e59b9a67a3beb
SSDEEP 24576:YaewsAjsZByOoCjQbGYJxEqadcvTy8qm:LljIsbZjEuLqm
TLSH
T17585E031FE74E036C3BB0DB21B76C316146DBA604F6219C3E3A88E9E59341D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4bdae14cc6c88bc959f01949ed9886459014ee23e622918c070d2e9c90a8e13e
MD5 dcd91116797f93c85efc285f3f7e34f9
SHA1 5e203ef2de0a89d8a37f31baf0e24728f6154c6f
SHA512 38b0342907c0fdab61bc7334441f3cee99f29b248ce716c77cf2daa8dbaa5e58f0ea8af34d40b3dd0ec19204824723f116a2a1e72af478ca0bd62735debbadba
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHDYuO:YUEtQevvqc2W1cpV2EI32DY
TLSH
T149474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e60c1c5781fabb8c1eabbff6d3727f5c2e75f47ddc3bb1bbed2c4cfab8e8e3e3
MD5 24730868ea3892566c336adce761468e
SHA1 360cb3a177c42f6819d2eecf72289a35618636d1
SHA512 0b297dc0a887c2a25c7e61ac31763a34be676058529745e7eb05b366c2556fe8422e97429ae00d6de15bf46aa56ff74ff95793409d7b0558f8746bb4d00f0dbb
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zosbZjEuLqm:doqtVjnmXYjEuOm
TLSH
T1CAD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a7be273504736f60a8970d50028df89c5fe0a39a2d8c4468250ba1e2b60065ec
MD5 2627c04031e79f67f0216526d54fdbc5
SHA1 10ae0faa4b8f9b191c2a7822d47efcdaa9657248
SHA512 7166d29c3fb47ffd5074eca819e6114259a5f3fa6fab2246948aaa2f70807b98a205c850a8bce8d92cd78642d17e2b7874fbd4754a951168f1dd2f1e93291821
SSDEEP 24576:kAhGLJIFoiwtA5l7S535ZByOoCjQbGYJxEqadcvTy8qm:kAMyFoiq5HsbZjEuLqm
TLSH
T14D359E81E7F955D4F5B3AAB89DB68171EA76BCAA5E31C20F2160D11F0E33A409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 dafc4d4376add4259c049d0919f5b5667b91381cdd7ab8fc78a877f1826c4535
MD5 2259b078101d4128ac75d2490c4fa4c4
SHA1 76a65730c63e6b9671c310ef5feb29c092bcb78c
SHA512 ca897a8d383a46ba2dae464e1428f83b2a275eda5bb459a81816916c4e24f4bd6d0d6e0d83f536542035151b8d7e716f546ebe63c1fdefab90ae3c8956e1b4ea
SSDEEP 12288:gmw5HEjsChNYBFgl0WDm+CdqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:9wu1OWoZByOoCjQbGYJxEqadcvTy8qm
TLSH
T14375F14636A94CF9EA679239CA97C132E7F2BC012A31CB1F5360C65B5F37211AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 4441199819876f7a640d6bb7521671b489438d6a1daf3c4c12746b449b9421ee
MD5 52757596253f355442f97956cbee567f
SHA1 d6f6a0274ce407e820a0ad22ca41337a561bcc82
SHA512 373ef1bbe17e5ec8b70e5d0370647cf984ab3d31bce0aa8031687da1ebc2908e731f908b16ddcd8c2b827604e3e226c8eefae19c13eb047b2bd9e5a3d4ecb994
SSDEEP 12288:DkZ1IycqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:YZu/ZByOoCjQbGYJxEqadcvTy8qm
TLSH
T15665129632E8A1F9E2A35239DDE18242D3B1BC965B3247CF53254BAA0F375C54D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5cddff297aae68140e0ca36333c49f37323288f945ffe1661f39d6bf4fe4810c
MD5 68b0ba93ac3abf1015a5bfaa0435def4
SHA1 e8b02a714395b0eb6728fafd1e7efd4371596487
SHA512 bfffbc548f97f139e465b55a8bdfb75ca751cadd88462947613198db1a852775049c97d3c2fe961e44af3d9ec42d7743ff206f4097d5f47246c8c65a10d53641
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:fQRQyi36YOcPQLvw2gAf+PN3uYjEuOm
TLSH
T1B8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e7555d30a9b50939d7d6dce4da0c40307991d73802a6de3ee65cca6943a0c998
MD5 1dff163af93f0ebac47a9f229b865145
SHA1 c793a94c459b2394f26993fcc6db72c501310728
SHA512 808b42e61a56be651068e90ed469c0bef714f30de4cf582e1d234a155a401748aced70cd8f6a3ed6b5e5f5293e7f5ff472575af8e6c2649e68861839e81cd956
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:5QRQyi36YOcPQLvw2gAf+PN3uYjEuOm
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8db6189fb7a30dcdaf86b8ee74bcde501c3a2fcc9e8b270b2a06b39453192272
MD5 8df7875cd8f60021f02887cb22329eec
SHA1 9ca1efd0c067bb1edde811bdfbea4160138e7a1f
SHA512 87d587389034aefd3c6a10b1d3309e598c36471c0493778fa96e265227c70d57b7bc44e48cbe25000db5949e60c01698365f51df02df1b5a704b3904571cca4b
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0PZByOoCjQbGYJxP:J68Qg55nhheWu7PNU3/YsbZjEuLqm
TLSH
T1E2B55A33B2F600A9C44DE1769F4A873196D17C758FE0E7DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ffe4269af895c652fc828fa81b3d2098262a68e5975d4872563ec1a3fec32c42
MD5 d3b954db9b7a70b86f4038aaaa419cc8
SHA1 6c232f4d15bc331b6314b11fab9804eac1b93747
SHA512 9fc1e54325be83c9e6098db2ec39172d2c3c7bd715d50c5920ae481763bfc808633399a7920a8c997b98722bdf807f728a16dcb4b9fa5b27dad22f1802474b44
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:Vy5112gYy5azzVvL69nLKnhZZYjEuOm
TLSH
T146168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1d9483428610f4911b87728b8ac4781ff9a2f3288a8d08ddc5d88bbb3d383085
MD5 84222fab16ecec2ba9c27f660c6534f0
SHA1 28d2cbdf88fcd7897b55fe95e554a547e2213ed6
SHA512 e34f63dff64254c275dc352912bed0993cd89b8c7f0a787daf93fb2f50667c097088125ab47ba810129aa6b65ed54b4f6629d3a8d61a7c7da3fa3ea4e5c22014
SSDEEP 49152:2B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGsbZjEuLqm:Eu6JmVxd2dGYjEuOm
TLSH
T18FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 36d293904d5a82d55354d3455413d2f179f1f3ad90405444d4c25451f5a53fee
MD5 03568e193fdf6d72b1cd34b2b0d2837a
SHA1 f7d15476273c6d3c74a36063e8367719a6b9be3f
SHA512 5731c2cf7c15d56b83b20908acee21dd4235447370268b72ce838d144e7eb1fc2221c92abe57d923931e749824ce3ee77fce8e49d40ce23b77cf5db599c9f889
SSDEEP 49152:K1hpsNoJpF1A6UU44CwH7R4xasbZjEuLqm:KmifPbRXYjEuOm
TLSH
T159B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 849245ea709b5be87bef2faf6ba0c86294a82a4b1efbe3c7a40e24b3197893db
MD5 9be9f1b23ed80aa2ef6a31f8f231d03c
SHA1 5d50cce047de676214d2a31bfc2b53bcb4630047
SHA512 89efd455e2305ab78477865f8bfb2bdb39aed72a701965ee9ac6b25506762814955858d590fd05e49163561d085c9f3381f644166e2d0d70d10132ed9986605e
SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHqVsbZjEuLqm:s5dKTi61VYjEuOm
TLSH
T123C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 26fee7a30799045d1cb59a96ff042cceb10c879eed32ebef3014f2826cc6d273
MD5 9092223625a53f10f9324868fdee07ba
SHA1 8aa8ab7e3f27d9ed9cafbc6a73201e4233222baf
SHA512 f1782f89ae3a4c60c795d1c9c762f811778348d006966909db1b15d69f59a7ae7c1f10d93effe12b1870bee22d6deace88b3d8d98e1b584ef0872931b9650b55
SSDEEP 49152:lhtSn8EApI0figngiDn0AP5w2sbZjEuLqm:UX2iyphbYjEuOm
TLSH
T17095BE13F2D901E8D05ED178C7468632EA62BC160B35AAEF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 17e460b5e8c0701032024b948f071a9fbd26bfade349b59b03b421a65b619bc0
MD5 f594fdf08f9869a7aba70c41ddca1884
SHA1 e466a8c9afe89e31fdb1406c63ad8c0c1b9e9603
SHA512 38439f3de6b6c5decf54523388955d19e70958250a6931ea3311a1d72bb83cf99ab447002491635cafffcf1fd4d1a23577b6bd5556c25ee895d897611e3074bf
SSDEEP 12288:KTqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:KTZByOoCjQbGYJxEqadcvTy8qm
TLSH
T12365239328DEC2D9E31557B1EEE281C393ACAEC99E774C17F31F6EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a0e8ba3dbcc4bb17794bdb96e68c658e0a724b3157e1cac24a21a0aa15421bcc
MD5 b4a3411fd2dde392c9110d6f3fd89cca
SHA1 3c0ef8599b70977afc486928145461b5939d81fd
SHA512 f0d87457f88ecd33de6c6bd769eb05433617da7354380b69ecd69dc3b10d1955df7e127f9287153f283217162d5bfa8a6cf5932646ed8cbc181b18efddba8895
SSDEEP 12288:sAqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:sAZByOoCjQbGYJxEqadcvTy8qm
TLSH
T19B652393289EC2D9E31557B1EED281C383ACEECA9E774C1BF31F5EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0bc1422e7c6a31aa6b50016d59876a674aedb553c57467a7cc0042a663dbac7f
MD5 224ffa3d9af2a1f40050abbfc1840415
SHA1 2009c11b82d7f778a8b01dcbd7f4220844fa33e9
SHA512 fd70d79fa29531a1b973c1b5b984d1522811981b9d4b9dc2e53478b8356c6f7b5d6ee9a93a8bfbe9ec783b75a005030bf933ca33fd917004e96628a58c95e4a3
SSDEEP 12288:OWqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:OWZByOoCjQbGYJxEqadcvTy8qm
TLSH
T124652393289EC2D9E31557B1EED281C393ACEECA9E774C1BF31F6DE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 a2529af976de3271343a061a402fb4a07abff9dc0bd7b12ebf97ea6f7c3ed670
MD5 e7002e69969568db965fd99ea3cb0644
SHA1 26d6799b2c5d9afe3fc395948fd4634f57733f15
SHA512 901eaf349f230495311f109775f21449263ef930ce1a4e5450f58f442465bba170367ffd91e7889fa9816845d2091e71d70674fddba9a325681e976ef7620d47
SSDEEP 12288:8VZqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:SZByOoCjQbGYJxEqadcvTy8qm
TLSH
T15065239326AE82D4D2669775DEE28093D3B8FDC99F324D5FE3160EDA0E381049D35362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b0ff2d558bd65a364f7faedef5f6bb7245a31960608634c6cd7df9842cf9dca3
MD5 69c9ca58ffa0ab48b85e0002cd68a82d
SHA1 e296f245e4c68f54129cbc24cfba145ef944e78a
SHA512 17bd14d31f2c6907915fa22ab4d9376b2b1765e086500b37c6284da249b16af826e59f655ca00d0ea2e1f49995d7c5bfacff612cf621b3ad696c1c09dde74786
SSDEEP 12288:vRqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:vRZByOoCjQbGYJxEqadcvTy8qm
TLSH
T1AE652393289EC2D9E31557B1EED281C393ACEECA9D774C1BF31F6EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1ceb8a82b8313cd6f594642011714675a072e5f5dfeafda6414188f35bfbb0dd
MD5 da07a830bcf7db96b515288b31e3698a
SHA1 110fffaeb6ee175eb5797f33624de086cf5b6a8c
SHA512 7d554eed28cc0d7ca5eda0a07def8c60faeadbd8e188b8a070a84669007d86453613d56b006283175647ebdff7dd041a14357be7f4997ddd94b53f19b7aa1ea0
SSDEEP 12288:WUqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:WUZByOoCjQbGYJxEqadcvTy8qm
TLSH
T110652393289EC2D9E3155771EEE281C393ACEECA9E774C17F31F5EE9863C0098915162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 1d495b9aabe7fc5cf18c2d149227a949e82c051d5a6248acf418344398db69c3
MD5 e01197fcf2e6f9a901e1326b33e783ec
SHA1 7780108d54a0ead976b0fff935bb14872dd9aea9
SHA512 445405127af5b76a394caf9d732c262e833f8ce8eae26eb9ee6fa21bfa94b057004e77a7ea3c6a535ed723ce6933ecf0fe43564735cbc959ad96f9473e4bc575
SSDEEP 12288:y4qgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:y4ZByOoCjQbGYJxEqadcvTy8qm
TLSH
T111652393289EC2D9E31557B1EED281D383ACEECA9D774C1BF31F5EE9863C0098915162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 b3ca35053d464028ddef4a768cd745deb3182ad43e7f44b8fc1e10eab6e863f2
MD5 567864966da0ed2b10ddde145af450ea
SHA1 64ffd88560932bbadef624b9968127c1bc21eae9
SHA512 065cfb40f5d72f78b3ae7c5442e2af58e7ee8c61ed0f068496e4b4545b7914541c82d3043931875fc349e5b86d37c2290213aaca119e603dae2dab832b4ad282
SSDEEP 24576:iZM9zFVSOgZByOoCjQbGYJxEqadcvTy8qm:iZM9zfwsbZjEuLqm
TLSH
T1CE850295739448F8ED67823ECD558502D2B2BC5A0B70CA1F13A8366B5F373910D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 8c410f116533c57a39207f262518976b033420ec52466d48e38de51835d6e1d4
MD5 d25cb35efa84ee5daa2b2f2f18357dd7
SHA1 56318ff2de59c75170e3e4a38002bc629fdca79e
SHA512 a7318384372d03689c7bbaef33d15ed5196523ff7297dd0f37b6667246ce18306d010c587f996fefcb27b882accc18fded2adc0b2edb43a2b49e88712c3814e5
SSDEEP 12288:mvqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:mvZByOoCjQbGYJxEqadcvTy8qm
TLSH
T16F652393289EC2D9E31557B5EED281C383ACEECA9E774C1BF31F5EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 9978e703163c30ae427ebfe6ba448e9a7373cf20a0846b1727a73ce1e4a4a540
MD5 62baad1b084e8eeba89e71c92a1fb8df
SHA1 0005ab0e41b203f5c51c3b98c677238c239bf891
SHA512 4b380b91fb84e71ada1b8926d4adeb2242930da9152275b06ce106657b38d5c50b854a6056f44030a5fafebcc9095d118526aa8a44dbeda8596a20b1090ec387
SSDEEP 12288:J7qgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:J7ZByOoCjQbGYJxEqadcvTy8qm
TLSH
T146652393289EC2D9E31556B1EED281C383ACEFCA9D774C1BF31F5EE9863C0098915162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 8f012af195016fa6db00695267782819f88eef78eadc095e05bc4f2c5227ae61
MD5 30f88d9254efb01d845b0331668f2a00
SHA1 64834a4034d6cde305aaebb6427f725fe8dcdf86
SHA512 42c09c113010a136177f65cafd6eafe1e5e1be4825f523c6a1b383ea83dd09abc9f1fc97dc12bac683bb0d81e5781941fe13a77cb9200cf66cc25c86d2746866
SSDEEP 12288:DyPz5L8cqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:uzycZByOoCjQbGYJxEqadcvTy8qm
TLSH
T16575125732A560F8D1379239CDA20642F375BC764B318EAF53640BBA1F372919E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 9a106bb255e9afe47b2082bbb954301c8827328837f23ad6c823331ce2584f9a
MD5 424755b7a77de0ef16055d8ddd98aef6
SHA1 03cc3bd1eafac80b0cc7aefa246064d0be352895
SHA512 34ff2501122b58b352552548489142a4de3726f463e1e0f3353c1cdf966a20ce1b166baea95105dac0ce083aab04628bd54ee647a00e201b133ca96b1f62c4da
SSDEEP 12288:hvqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:hvZByOoCjQbGYJxEqadcvTy8qm
TLSH
T107652393289EC2D9E31557B5EED281C383ACEECA9E774C17F31F6EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a2b825316f04203b77ae1e395b626e45d7bbdcf5be5c9e49326dcae16cb2af14
MD5 f4448f7693ceb8161b037b74ee7db998
SHA1 d105ceeb392621185658c99d7d9d71a90aa575b9
SHA512 0e31831d77fb9dce950557aa1baebbfd7b2cb2643f2d644011d4d7f60f2a6ee384b6d61c3378dbad70b79de3fd82522342714c909241561a8d6e565046403e5f
SSDEEP 12288:NvqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:NvZByOoCjQbGYJxEqadcvTy8qm
TLSH
T110652393289EC2D9E31557B5EED281C383ACEECA9D774C17F31F6EE9863C0098915162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e43a02b039f241520caef2192996e4a9f8810de250e3f65829b8844ee5d0fa6f
MD5 ed41eaa04146e02e828deaa4122baabc
SHA1 b8f4aa670891f1f659aa0fe1e4775cd39d3e7e7c
SHA512 1cb59a92a6ba15d4fedb9e2307d79389da9e7c8d24ff780240c9c3e846748edfe44b48219a6aba6ecafa0842d0330be2e57e78cca7573fb5af7a59efa7aaea0c
SSDEEP 12288:kyPz5L8cqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:9zycZByOoCjQbGYJxEqadcvTy8qm
TLSH
T15F75125732A560F8D1379239CDA20642F375BC764B318EAF53640BBA1F372919E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 f89564a03ad07046e3170660a2abf9d200929e1d95784a0857575d2691a9aedc
MD5 f5caa02ed7650e9fdeb577fb0a90e289
SHA1 c445f21527dd6bbeeb9f6dcdfb5c25e813def9de
SHA512 e423838b142adba37b25c1589b0085ae5289439c928dfc00e8e21486cfbbc3e2ad4630a9198dbaeea0cad163a66ae8c6affb5942802159c9e866e4eb1f1a27a2
SSDEEP 24576:ATmaLl3z0zDmZByOoCjQbGYJxEqadcvTy8qm:ATlLljDsbZjEuLqm
TLSH
T1EA8502A5739048F8ED67823ECD668502D2B2BC5A0B70CA1F13A8366B4F373515D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 81a39a7c1b09b9340d0212a63da7103bbad4b1d4e0000921494b889c8a1eb260
MD5 857d510504c6e2c05d1d1812636c40be
SHA1 822434f79dea617c01fb24e87debaad45c7b70b8
SHA512 131adb70d31f8dc56de3adbb4634328dca58c5e86d599cd7eab1f2fbba9503ce85aee7045b101f4183c2d050265cbb074e32aea6ca323f02576c1e91bf0c085e
SSDEEP 24576:q3Sd9CHKy7GZaZByOoCjQbGYJxEqadcvTy8qm:MSd9CHKyawsbZjEuLqm
TLSH
T13A95CF90B3E810E8F1B79A35CD764512DAB67C991B31CE8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 584c795d2d595aa5b3ff4120e22fb0f0b58c2e0d9a95286a983c08a9367253a7
MD5 d212f6408885c75f0e918327d8cd77eb
SHA1 a132340d500e58c29669e0cc1ffc04b2f4842eb7
SHA512 86b8bdbd5240b594702638e2ff7c3f6f0468d5194cb475e386f49ee94c9c5c897c5df6d50076392d03197d0fe3caf4060ba2b7e9a5ea55a2c2f9de0ecf24954b
SSDEEP 12288:K2qgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:K2ZByOoCjQbGYJxEqadcvTy8qm
TLSH
T195652393289EC2D9E31557B1EED681C383ACEECA9D774C1BF31F6EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 50090caf25cae5668410e8203873424e044ec7a421a1bf9e42a0ab417347c812
MD5 74aa645226b40610505e2c8bdaf30357
SHA1 7a46f606a3987f46253af402155d513fa50b0b38
SHA512 0009d1409dda36f25dbd79d1dd1598c522bc5552a1ea9c1cdb4143c26ab4c9604b1413a4217dd715612879fc5158e20fdd7711e6959f22747fb63761d14722a0
SSDEEP 12288:b8qgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:b8ZByOoCjQbGYJxEqadcvTy8qm
TLSH
T191652393289EC2E9E31657B1AEE681C383ACEFC99D774C17F31F5DE9863C0098915162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3de737ed1859f77ca3e91cc937388d1d7beae9e6eeda62fede8f78665a96895a
MD5 d4e9349ec2d4f66a55aa346cf062d3e7
SHA1 46a9ef4f420bc3f8e0609fcaaf94685274e03250
SHA512 64ceca574657ae0b50db9368866b698834a433f0bbcf8c5cb66793658565b99f4bf0986a30ca57e0593faf8bd985de9cf32f2d2162c8634eb939c7fc4a72c0a3
SSDEEP 12288:nVqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:nVZByOoCjQbGYJxEqadcvTy8qm
TLSH
T122652393289EC2D9E31557B5EED281C383ACEECA9E774C1BF31F5EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 622a39108a94ab95cd6449f7e944f2f66a391987f0a2ab26c67b0dae5a2792e3
MD5 6fd30487b9c14f9b8434fc160054ec47
SHA1 84a036fe3ccdf58a4196c78b43baaa80d97e89a7
SHA512 c3c6a7ffa06ee97404bd90ea76c710c7b8436daeb2d1a7ff5e753df5027c556e7e0d8d04b9132a99b885bee0567faf18ea1bbe544b41396b7af64d8c31f4468f
SSDEEP 12288:/vqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:/vZByOoCjQbGYJxEqadcvTy8qm
TLSH
T1DD652393289EC2D9E31557B5EED281C383ACEECA9D774C1BF31F5EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 28722fc701b47cc8e1f437d3765ffc5ff610e1e1068a6ee8f45509fc5f6343b2
MD5 2e7217afcb8d8da321b5fb00bcac51af
SHA1 e702c40c7c4c0e47d6e31c632a718a6ca0d4631e
SHA512 202b0b80bf7d052452e8872adb83cb9e77ef25211c2879cf9fc124b68f2b818d7c6cf180db7102f5ec01b748915ca48114615a9b0103de2f142c43f390d5ce5b
SSDEEP 12288:c2qgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:c2ZByOoCjQbGYJxEqadcvTy8qm
TLSH
T18A652393289EC2D9D31557B1EED281C393ACEECA9D774C1BF31F6EE9863C0098916152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 5cb6b597cb5f2cf87bb3a60421ece777f5c2d75a173c704c0b472586c16a31df
MD5 60de09a1b87856a24cfeb69a0a4950ca
SHA1 a661571e2b7be7fd41b9d88ea70b2f6871bfbc0d
SHA512 b86cce9ea59f74828cac7f1f1420a23cc1d49e98f7fdbd4476d824dad7021094d81c5311611f2ed97be3fb1d986c40f2aa13ea27f09129fedd4bf4a4b730804c
SSDEEP 12288:0HqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:0HZByOoCjQbGYJxEqadcvTy8qm
TLSH
T113652393289EC2D9D31557B1EED281D383ACEECA9D774C1BF31F6EE9863C0098915162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 9776c1e5e7657635abdb7d0fb661f8b5a8bcaa11607c909ca5c0e4a91ce391bf
MD5 952f61331c2b7799d554f406c1839136
SHA1 0f3bbea2c90ac0421e54beecd464f31d629972a0
SHA512 0d1519775e5f226d9a2c9df97eb9b991f92ca9dbe3f84e1ea16b201d25ca8d5df3259f6c843e2854390d62bda079f08d1d66fd7ab1b6849324f1110dfb1615d5
SSDEEP 12288:qRqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:qRZByOoCjQbGYJxEqadcvTy8qm
TLSH
T11B652393289EC2D9E31557B1EED281C393ACEECA9D774C1BF31F6EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 953c21ce1ec95200f05e928d71a91ad825fe3febeec2995c97716b7683c6f2c8
MD5 9aef02d684c75e21be58ee767dca0c13
SHA1 e8b42026bfe4299f206262467dde880cd1ef0c33
SHA512 2f3660ecd4162da551cb9817eb8f5c24312261be932ee075f4a0d0291e27b9ac1aa0fe518ffc354028faff4103902363eb4728152d5c606f86900eab1e4b83b9
SSDEEP 12288:GeqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:GeZByOoCjQbGYJxEqadcvTy8qm
TLSH
T13C652393289EC2D9D31556B1EED281D383ACEECA9D774C17F31F5EE9863C0098916112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 9560b218308bc2c656577ca47309fee616ce8d6b8f890f29a6fd5d54d18c03ac
MD5 95ded9bdf5a45649a7a0b5598dcad7f1
SHA1 43b9170de5a2fb5a7353e398522c13b711feb652
SHA512 96d7cb71567bd5e06fa755c985fdbfed5426f4dd2391db6ac9011e747f53f98fbbd7c4169c4fc1e22a92628a8e269564d58a2db358ecd44ee085c0d09ed44525
SSDEEP 12288:ORqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:ORZByOoCjQbGYJxEqadcvTy8qm
TLSH
T108652393289EC2D9E31557B1EED281C393ACEECA9D774C1BF31F6EE9863C0098915152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 05c47da096a835d05878b85fd077f0c208eeb3dce41a7a42a04280c8a9a5c49f
MD5 8c4da1fb57dffe19a6668c449248aca7
SHA1 5fb01786c0d876e25695382549decfe4c53779cb
SHA512 73db2632b9e4019fc7f0f8ae84879cc382978c4dc0d3288321b8846a1cc1a0c79529c3e13b56c62c0a568d1b6fc14090860b4d142dfb891b4d9103bfb7edbe36
SSDEEP 24576:dfwvpk9RX6wkyAIrZByOoCjQbGYJxEqadcvTy8qm:CMnYI5sbZjEuLqm
TLSH
T14595DF29EBDC44E5E1B7923C99B3460AF2B178591B31C6CF025A53AD0E37ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e3ef7c8c948a38de1f7d6bfa886619e1cbbd4befaf96dc6c0c020b8e192e442b
MD5 3de21b638da80aa99d8673d37dd416ab
SHA1 87b573ace3afdd52c503e03d40eae5278d5fbe79
SHA512 af5b2cf1aae4093d69d118a9d6da41581c4be3c0eb9dc4d950fa7764953a356866659db6ce84b97609f3605b12d13f10dd420a982ac481e35e4f61ac12e47768
SSDEEP 49152:rYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WsbZjEuLqm:PySzPOYjEuOm
TLSH
T17D066C96A1A841D5C1B9C1B98B1BCC17FBB134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4372da58f53937e9ad104b1da948d17ca6745efbba45a49caa04b5c1c095334f
MD5 55c76e1f96b7b1d1a404fb6da12c4602
SHA1 c1f1fd9cd09617c410fbbd4f2b1a46f15f9f0fa3
SHA512 3db46314e31213ee1ef1245830d15e2880a3cb8e647d8feae56a80063ea8569af377aa9a72fb01e81d07c1e6536f074ad3efd67cda30ea787f41b1d064b87b9c
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYQZByOoCjQbGYJxEqadcvTy8qm:147JUQj1irIhCnDHUPfF/GsbZjEuLqm
TLSH
T10965AE1EA3EC01E5E1BA92788555465AEA71782E1F31CACF2270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 191b5105962f9ab01ab7cf1e55b351021b2d7f9f651d29da7d9e3c6a50890fff
MD5 25059452d51ba20f8758ee389562603b
SHA1 5f37e07df724bb253e730cbf93972406cd866564
SHA512 3fbac95b834901e8b21dbcd414ec706822587ecc3e471c28664fc93b95e8991ed38469b1a7bcfbd40bf167733c3ace5812e7cf163a2005be85245927d0817696
SSDEEP 12288:mesf/qgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:+/ZByOoCjQbGYJxEqadcvTy8qm
TLSH
T16C75F15AD29842E8C16E6275CB968241B3777C658BF1C7CB63D0F97E0F391809DEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 f785556f0d8e87463cd9b3f32d9b9b416ea824216ba43a79477449bb0a0f61e0
MD5 6eb0592cb4f05ea2c75d6e278f7ac1c3
SHA1 b6f86bdb7d75887a5994a3d2f06f2b9cee975915
SHA512 f80489fbe494171eb486cb4b60f840250907f2208e8fa32665e5013fe54dd431b2bb76e432a10538826af8d0e1bc1447496c17d3f12ba16f3c5578f6fbc880eb
SSDEEP 24576:fTVmUPUnNpCISUTOpuiVoGSnjeItgd1MgpDp:BmUsnNpCISUTOUiVbIed2gpV
TLSH
T1E75528007626CB8FC66940325E36D6CCA770BD46FE44AF1373C9973F8476659BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 1065a26ddfef7e6e2ec815b9e9cd8799729ec6318e97059c77813bcc342d6eb4
MD5 461958aebaa68b6bd8d1994fbd67940a
SHA1 389653b1d1bae58e6e4cb121415b7d82c64f5bdf
SHA512 59f96b9d4837f47e5e0449936fe64b5ccfbb6d87ceb3f1c6843b256a55ffab6760b969bcca79bcfffc9c6e0bcbfa500d2590524b206f7b0b44c4b1175e296a28
SSDEEP 3:OlH/l4PTUpVKylllCj2l/vl/bl3y9Gxtg3mCllltGlslslslslslsl62/S8t:KqPTuKytCA9ZQK0mCtEEEEEEEE8
TLSH
T17881925047932731CA6AD538006E03A607A2CE8160E18397320225621C50558AC19A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 505b35c4795776c7587e1d1ba33cde79ab58d5c776957f8af3ae9a9cb92bc22b
MD5 7e44c10833b6da1d48ffa679a1c23709
SHA1 357602351d3d2e027942a53274e3710f406595e1
SHA512 7aff35e5250d045b526ce909f6b34fcf81cdb0c0f96dd751b37e3c4f91ed22d3e4811089b55f289531be035721656323faaa78415310dc4e6627473a50bdc53e
SSDEEP 12288:EEY8o8XNeLlkdphlD7jJCE+GCCW9ibrAwRw3iAQ:EN8oCakd7x3wwDfm
TLSH
T17845090065E7EB4FC97E5037037286CD7BB8AC07B7893F0573458938986696EB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 cfaa5cb3d1413eee750b32f7e9201b1a4fb5167248b611763221aa686b5860f5
MD5 e7a31a579e3af28ca5503b1d64a47b5a
SHA1 ef68e3a929624853bdcc795faf15f478fcaec865
SHA512 137c9f718739fd3285152ca82e098f06e7a350e2ea03bcea3bcdef4229a3f20999ca0027a3205667a7b58e597437194989c4c5dc48423ad3e323495b405ec53e
SSDEEP 12288:j/7XqgByOoCFZQbwhyyBeJOyEThArOdcmug2EE4X8qm:3XZByOoCjQbGYJxEqadcvTy8qm
TLSH
T12F6523A3169DC699E2762770ADEAC062536DFE984F318CD7F30A6AE9853C085CD35213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 2c8644cc15a72269949a895d08918457d8472a93863b3cd21b5fb6036d93e7d4
MD5 9a4d721196360b77350a82e0a7bbae32
SHA1 8050f6f5aaa1750d624e491a62a994c7cf2e3b75
SHA512 e53bb27f4a1b32f14123f06cbb0e5847005e956e3ce2d261c22e96e7457dc3f9cbf8bf137eb24d2e4c9c3e5bc405630fd58bc8e2fceba5116b1392276dd051bf
SSDEEP 24576:ZG88u8FpJqH16zria7/mgZByOoCjQbGYJxEqadcvTy8qm:M7ZFPqVFa7/rsbZjEuLqm
TLSH
T16895F16576E502F0D47BD1388A824663F6B2B8250374EFDF07A88B951F236D54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 60b7da9cd1b301ad4fa79f1321cba050fcc80c7a7ee6a189d347b66beb456cb5
MD5 811968999a38ea16a267c6cf5c7bd183
SHA1 766171269f5c9342ccb6c1ffc00ac13db5f84a54
SHA512 36225b99eeaee40ff960e751b5e08ab7a8c5bf77fde710be99a7ffe7c193e30e29ce54c4749e2e2e71cba77563e7f4a18ff3ff5e4bd99e2abca37d1a43002a9c
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAsbZjEuLqm:3G05lO43bBYjEuOm
TLSH
T115D5C06A62EC11F8D1BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 457276a1ba41828525fbf8fe38c249eb5626967723fda1de0ff3afd3f6e8f03d
MD5 f6146babb4c4a70ca1eeb609101ef283
SHA1 5990858864346820eb8336d1d1200b0b07a8d543
SHA512 3f434056f1446343dde52326d1360c86af7bfc879ed651e6977058d8c77fb18b6030a5d67a8227d657c64539a328f07e9d90f67d4316b2de06d5aa060e2bbfd0
SSDEEP 24576:lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnyZByOoCjQbGYJxEqadcvTy8qm:la5POZ3+Jt2pasx2+mYsbZjEuLqm
TLSH
T12565BF5EA6FC01D5D179D17DC583861AF5B1342653329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 046a37426456a361709984bd0cbd3fe73d8e881117d048d4092b6b3e99eff033
MD5 88117a8b015bea7e30fbe21dfdcecb3b
SHA1 22e8dfafde189e34cf2079822fcba179e4a00f40
SHA512 c8bf55f87ae4335ad4c50bd6f2da55fe674b8db185b1566aa2467a005a3d794f6718ae718c2b2c2195b7e312196559ae09b7c8239be590c9e07cb53895d0d2ec
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkIZByOoCjQbGYJxEqadcvTy8qm:oNc/zEOVHFLsbZjEuLqm
TLSH
T17D857B1622E901E4F1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 029cd43b814071285efd2fcadb8c75b8c36104cbfb3230332c581dcbc7fd00e6
MD5 9db26c1575a234054bf609a4ea6e582f
SHA1 13c7b2cf37c222a6828212b852f1ba0a560e24be
SHA512 43919498c551bb7b1f3d05616734679660aea6dcd4d5f650ab96806c6dc617a7c0a8e73837133bdafa4f379635ea21333ecc871165063d1c4df6bd5db0d44cd3
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bY9ZByOoCjQbGYJxEqadcvTy8qm:Mgb4mBIBhGFksbZjEuLqm
TLSH
T13F65AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e09cbd2f599421a0812f4b49bafaea655910bad2983dc3770826b057db074fd9
MD5 8ec63be56433626c60b949254743457b
SHA1 568b143799cce97db713242499745e698575a20c
SHA512 79f81b6dc2209ce27d43f25e167d54e3409be325adcd27757bf3c667d627f0551b7889758fd683254eb936ee5c2b2ef4b0acc506a51e107671d0a92bfa20286f
SSDEEP 24576:28kNvNnaFeYhJNtmZBmeZByOoCjQbGYJxEqadcvTy8qm:28MwBtOmqsbZjEuLqm
TLSH
T1E055AF6EB6F846E4D1FAC6B5CD238112E6727861073292CB9390C13F4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 16c363d30f1ec7c5ad656f2ca8989428fcf14206ddb883d5f577f62f0e671485
MD5 e5512be49902db0d35537831f68fa899
SHA1 82aa728d70fa0966c05cff3e7c6e139a7d083db2
SHA512 4087210bf664047c9f776278ca2ab25e05266c4899acce337f4e9a60621b02b20652c32448f0cb74d79de5d8c11b2ed8cdd0b88091394ecc9bea16d9ecb20e9b
SSDEEP 24576:GPUr+NQEZByOoCjQbGYJxEqadcvTy8qm:GJQwsbZjEuLqm
TLSH
T17775E12F26ED18E5E676E17D89828209F771B8620712D6CF02A1817E4F379D8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 9517677b982abc8fd135afa28cef13e5969134bbb06ce032d4de0b4bdfe6146a
MD5 6193c53affe642e00c8e6790d9dc1b7e
SHA1 9a02c1570110488097f4d6c3cca41c78dd31080e
SHA512 6f601acb2015763901f58da81d1829e12e08fcbfe79c5b49d4a9d82796f1180fcdd48a439ba5db7c285c4a8f8c176ea86e5ded5aed0a45a78308354d83232a53
SSDEEP 24576:4D3FHshBIYQgAzZByOoCjQbGYJxEqadcvTy8qm:4DVHeBIAAxsbZjEuLqm
TLSH
T1C185E17EE69C00E4D57BD1BCDAA38507E37138A9073259CB129481BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/552-146-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/552-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/552-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/552-144-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1192-409-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1192-99-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1192-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1192-407-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1192-393-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1192-105-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2432-352-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2432-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2432-64-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2432-71-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2612-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2612-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2612-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2612-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2612-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2656-62-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/2656-48-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/2656-60-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2656-57-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2656-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4240-31-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4240-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4240-24-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4240-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4240-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4648-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4648-112-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4648-353-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4648-118-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4648-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5284-88-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/5284-379-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/5284-89-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/5284-94-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/5512-406-0x00000273BBFA0000-0x00000273BC17B000-memory.dmp

Download

memory/5680-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5680-395-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5680-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5680-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5704-76-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5704-78-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5704-364-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5704-84-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5864-123-0x0000000140000000-0x000000014020D000-memory.dmp

Download

memory/5864-394-0x0000000140000000-0x000000014020D000-memory.dmp

Download

memory/5864-125-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5864-131-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5888-16-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/5888-255-0x0000000140000000-0x0000000140270000-memory.dmp

Download

memory/5888-245-0x0000000003110000-0x0000000003170000-memory.dmp

Download

memory/5888-239-0x0000000003110000-0x0000000003170000-memory.dmp

Download

memory/5888-17-0x0000000002880000-0x0000000002904000-memory.dmp

Download

memory/5888-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/5888-0-0x0000000140000000-0x0000000140270000-memory.dmp

Download

memory/5888-9-0x0000000002880000-0x0000000002904000-memory.dmp

Download

memory/5888-75-0x0000000140000000-0x0000000140270000-memory.dmp

Download

memory/5888-248-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/5888-251-0x0000000003110000-0x0000000003170000-memory.dmp

Download

memory/5888-249-0x0000000002880000-0x0000000002904000-memory.dmp

Download